From 1f805378d454dac48b5c214029d254055fdf961b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 05:35:20 -0400
Subject: [PATCH 01/29] feat(window): shared craft-window crate for consistent
 window decorations (#217)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(window): shared crate deciding who draws the window frame

Add craft-window, which decides whether the desktop or the app draws the
window frame (titlebar, borders, window buttons) and applies it to an
egui ViewportBuilder. This fixes the drift where some Craft apps drew
their own titlebar on KDE while others kept KWin's.

The rule: macOS, Windows and X11 keep the desktop frame; a Wayland
compositor with zxdg_decoration_manager_v1 (KDE, Sway, Hyprland, COSMIC)
keeps its frame; one without it (GNOME) leaves the frame to the app.
<PREFIX>_TITLEBAR=app|system|desktop overrides. When the app draws the
frame, the decision carries the window-button Layout from GNOME's
button-layout so the app's header bar matches the desktop's order.

Decision logic only; drawing the buttons stays in each app. Extracted and
generalized from pdfcraft's decorations.rs. forbid(unsafe_code); default
build has no egui dependency (egui feature adds decorate()).

* style(window): rustfmt the Wayland probe and Dispatch impl

cargo fmt --check failed CI: collapse the thread-spawn builder chain and
the Dispatch::event signature onto the lines rustfmt wants (verified with
rustfmt 1.98 against the workspace rustfmt.toml).

* fix(window): address review — WAYLAND_SOCKET, bounded gsettings, checkout creds

- Skip the Wayland probe when WAYLAND_SOCKET is set: connect_to_env would
  take ownership of the inherited fd and unset the variable, closing the
  descriptor winit needs. Keep the desktop frame instead.
- Run the gsettings button-layout lookup behind the same 500 ms bounded
  worker as the Wayland probe, so a stalled gsettings can't block startup.
  Factored the worker into a shared bounded() helper.
- window.yml: set persist-credentials: false on checkout so the token
  isn't left in .git/config while cargo runs dependency build scripts.
- README: document the socket guard and the bounded gsettings lookup.

Verified with rustfmt 1.98 and clippy -D warnings (both feature sets).

* fix(window): reap the gsettings child on timeout; document probe tradeoffs

Follow-up to review: the button-layout lookup now spawns gsettings with
piped output, reads it on a worker, and kills+reaps the child whether it
finishes or times out — so a stalled gsettings leaves neither a blocked
process nor a parked worker (it is a one-shot startup call).

Also document, on the Wayland probe, that an inherited WAYLAND_SOCKET
(rare; normal launches get WAYLAND_DISPLAY) deliberately falls back to the
desktop frame to protect winit's connection — the same frame an app that
doesn't probe would get, a safe default rather than a regression.

Verified: rustfmt 1.98 clean, clippy -D warnings clean (default + egui),
tests pass.
---
 .github/workflows/window.yml |  36 +++
 Cargo.lock                   |   8 +
 Cargo.toml                   |   1 +
 crates/window/Cargo.toml     |  22 ++
 crates/window/README.md      |  70 ++++++
 crates/window/src/lib.rs     | 439 +++++++++++++++++++++++++++++++++++
 6 files changed, 576 insertions(+)
 create mode 100644 .github/workflows/window.yml
 create mode 100644 crates/window/Cargo.toml
 create mode 100644 crates/window/README.md
 create mode 100644 crates/window/src/lib.rs

diff --git a/.github/workflows/window.yml b/.github/workflows/window.yml
new file mode 100644
index 00000000..61407086
--- /dev/null
+++ b/.github/workflows/window.yml
@@ -0,0 +1,36 @@
+name: Window decorations
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: ['crates/window/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/window.yml']
+  pull_request:
+    paths: ['crates/window/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/window.yml']
+
+permissions:
+  contents: read
+
+jobs:
+  window:
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The token isn't needed after checkout; cargo runs build scripts and proc macros from
+          # dependencies, so don't leave it in .git/config for that third-party code to read.
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - run: cargo fmt --check
+      # Default (no egui) and the egui feature both build and lint cleanly.
+      - run: cargo clippy -p craft-window --all-targets --locked -- -D warnings
+      - run: cargo clippy -p craft-window --all-targets --locked --features egui -- -D warnings
+      - run: cargo test -p craft-window --locked -- --nocapture
+      - run: cargo test -p craft-window --locked --features egui -- --nocapture
diff --git a/Cargo.lock b/Cargo.lock
index 4d9de428..4c7cda04 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -732,6 +732,14 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "craft-window"
+version = "0.1.0"
+dependencies = [
+ "egui",
+ "wayland-client",
+]
+
 [[package]]
 name = "craft-winprint-gdi"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index ca53f61a..319c1138 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,6 +29,7 @@ craft-print = { path = "crates/print" }
 craft-quit = { path = "crates/quit" }
 craft-settings = { path = "crates/settings" }
 craft-ui = { path = "crates/ui" }
+craft-window = { path = "crates/window" }
 egui = { version = "0.36", default-features = false }
 rayon = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/window/Cargo.toml b/crates/window/Cargo.toml
new file mode 100644
index 00000000..54db833d
--- /dev/null
+++ b/crates/window/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "craft-window"
+description = "Decide who draws the window frame on Linux (the compositor or the app) and apply it, so every Craft app gets the same native titlebar and borders per desktop."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[features]
+# `apply`/`decorations`: decide decorations and set them on an `egui::ViewportBuilder`.
+egui = ["dep:egui"]
+
+[dependencies]
+egui = { workspace = true, optional = true }
+
+# Only Linux and the BSDs probe a Wayland compositor; everywhere else the frame is the OS's.
+[target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))'.dependencies]
+wayland-client = "0.31"
+
+[lints]
+workspace = true
diff --git a/crates/window/README.md b/crates/window/README.md
new file mode 100644
index 00000000..75b4c681
--- /dev/null
+++ b/crates/window/README.md
@@ -0,0 +1,70 @@
+craft-window
+============
+
+Decide who draws the window frame — the desktop or the app — so every Craft app shows the same
+titlebar and borders on a given desktop.
+
+## Why
+
+egui apps either keep the desktop's window frame (titlebar, borders, window buttons) or turn it off
+and draw their own. Across the suite this had drifted:
+
+- some apps always drew their own frame on Linux (so KDE's titlebar was replaced by the app's),
+- some always kept the desktop's,
+- some probed the compositor and only drew their own on GNOME.
+
+So two Craft apps open side by side on KDE could wear different titlebars. This crate makes the
+decision in one place, matching each desktop.
+
+## The rule
+
+| Platform | Frame |
+| --- | --- |
+| macOS, Windows | desktop (the OS) |
+| Linux/BSD on X11 | desktop (the window manager) |
+| Linux/BSD on Wayland **with** `zxdg_decoration_manager_v1` (KDE, Sway, Hyprland, COSMIC) | desktop (the compositor) |
+| Linux/BSD on Wayland **without** it (GNOME's Mutter) | the app |
+
+When the app draws the frame, the decision carries the window-button `Layout` the desktop names
+(GNOME's `button-layout`), so the app's header bar puts minimize/maximize/close where that desktop
+puts them. This crate decides *whether* and *where*; drawing the buttons stays in each app, whose
+title bars differ.
+
+### Override
+
+`<PREFIX>_TITLEBAR` forces the choice. With the default prefix `CRAFT`: `CRAFT_TITLEBAR=app` forces
+the app frame, `=system` (or `=desktop`) forces the desktop frame. Apps pass their own prefix
+(`Prefix::new("PDFCRAFT")` → `PDFCRAFT_TITLEBAR`) so each keeps its own variable name.
+
+## Use
+
+```rust,ignore
+use craft_window::{Choice, Prefix, decorate};
+
+// Once at startup, before the window is created:
+let choice = Choice::probe(Prefix::new("PHOTOCRAFT"));
+let viewport = decorate(egui::ViewportBuilder::default().with_title("PhotoCraft"), choice.frame());
+
+// If the app draws the frame, lay the header-bar buttons out by the desktop's order:
+if let Some(layout) = choice.frame().layout() {
+    // layout.left / layout.right -> draw Minimize/Maximize/Close there
+}
+```
+
+An app that offers a "System title bar" preference checks `choice.overridden()` and its own setting,
+and can override the probe by setting the frame to `Frame::Desktop`.
+
+The `egui` feature adds [`decorate`]. Without it, the crate is pure decision logic (`Choice`,
+`Frame`, `Layout`) with no egui dependency.
+
+## Notes
+
+- The Wayland probe opens a short-lived connection and reads the global registry once, on its own
+  thread with a 500 ms timeout; on failure or timeout it keeps the desktop's frame. Call it once at
+  startup.
+- It never touches the connection winit inherits: when `WAYLAND_SOCKET` is set (a compositor handed
+  the app an open descriptor), the probe skips connecting and keeps the desktop frame, so it can't
+  consume the socket winit needs.
+- The GNOME `button-layout` lookup (`gsettings`) runs behind the same bounded worker, so a stalled
+  `gsettings` can't block startup either.
+- `#![forbid(unsafe_code)]`, and the never-crash lints the workspace requires.
diff --git a/crates/window/src/lib.rs b/crates/window/src/lib.rs
new file mode 100644
index 00000000..42f936c5
--- /dev/null
+++ b/crates/window/src/lib.rs
@@ -0,0 +1,439 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+//! Decide who draws the window frame, so every Craft app shows the same titlebar and borders on a
+//! given desktop.
+//!
+//! egui apps either let the desktop draw the window frame (the title bar, borders and window
+//! buttons) or turn it off and draw their own. Across the suite this decision had drifted: some
+//! apps always drew their own frame on Linux, some always kept the desktop's, and some probed the
+//! compositor — so on KDE, say, one app wore KWin's title bar while another wore its own. This
+//! crate makes the decision one place.
+//!
+//! The rule, by platform:
+//!
+//! - **macOS and Windows:** the OS always draws the frame ([`Frame::Desktop`]). (An app that insets
+//!   its content under the traffic lights, or draws its own caption buttons on Windows, still asks
+//!   the OS for a decorated window and overdraws it; that is the app's choice and not this crate's.)
+//! - **Linux and the BSDs, X11:** the window manager draws the frame ([`Frame::Desktop`]).
+//! - **Linux and the BSDs, Wayland:** a compositor that offers server-side decorations
+//!   (`zxdg_decoration_manager_v1` — KDE, Sway, Hyprland, COSMIC) draws the frame
+//!   ([`Frame::Desktop`]). One that does not (GNOME's Mutter) leaves the frame to the app
+//!   ([`Frame::App`]): without this, winit draws an imitation frame that matches no desktop.
+//!
+//! An environment variable overrides the choice, for users whose compositor the probe can't read
+//! or who simply prefer the other frame. With the default prefix `CRAFT`, `CRAFT_TITLEBAR=app`
+//! forces [`Frame::App`] and `=system` (or `=desktop`) forces [`Frame::Desktop`]; apps may pass
+//! their own prefix (`PDFCRAFT`, `FIGCRAFT`, …) so each keeps its own variable name.
+//!
+//! When the app draws the frame, [`Frame::App`] carries the [`Layout`] of window buttons the
+//! desktop names (GNOME's `button-layout`), so the app's header bar puts minimize, maximize and
+//! close where that desktop puts them. This crate decides *whether* and *where*; drawing the
+//! buttons stays with each app (their title bars differ).
+//!
+//! # With egui
+//!
+//! The `egui` feature adds [`decorate`], which applies the decision to an
+//! [`egui::ViewportBuilder`] before the window is created:
+//!
+//! ```ignore
+//! let viewport = egui::ViewportBuilder::default().with_title("PhotoCraft");
+//! // The app may still prefer its own frame when the user asked for it in preferences:
+//! let choice = craft_window::Choice::probe(craft_window::Prefix::default());
+//! let viewport = craft_window::decorate(viewport, choice.frame());
+//! ```
+//!
+//! The probe opens a short-lived Wayland connection and reads the global registry once; it never
+//! touches the connection winit inherits. Call it once at startup.
+
+/// The environment-variable prefix an app overrides the frame with: `<PREFIX>_TITLEBAR`.
+///
+/// `Prefix::default()` is `CRAFT`, so `CRAFT_TITLEBAR`. An app that wants its own name passes
+/// [`Prefix::new`] (`Prefix::new("PDFCRAFT")` reads `PDFCRAFT_TITLEBAR`). The name is used as
+/// given; it should be ASCII letters, digits and underscores, as environment names are.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Prefix(&'static str);
+
+impl Default for Prefix {
+    fn default() -> Self {
+        Self("CRAFT")
+    }
+}
+
+impl Prefix {
+    /// An app-specific prefix, so the override variable is `<prefix>_TITLEBAR`.
+    pub const fn new(prefix: &'static str) -> Self {
+        Self(prefix)
+    }
+
+    /// The environment variable this prefix reads, e.g. `CRAFT_TITLEBAR`.
+    pub fn var_name(self) -> String {
+        format!("{}_TITLEBAR", self.0)
+    }
+}
+
+/// Who draws the window frame.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Frame {
+    /// The desktop draws it: the OS on macOS and Windows, the window manager on X11, the
+    /// compositor on a Wayland session with server-side decorations. The app leaves decorations on.
+    Desktop,
+    /// The app draws it (GNOME's Wayland session, or an override). The app turns decorations off
+    /// and draws a header bar with the window buttons in this [`Layout`].
+    App(Layout),
+}
+
+impl Frame {
+    /// Whether the app should keep the OS/compositor decorations on (`true` for [`Frame::Desktop`]).
+    /// This is the value to pass to `egui::ViewportBuilder::with_decorations`.
+    pub fn decorations(&self) -> bool {
+        matches!(self, Frame::Desktop)
+    }
+
+    /// The window-button layout when the app draws the frame, else `None`.
+    pub fn layout(&self) -> Option<&Layout> {
+        match self {
+            Frame::App(layout) => Some(layout),
+            Frame::Desktop => None,
+        }
+    }
+}
+
+/// How the frame was decided, so an app can log it or offer a "System title bar" preference that
+/// knows the current state.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Choice {
+    frame: Frame,
+    /// `Some(true)` when `<PREFIX>_TITLEBAR` forced the app frame, `Some(false)` when it forced the
+    /// desktop frame, `None` when the platform decided.
+    overridden: Option<bool>,
+}
+
+impl Choice {
+    /// Probe the running platform and desktop and decide who draws the frame.
+    ///
+    /// `prefix` names the override variable (`<prefix>_TITLEBAR`). On macOS, Windows and X11 this
+    /// does no I/O; on a Wayland session it opens a short-lived connection to read the registry.
+    pub fn probe(prefix: Prefix) -> Self {
+        match override_frame(&prefix.var_name()) {
+            Some(true) => Self { frame: Frame::App(Layout::from_desktop()), overridden: Some(true) },
+            Some(false) => Self { frame: Frame::Desktop, overridden: Some(false) },
+            None if app_draws_frame() => Self { frame: Frame::App(Layout::from_desktop()), overridden: None },
+            None => Self { frame: Frame::Desktop, overridden: None },
+        }
+    }
+
+    /// The decided frame.
+    pub fn frame(&self) -> &Frame {
+        &self.frame
+    }
+
+    /// The decided frame, consumed.
+    pub fn into_frame(self) -> Frame {
+        self.frame
+    }
+
+    /// Whether `<PREFIX>_TITLEBAR` set the frame: `Some(true)` it forced the app's, `Some(false)`
+    /// the desktop's, `None` the platform decided.
+    pub fn overridden(&self) -> Option<bool> {
+        self.overridden
+    }
+}
+
+/// Read `<var>`: `app` → force the app frame, `system`/`desktop` → force the desktop frame,
+/// anything else (or unset) → let the platform decide.
+fn override_frame(var: &str) -> Option<bool> {
+    parse_override(std::env::var(var).ok().as_deref())
+}
+
+/// The override a `<PREFIX>_TITLEBAR` value asks for: `Some(true)` the app frame, `Some(false)` the
+/// desktop frame, `None` to let the platform decide. Pure, so it is tested without the environment.
+fn parse_override(value: Option<&str>) -> Option<bool> {
+    match value.map(str::trim) {
+        Some("app") => Some(true),
+        Some("system" | "desktop") => Some(false),
+        _ => None,
+    }
+}
+
+/// A window button.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Button {
+    Minimize,
+    Maximize,
+    Close,
+}
+
+/// Which window buttons go on which end of the app-drawn header bar, outermost last.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Layout {
+    pub left: Vec<Button>,
+    pub right: Vec<Button>,
+}
+
+impl Default for Layout {
+    /// What a desktop that names no layout gets: all three, on the right.
+    fn default() -> Self {
+        Self { left: Vec::new(), right: vec![Button::Minimize, Button::Maximize, Button::Close] }
+    }
+}
+
+impl Layout {
+    /// The desktop's window-button layout, read from GNOME's `button-layout` where it is set, else
+    /// the default (all three on the right). Only meaningful when the app draws the frame.
+    pub fn from_desktop() -> Self {
+        desktop_button_layout()
+    }
+
+    /// Parse GNOME's `org.gnome.desktop.wm.preferences button-layout`: `left:right`, each a comma
+    /// list such as `appmenu:minimize,maximize,close` (Fedora's default is `appmenu:close`).
+    /// Without a colon everything is on the left, as in GTK. Names this crate has no button for
+    /// (`appmenu`, `icon`, `menu`, `spacer`) are skipped, and a button named twice appears once.
+    /// `gsettings` prints the value quoted; the quotes are dropped.
+    pub fn parse(value: &str) -> Self {
+        let value = value.trim().trim_matches(|c| c == '\'' || c == '"');
+        let (left, right) = value.split_once(':').unwrap_or((value, ""));
+        let mut seen: Vec<Button> = Vec::new();
+        let mut side = |list: &str| {
+            let mut out = Vec::new();
+            for name in list.split(',') {
+                let button = match name.trim() {
+                    "minimize" => Button::Minimize,
+                    "maximize" => Button::Maximize,
+                    "close" => Button::Close,
+                    _ => continue,
+                };
+                if !seen.contains(&button) {
+                    seen.push(button);
+                    out.push(button);
+                }
+            }
+            out
+        };
+        let left = side(left);
+        let right = side(right);
+        Self { left, right }
+    }
+
+    /// Whether the layout has at least one button, so the window can be closed by mouse. A layout
+    /// with none (a desktop that named only buttons this crate skips) falls back to the default.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd", test))]
+    fn is_usable(&self) -> bool {
+        !self.left.is_empty() || !self.right.is_empty()
+    }
+}
+
+/// GNOME's button layout where `gsettings` can read it, else the default. Returns the default on
+/// any platform without `gsettings` or when the value names no usable button.
+fn desktop_button_layout() -> Layout {
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+    if let Some(value) = platform::gsettings_button_layout() {
+        let layout = Layout::parse(&value);
+        if layout.is_usable() {
+            return layout;
+        }
+    }
+    Layout::default()
+}
+
+/// Whether the app should draw the frame itself: a Wayland compositor with no server-side
+/// decorations. `false` on macOS, Windows, X11 and any Wayland compositor that decorates.
+fn app_draws_frame() -> bool {
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+    {
+        platform::wayland_leaves_frame_to_app()
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd")))]
+    {
+        false
+    }
+}
+
+/// Apply a [`Frame`] to an [`egui::ViewportBuilder`]: decorations on for the desktop frame, off for
+/// the app frame. Call before the window is created. The app still draws its header bar and, for
+/// [`Frame::App`], lays its window buttons out by [`Frame::layout`].
+#[cfg(feature = "egui")]
+pub fn decorate(builder: egui::ViewportBuilder, frame: &Frame) -> egui::ViewportBuilder {
+    builder.with_decorations(frame.decorations())
+}
+
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+mod platform {
+    use std::process::{Command, Stdio};
+    use std::sync::mpsc;
+    use std::time::Duration;
+
+    use wayland_client::globals::{GlobalListContents, registry_queue_init};
+    use wayland_client::protocol::wl_registry;
+    use wayland_client::{Connection, Dispatch, QueueHandle};
+
+    /// Whether this is a Wayland session whose compositor offers no server-side decorations
+    /// (`zxdg_decoration_manager_v1`), so the frame is left to the app (GNOME). `false` on X11
+    /// (no Wayland connection) and on any compositor that offers them (KDE, Sway, Hyprland,
+    /// COSMIC).
+    ///
+    /// Called once at startup, before the window is created. It runs the registry read on a
+    /// worker thread with a 500 ms deadline so a stalled compositor can't block startup; on
+    /// failure or timeout it returns `false` and the window keeps the desktop's frame. (A
+    /// compositor that never answers would leave that one worker parked for the process's life;
+    /// acceptable because this is a single, one-shot call, not a repeated one.)
+    pub(super) fn wayland_leaves_frame_to_app() -> bool {
+        bounded(registry_leaves_frame_to_app).flatten().unwrap_or(false)
+    }
+
+    /// Run `f` on a short-lived worker thread with a 500 ms deadline, so a stalled dependency can't
+    /// block window startup. `None` when the thread can't be spawned or `f` doesn't finish in time;
+    /// otherwise `f`'s return value. For a child process, prefer [`gsettings_button_layout`], which
+    /// also kills and reaps the child on timeout; this helper only bounds the caller's wait.
+    fn bounded<T: Send + 'static>(f: impl FnOnce() -> T + Send + 'static) -> Option<T> {
+        let (send, receive) = mpsc::sync_channel(1);
+        let spawned = std::thread::Builder::new().name("craft-window-probe".into()).spawn(move || {
+            let _ = send.send(f());
+        });
+        if spawned.is_err() {
+            return None;
+        }
+        receive.recv_timeout(Duration::from_millis(500)).ok()
+    }
+
+    /// A fresh connection (never winit's inherited one): `None` when there is no Wayland
+    /// compositor, else whether it offers no decoration manager.
+    fn registry_leaves_frame_to_app() -> Option<bool> {
+        // `connect_to_env` would take ownership of an inherited `WAYLAND_SOCKET` fd and unset the
+        // variable; dropping this short-lived connection would then close the descriptor winit
+        // needs. So when the compositor handed us an open socket (rare: normal launches get
+        // `WAYLAND_DISPLAY`, a name we could reopen, not `WAYLAND_SOCKET`), skip the probe and keep
+        // the desktop frame. On GNOME this means winit's fallback frame rather than an app-drawn
+        // one, the same as an app that doesn't probe at all \u2014 a safe default, not a regression,
+        // taken only to protect winit's connection.
+        if std::env::var_os("WAYLAND_SOCKET").is_some() {
+            return None;
+        }
+        let conn = Connection::connect_to_env().ok()?;
+        let (globals, _queue) = registry_queue_init::<Registry>(&conn).ok()?;
+        let offered = globals.contents().with_list(|list| list.iter().any(|g| g.interface == "zxdg_decoration_manager_v1"));
+        Some(!offered)
+    }
+
+    /// GNOME's `button-layout`, read with `gsettings`. `None` when `gsettings` is missing, fails,
+    /// times out, or prints nothing usable. The child is spawned with piped output and read on a
+    /// worker thread; if it doesn't finish within 500 ms the child is killed and reaped, so a
+    /// stalled `gsettings` leaves neither a blocked process nor a parked worker.
+    pub(super) fn gsettings_button_layout() -> Option<String> {
+        let mut child = Command::new("gsettings")
+            .args(["get", "org.gnome.desktop.wm.preferences", "button-layout"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::null())
+            .spawn()
+            .ok()?;
+        let stdout = child.stdout.take()?;
+        let (send, receive) = mpsc::sync_channel(1);
+        let reader = std::thread::Builder::new().name("craft-window-gsettings".into()).spawn(move || {
+            let mut stdout = stdout;
+            let mut buf = String::new();
+            let read = std::io::Read::read_to_string(&mut stdout, &mut buf);
+            let _ = send.send(read.ok().map(|_| buf));
+        });
+        if reader.is_err() {
+            let _ = child.kill();
+            let _ = child.wait();
+            return None;
+        }
+        let output = receive.recv_timeout(Duration::from_millis(500));
+        // Kill-and-reap whether it finished or timed out: a finished child still needs reaping, and
+        // a timed-out one must not linger. `kill` on an exited child is a harmless error.
+        let _ = child.kill();
+        let _ = child.wait();
+        let value = output.ok().flatten()?;
+        let value = value.trim();
+        if value.is_empty() { None } else { Some(value.to_string()) }
+    }
+
+    /// The registry roundtrip needs a `Dispatch`, but no event carries state here.
+    struct Registry;
+
+    impl Dispatch<wl_registry::WlRegistry, GlobalListContents> for Registry {
+        fn event(_: &mut Self, _: &wl_registry::WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Button, Frame, Layout, Prefix, parse_override};
+
+    #[test]
+    fn prefix_names_the_override_variable() {
+        assert_eq!(Prefix::default().var_name(), "CRAFT_TITLEBAR");
+        assert_eq!(Prefix::new("PDFCRAFT").var_name(), "PDFCRAFT_TITLEBAR");
+    }
+
+    #[test]
+    fn the_override_reads_app_and_system() {
+        assert_eq!(parse_override(Some("app")), Some(true));
+        assert_eq!(parse_override(Some(" system ")), Some(false));
+        assert_eq!(parse_override(Some("desktop")), Some(false));
+        assert_eq!(parse_override(Some("nonsense")), None);
+        assert_eq!(parse_override(None), None);
+    }
+
+    #[test]
+    fn frame_maps_to_decorations_and_layout() {
+        assert!(Frame::Desktop.decorations());
+        assert!(Frame::Desktop.layout().is_none());
+        let app = Frame::App(Layout::default());
+        assert!(!app.decorations());
+        assert!(app.layout().is_some());
+    }
+
+    #[test]
+    fn the_default_layout_is_three_buttons_on_the_right() {
+        let layout = Layout::default();
+        assert!(layout.left.is_empty());
+        assert_eq!(layout.right, vec![Button::Minimize, Button::Maximize, Button::Close]);
+    }
+
+    #[test]
+    fn parse_reads_gnomes_two_sided_layout() {
+        let layout = Layout::parse("appmenu:minimize,maximize,close");
+        assert!(layout.left.is_empty());
+        assert_eq!(layout.right, vec![Button::Minimize, Button::Maximize, Button::Close]);
+
+        let fedora = Layout::parse("appmenu:close");
+        assert_eq!(fedora.right, vec![Button::Close]);
+
+        let left = Layout::parse("close,minimize,maximize:");
+        assert_eq!(left.left, vec![Button::Close, Button::Minimize, Button::Maximize]);
+        assert!(left.right.is_empty());
+    }
+
+    #[test]
+    fn parse_drops_quotes_unknown_names_and_duplicates() {
+        // gsettings prints the value single-quoted.
+        let layout = Layout::parse("'appmenu:minimize,close,close,spacer'");
+        assert!(layout.left.is_empty());
+        assert_eq!(layout.right, vec![Button::Minimize, Button::Close]);
+    }
+
+    #[test]
+    fn parse_without_a_colon_puts_everything_on_the_left() {
+        let layout = Layout::parse("minimize,maximize,close");
+        assert_eq!(layout.left, vec![Button::Minimize, Button::Maximize, Button::Close]);
+        assert!(layout.right.is_empty());
+    }
+
+    #[test]
+    fn a_layout_naming_no_known_button_is_not_usable() {
+        assert!(!Layout::parse("appmenu:spacer").is_usable());
+        assert!(Layout::parse("appmenu:close").is_usable());
+    }
+
+    #[cfg(any(target_os = "macos", target_os = "windows"))]
+    #[test]
+    fn the_os_always_draws_the_frame_on_macos_and_windows() {
+        // A prefix whose variable no test or environment sets, so the platform decides.
+        let choice = super::Choice::probe(Prefix::new("CRAFT_WINDOW_UNSET_FOR_TEST"));
+        assert_eq!(choice.frame(), &Frame::Desktop);
+        assert_eq!(choice.overridden(), None);
+    }
+}

From 20b2c1a1eb17f02ca99d17443e02de529aa2a0cf Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 15:46:51 -0400
Subject: [PATCH 02/29] ci: add SonarCloud scan via shared reusable workflow

Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
with secrets: inherit. Adds SonarCloud badge to README where missing and
removes the redundant sonar-project.properties (config now passed by the
reusable workflow).
---
 .github/workflows/sonarcloud.yml | 20 ++++++++++++++++++++
 README.md                        |  2 ++
 2 files changed, 22 insertions(+)
 create mode 100644 .github/workflows/sonarcloud.yml

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 00000000..ecee45a6
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,20 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
diff --git a/README.md b/README.md
index 3289aba6..2f09381b 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 Craft App Libraries
 ===================
 
+<a href="https://sonarcloud.io/project/overview?id=storytold_craft-libs"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+
 This repo contains libraries used by the various Craft Apps. It's a Rust monorepo workspace, and the libraries can be included by any Craft Apps that need them.
 
 In the future this may grow to include non-Rust library code.

From ce8962552186aa9ff59849e518fff33659957c3a Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 16:00:28 -0400
Subject: [PATCH 03/29] ci: add sonar-project.properties for CI-based analysis

Marks the project ineligible for SonarCloud Automatic Analysis, resolving the
CI-vs-automatic-analysis conflict so the SonarCloud workflow succeeds.
---
 sonar-project.properties | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 sonar-project.properties

diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 00000000..b2368f5d
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_craft-libs
+sonar.organization=storytold

From e25b6ec6e60d22dcd9073542d10aa5a0d3e26ce1 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 17:12:54 -0400
Subject: [PATCH 04/29] security: validate CLI paths/args in dev tools
 (SonarCloud S2083/S8707/S8705/S7044)

Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.
---
 scripts/fetch-pdf-test-fonts.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/fetch-pdf-test-fonts.py b/scripts/fetch-pdf-test-fonts.py
index 821a5e74..99ce3946 100644
--- a/scripts/fetch-pdf-test-fonts.py
+++ b/scripts/fetch-pdf-test-fonts.py
@@ -11,6 +11,8 @@ import urllib.request
 
 
 def fetch(url):
+    if not url.startswith("https://"):
+        raise ValueError("refusing to fetch a non-HTTPS URL")
     for attempt in range(3):
         try:
             with urllib.request.urlopen(url, timeout=60) as response:
@@ -42,7 +44,9 @@ def main():
         name, url, digest = fixture["name"], fixture["source"], fixture["sha256"]
         if Path(name).name != name or name in ("", ".", "..") or not url.startswith("https://"):
             raise ValueError("invalid fixture name or source")
-        path = destination / name
+        path = (destination / name).resolve()
+        if path.parent != destination:
+            raise ValueError(f"fixture path escapes destination: {name}")
         if path.is_file() and hashlib.sha256(path.read_bytes()).hexdigest() == digest:
             print(f"Verified {name}")
             continue

From 1b9cf1973a11667396bc6675e836a9616dc322b7 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 20:14:01 -0400
Subject: [PATCH 05/29] ci: pin GitHub Actions to full commit SHA (SonarCloud
 githubactions:S7637) (#228)

Pin third-party actions to full-length commit SHAs (with version comments)
instead of mutable tags/branches to prevent supply-chain tampering via
retagged releases. Resolves SonarCloud rule githubactions:S7637.
---
 .github/workflows/ai-core.yml |  2 +-
 .github/workflows/atomic.yml  |  2 +-
 .github/workflows/docpath.yml |  2 +-
 .github/workflows/i18n.yml    |  2 +-
 .github/workflows/media.yml   |  8 ++++----
 .github/workflows/pdf.yml     | 12 ++++++------
 .github/workflows/print.yml   |  2 +-
 .github/workflows/ui.yml      |  8 ++++----
 .github/workflows/window.yml  |  2 +-
 9 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/ai-core.yml b/.github/workflows/ai-core.yml
index 4733eaee..5f2204f7 100644
--- a/.github/workflows/ai-core.yml
+++ b/.github/workflows/ai-core.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
diff --git a/.github/workflows/atomic.yml b/.github/workflows/atomic.yml
index 25423780..d2112768 100644
--- a/.github/workflows/atomic.yml
+++ b/.github/workflows/atomic.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - name: Install ACL tools
diff --git a/.github/workflows/docpath.yml b/.github/workflows/docpath.yml
index 557f00f5..3aaaa97e 100644
--- a/.github/workflows/docpath.yml
+++ b/.github/workflows/docpath.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - run: cargo fmt --check
diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml
index d7e6f5b5..a973e37f 100644
--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - run: cargo fmt --check
diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml
index 088f255b..272abab8 100644
--- a/.github/workflows/media.yml
+++ b/.github/workflows/media.yml
@@ -22,11 +22,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-media-lint
       - run: cargo fmt -p craft-media --check
@@ -42,8 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-media-test
       - name: Build tests while installing ffmpeg
diff --git a/.github/workflows/pdf.yml b/.github/workflows/pdf.yml
index e0d9fcf1..c2f8c3f6 100644
--- a/.github/workflows/pdf.yml
+++ b/.github/workflows/pdf.yml
@@ -27,10 +27,10 @@ jobs:
       RUSTFLAGS: --cfg craft_pdf_unicode_fixtures
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf
       - uses: actions/setup-python@v5
@@ -51,8 +51,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf-backends
       - run: bash scripts/test-pdf-backends.sh
@@ -64,10 +64,10 @@ jobs:
       CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf-wasm
       - uses: actions/setup-python@v5
diff --git a/.github/workflows/print.yml b/.github/workflows/print.yml
index ea0696e3..270ac75e 100644
--- a/.github/workflows/print.yml
+++ b/.github/workflows/print.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - run: cargo fmt --check
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 79845a44..3db33478 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -32,10 +32,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y mesa-vulkan-drivers libvulkan1
           echo 'WGPU_BACKEND=vulkan' >> "$GITHUB_ENV"
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-ui
       - run: cargo fmt --check
@@ -49,10 +49,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-ui-wasm
       - run: cargo check -p craft-ui --all-features --locked --target wasm32-unknown-unknown
diff --git a/.github/workflows/window.yml b/.github/workflows/window.yml
index 61407086..80aa86b6 100644
--- a/.github/workflows/window.yml
+++ b/.github/workflows/window.yml
@@ -25,7 +25,7 @@ jobs:
           # The token isn't needed after checkout; cargo runs build scripts and proc macros from
           # dependencies, so don't leave it in .git/config for that third-party code to read.
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - run: cargo fmt --check

From b9c1a1105e215621793076a3ca67839a93968901 Mon Sep 17 00:00:00 2001
From: skylar taylor-barrick <hi@skylar.cc>
Date: Thu, 22 Oct 2026 08:13:08 -0600
Subject: [PATCH 06/29] Add craft-platform with shared native dialog lifecycle
 helpers (#224)

* platform: add native dialog lifecycle services

* Document dialog outcomes and lifecycle contracts

---------

Co-authored-by: skylartaylor <skylartaylor@users.noreply.github.com>
---
 Cargo.lock                                |   7 +
 Cargo.toml                                |   1 +
 NOTICE                                    |   7 +
 README.md                                 |   2 +
 crates/platform/Cargo.toml                |  19 ++
 crates/platform/LICENSE-APACHE            | 177 +++++++++++++++
 crates/platform/LICENSE-MIT               |  21 ++
 crates/platform/NOTICE                    |   6 +
 crates/platform/README.md                 |  42 ++++
 crates/platform/src/dialog_outcome.rs     |  97 ++++++++
 crates/platform/src/dialogs.rs            | 258 ++++++++++++++++++++++
 crates/platform/src/lib.rs                |   5 +
 crates/platform/tests/dialog_lifecycle.rs | 248 +++++++++++++++++++++
 13 files changed, 890 insertions(+)
 create mode 100644 crates/platform/Cargo.toml
 create mode 100644 crates/platform/LICENSE-APACHE
 create mode 100644 crates/platform/LICENSE-MIT
 create mode 100644 crates/platform/NOTICE
 create mode 100644 crates/platform/README.md
 create mode 100644 crates/platform/src/dialog_outcome.rs
 create mode 100644 crates/platform/src/dialogs.rs
 create mode 100644 crates/platform/src/lib.rs
 create mode 100644 crates/platform/tests/dialog_lifecycle.rs

diff --git a/Cargo.lock b/Cargo.lock
index 4c7cda04..fc190e00 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -686,6 +686,13 @@ dependencies = [
  "wasm-bindgen-test",
 ]
 
+[[package]]
+name = "craft-platform"
+version = "0.1.0"
+dependencies = [
+ "egui",
+]
+
 [[package]]
 name = "craft-print"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 319c1138..da23b867 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,7 @@ repository = "https://github.com/storytold/craft-libs"
 
 [workspace.dependencies]
 # internal: add each crate here as `craft-<name> = { path = "crates/<name>" }`
+craft-platform = { path = "crates/platform" }
 craft-ai-core = { path = "crates/ai-core" }
 craft-pdf = { path = "crates/pdf", version = "=0.1.0" }
 krilla = { version = "=0.8.2", default-features = false, features = ["raster-images"] }
diff --git a/NOTICE b/NOTICE
index 9467671f..49a34553 100644
--- a/NOTICE
+++ b/NOTICE
@@ -106,3 +106,10 @@ Compact ICC Profiles by Clinton Ingram (CC0-1.0), and dependency CMaps (BSD-3-Cl
 Their licences and per-file hashes are retained in vendor/hayro-interpret/assets,
 licenses/pdf-backend and ATTRIBUTION.md. These are existing reader dependency assets;
 applications retain their own document-font selection and licensing policy.
+
+Platform dialog lifecycle provenance
+
+The dialog outcomes and lifecycle adapt preserved local platform candidate
+9b135779a1e7136438a217c18afe1693ea23f1ab.
+Copyright (c) 2026 ArtCraft Team and the craft-libs contributors.
+All adapted source is licensed MIT OR Apache-2.0.
diff --git a/README.md b/README.md
index 2f09381b..4629d9a5 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,8 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
 
 ## Libraries
 
+- [`craft-platform`](crates/platform/README.md): optional native dialog lifecycle; application policy stays in the apps.
+
 - [`craft-ai-core`](crates/ai-core/README.md): the data model and contract for AI in the Craft Apps (connections, models, tools, requests, jobs, consent, history, route spec). Pure, no I/O, wasm-safe. Contract in [docs/ai-shared-layer.md](docs/ai-shared-layer.md).
 - [`craft-pdf`](crates/pdf/README.md): independently optional PDF parsing, interpretation, rasterization and guarded authoring. Apps retain layout, fonts, editing and export policy; writer-only consumers do not enable the shared reader.
 
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
new file mode 100644
index 00000000..68eba168
--- /dev/null
+++ b/crates/platform/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "craft-platform"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+description = "Small platform lifecycle services for the Craft suite"
+
+[lints]
+workspace = true
+
+[features]
+default = []
+dialogs = []
+egui = ["dep:egui"]
+
+[dependencies]
+egui = { workspace = true, optional = true }
diff --git a/crates/platform/LICENSE-APACHE b/crates/platform/LICENSE-APACHE
new file mode 100644
index 00000000..f433b1a5
--- /dev/null
+++ b/crates/platform/LICENSE-APACHE
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/crates/platform/LICENSE-MIT b/crates/platform/LICENSE-MIT
new file mode 100644
index 00000000..e1450bdf
--- /dev/null
+++ b/crates/platform/LICENSE-MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ArtCraft Team and the craft-libs contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/crates/platform/NOTICE b/crates/platform/NOTICE
new file mode 100644
index 00000000..3e8bf4b1
--- /dev/null
+++ b/crates/platform/NOTICE
@@ -0,0 +1,6 @@
+Platform dialog lifecycle provenance
+
+The dialog outcomes and lifecycle adapt preserved local platform candidate
+9b135779a1e7136438a217c18afe1693ea23f1ab.
+Copyright (c) 2026 ArtCraft Team and the craft-libs contributors.
+All adapted source is licensed MIT OR Apache-2.0.
diff --git a/crates/platform/README.md b/crates/platform/README.md
new file mode 100644
index 00000000..cebf8683
--- /dev/null
+++ b/crates/platform/README.md
@@ -0,0 +1,42 @@
+# craft-platform
+
+Small platform lifecycle services for Craft applications. Application state, settings, palettes,
+document policy and native command routing remain in their current owners. Defaults add no
+third-party dependencies. Enable only the services a host uses.
+
+| Feature | Shared responsibility |
+| --- | --- |
+| default | Typed dialog outcomes; no backend or toolkit. |
+| `dialogs` | Reserve waiting workers before eager UI-thread native picker creation; serial requests, failure delivery and completion wakeups. The backend factory belongs to the app. |
+| `egui` | Combine with `dialogs` for the deferred-close guard. |
+
+
+## Native dialogs
+
+`dialogs::wait_prepared(create, deliver)` reserves the worker first. Call it on the native UI thread.
+`create` must call `pick_file`, `save_file`, or the equivalent backend method **before returning its
+future**. Putting that call inside an async block delays native sheet creation until the worker
+polls it. Worker reservation failure never opens the sheet. No live picker has a timeout.
+
+`NativeDialogs<Request, Answer>` provides an optional serial queue. Pump it on the event-loop
+thread before consuming answers and after code that can request a picker. Replies become visible
+only after the pump releases transport ownership, so a continuation can enqueue the next picker.
+Dropping a stale reply does not release the actual picker. A host-specific preflight is optional;
+it runs off-thread and must be bounded. Unknown capability permits a picker. Proven absence may
+request an application-owned fallback. Custom save-format sheets and portal choices remain intact.
+
+`Outcome::Selected`, explicit `Cancelled`, `Failed` and `Indeterminate` have different evidence.
+An rfd `None` is `Indeterminate`; it cannot prove user cancellation rather than backend failure.
+Disconnected workers are failures. Apps own localization, document identity/revision checks, filters,
+actual save receipts, chained continuations and the decision to close.
+
+Retain the actual parent window through queued requests, preflight, the native picker AND any
+unconsumed application continuation. `DeferredClose::update` cancels close during pending work and
+returns a request to retry the application's normal close policy afterward. It never grants
+permission to discard work. Run those guards before `craft_quit::on_close_request` in `App::logic`.
+
+## Integration
+
+Enable only the services a host uses. Applications retain palettes, settings, document identity,
+close policy, filters, names, MIME types and native command routing. Existing craft-settings,
+craft-atomic, craft-print, craft-docpath and craft-quit remain canonical.
diff --git a/crates/platform/src/dialog_outcome.rs b/crates/platform/src/dialog_outcome.rs
new file mode 100644
index 00000000..7f675002
--- /dev/null
+++ b/crates/platform/src/dialog_outcome.rs
@@ -0,0 +1,97 @@
+//! Dialog results with evidence: an empty rfd answer does not establish user cancellation.
+/// Host assessment of whether a native backend is available; unknown is not proven absence.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Capability {
+    /// The host has confirmed that a backend is available.
+    Available,
+    /// Proven backend absence, with a diagnostic suitable for the host.
+    Unavailable(String),
+    /// Inconclusive capability evidence; the host should still permit a picker attempt.
+    Unknown(String),
+}
+/// The layer that prevented a dialog request from completing.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ErrorKind {
+    /// The host proved that no backend is available.
+    Unavailable,
+    /// Request transport or background execution failed.
+    Worker,
+    /// The picker backend reported or encountered a failure.
+    Backend,
+}
+/// A classified dialog failure with a host-facing diagnostic.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct DialogError {
+    /// The failing layer.
+    pub kind: ErrorKind,
+    /// Diagnostic text for the host to present or log.
+    pub message: String,
+}
+impl DialogError {
+    /// Construct a failure without inferring cancellation from the diagnostic.
+    pub fn new(kind: ErrorKind, message: impl Into<String>) -> Self {
+        Self { kind, message: message.into() }
+    }
+}
+impl std::fmt::Display for DialogError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+impl std::error::Error for DialogError {}
+/// Selection, explicit cancellation, failure, or an answer whose cause is unknown.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Outcome<T> {
+    /// A value returned by the picker.
+    Selected(T),
+    /// Explicit app/backend cancellation; never inferred from rfd's empty answer.
+    Cancelled,
+    /// A transport, capability or backend failure.
+    Failed(DialogError),
+    /// No selection; rfd cannot say whether the user cancelled or its backend failed.
+    Indeterminate,
+}
+impl<T> Outcome<T> {
+    /// Preserve a selection; an empty rfd answer is indeterminate, never proven cancellation.
+    pub fn from_rfd(value: Option<T>) -> Self {
+        value.map_or(Self::Indeterminate, Self::Selected)
+    }
+    /// Transform only a selected value, preserving all other outcomes unchanged.
+    pub fn map<U>(self, map: impl FnOnce(T) -> U) -> Outcome<U> {
+        match self {
+            Self::Selected(value) => Outcome::Selected(map(value)),
+            Self::Cancelled => Outcome::Cancelled,
+            Self::Failed(error) => Outcome::Failed(error),
+            Self::Indeterminate => Outcome::Indeterminate,
+        }
+    }
+    /// Construct a backend failure with the supplied diagnostic.
+    pub fn failed(message: impl Into<String>) -> Self {
+        Self::Failed(DialogError::new(ErrorKind::Backend, message))
+    }
+}
+impl<T> Outcome<Vec<T>> {
+    /// Treat missing and empty multi-selection answers as indeterminate.
+    pub fn from_rfd_files(value: Option<Vec<T>>) -> Self {
+        Self::from_rfd(value.filter(|paths| !paths.is_empty()))
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn missing_and_empty_rfd_answers_never_establish_cancellation() {
+        assert_eq!(Outcome::<String>::from_rfd(None), Outcome::Indeterminate);
+        assert_eq!(Outcome::<Vec<String>>::from_rfd_files(Some(Vec::new())), Outcome::Indeterminate);
+        assert_eq!(Outcome::from_rfd_files(Some(vec!["a"])), Outcome::Selected(vec!["a"]));
+        for _capability in [Capability::Available, Capability::Unavailable("missing".into()), Capability::Unknown("timeout".into())] {
+            assert_eq!(Outcome::<String>::from_rfd(None), Outcome::Indeterminate);
+        }
+    }
+    #[test]
+    fn mapping_preserves_explicit_cancellation_and_failure() {
+        assert_eq!(Outcome::<u8>::Cancelled.map(u32::from), Outcome::Cancelled);
+        assert_eq!(Outcome::<u8>::failed("worker stopped").map(u32::from), Outcome::failed("worker stopped"));
+        assert_eq!(Outcome::Selected(7_u8).map(u32::from), Outcome::Selected(7));
+    }
+}
diff --git a/crates/platform/src/dialogs.rs b/crates/platform/src/dialogs.rs
new file mode 100644
index 00000000..b09c66be
--- /dev/null
+++ b/crates/platform/src/dialogs.rs
@@ -0,0 +1,258 @@
+//! UI-thread picker creation with reserved waiting workers. No backend or application policy.
+//!
+//! `create` must call the native picker method eagerly on the event-loop thread, returning its
+//! already-created future. Hosts retain the parent through transport AND their continuation.
+//! A missing backend answer is indeterminate; only explicit backend evidence proves cancellation.
+use crate::dialog_outcome::{DialogError, ErrorKind, Outcome};
+use std::{
+    future::Future,
+    pin::Pin,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+        mpsc::{self, Receiver, Sender, SyncSender, TryRecvError},
+    },
+    thread::JoinHandle,
+};
+/// An already-created native picker future that a reserved worker can wait on.
+pub type DialogFuture<T> = Pin<Box<dyn Future<Output = Outcome<T>> + Send>>;
+
+/// Wait for a future without polling an idle native dialog.
+pub fn block_on<T>(future: impl Future<Output = T>) -> T {
+    struct Unpark(std::thread::Thread);
+    impl std::task::Wake for Unpark {
+        fn wake(self: Arc<Self>) {
+            self.0.unpark();
+        }
+    }
+    let waker = std::task::Waker::from(Arc::new(Unpark(std::thread::current())));
+    let mut context = std::task::Context::from_waker(&waker);
+    let mut future = std::pin::pin!(future);
+    loop {
+        if let std::task::Poll::Ready(value) = future.as_mut().poll(&mut context) {
+            return value;
+        }
+        std::thread::park();
+    }
+}
+// Notification callbacks must not unwind a reserved worker after the UI observes readiness.
+fn notify(wake: &dyn Fn()) {
+    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(wake));
+}
+fn worker_error(message: impl Into<String>) -> DialogError {
+    DialogError::new(ErrorKind::Worker, message)
+}
+fn guarded<T>(f: impl FnOnce() -> Outcome<T>) -> Outcome<T> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)).unwrap_or_else(|_| Outcome::Failed(worker_error("The file-dialog backend failed")))
+}
+/// Reserve the worker before opening a native sheet. A failed reservation never calls `create`.
+/// No timeout is imposed on a live picker. Backend constructor/poll panics become explicit failures.
+pub fn wait_prepared<T: Send + 'static, F: Future<Output = Outcome<T>> + Send + 'static>(
+    create: impl FnOnce() -> F,
+    deliver: impl FnOnce(Outcome<T>) + Send + 'static,
+) -> std::io::Result<JoinHandle<()>> {
+    let (send, receive) = mpsc::channel::<F>();
+    let worker = std::thread::Builder::new().name("file-dialog".into()).spawn(move || {
+        deliver(guarded(|| match receive.recv() {
+            Ok(future) => block_on(future),
+            Err(_) => Outcome::Failed(worker_error("The file-dialog factory failed")),
+        }));
+    })?;
+    if let Ok(future) = std::panic::catch_unwind(std::panic::AssertUnwindSafe(create)) {
+        send.send(future).map_err(|_| std::io::Error::other("The reserved file-dialog worker stopped"))?;
+    }
+    Ok(worker)
+}
+
+type Job<R, T> = (R, Sender<Outcome<T>>);
+/// Clonable request endpoint. At most one queued, preparing or live request is accepted.
+pub struct DialogClient<R, T> {
+    sender: SyncSender<Job<R, T>>,
+    busy: Arc<AtomicBool>,
+    wake: Arc<dyn Fn() + Send + Sync>,
+}
+impl<R, T> Clone for DialogClient<R, T> {
+    fn clone(&self) -> Self {
+        Self { sender: self.sender.clone(), busy: self.busy.clone(), wake: self.wake.clone() }
+    }
+}
+impl<R, T> DialogClient<R, T> {
+    /// Queue a request without blocking and wake the host to pump it.
+    /// A busy or unavailable host answers with a worker failure; no second picker is opened.
+    pub fn request(&self, request: R) -> Receiver<Outcome<T>> {
+        let (answer, receive) = mpsc::channel();
+        if self.busy.compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst).is_err() {
+            let _ = answer.send(Outcome::Failed(worker_error("A file dialog is already pending")));
+        } else if let Err(error) = self.sender.try_send((request, answer)) {
+            self.busy.store(false, Ordering::SeqCst);
+            let (_, answer) = match error {
+                mpsc::TrySendError::Full(job) | mpsc::TrySendError::Disconnected(job) => job,
+            };
+            let _ = answer.send(Outcome::Failed(worker_error("The file-dialog host is unavailable")));
+        }
+        notify(self.wake.as_ref());
+        receive
+    }
+}
+struct Preparing<R, T> {
+    request: R,
+    ready: Receiver<()>,
+    send: Sender<DialogFuture<T>>,
+    completion: Completion<T>,
+}
+struct Completion<T> {
+    done: Receiver<Outcome<T>>,
+    answer: Sender<Outcome<T>>,
+}
+impl<T> Completion<T> {
+    fn poll(&self) -> Option<Outcome<T>> {
+        match self.done.try_recv() {
+            Ok(outcome) => Some(outcome),
+            Err(TryRecvError::Empty) => None,
+            Err(TryRecvError::Disconnected) => Some(Outcome::Failed(worker_error("The file-dialog worker stopped without an answer"))),
+        }
+    }
+}
+enum State<R, T> {
+    Preparing(Preparing<R, T>),
+    Waiting(Completion<T>),
+}
+/// Event-loop-owned transport. Dropping a reply does not release a live picker or its parent.
+/// `pump` must run before consuming replies, and after app code that may enqueue a request.
+/// The host must retain this service/window while `pending()` or its own continuation is pending.
+pub struct NativeDialogs<R, T> {
+    queue: Receiver<Job<R, T>>,
+    busy: Arc<AtomicBool>,
+    state: Option<State<R, T>>,
+    wake: Arc<dyn Fn() + Send + Sync>,
+    check: Arc<dyn Fn() -> Result<(), DialogError> + Send + Sync>,
+}
+impl<R, T: Send + 'static> NativeDialogs<R, T> {
+    /// Create a client and its event-loop-owned service without a backend preflight check.
+    pub fn new(wake: impl Fn() + Send + Sync + 'static) -> (DialogClient<R, T>, Self) {
+        Self::with_preflight(wake, || Ok(()))
+    }
+    /// Optional host-owned advisory check, run on the reserved worker before any picker exists.
+    /// Hosts must bound this check. Unknown capability must permit the actual picker; return an
+    /// Unavailable error only when absence is proven. This service performs no filesystem probes.
+    pub fn with_preflight(
+        wake: impl Fn() + Send + Sync + 'static,
+        check: impl Fn() -> Result<(), DialogError> + Send + Sync + 'static,
+    ) -> (DialogClient<R, T>, Self) {
+        let (sender, queue) = mpsc::sync_channel(1);
+        let busy = Arc::new(AtomicBool::new(false));
+        let wake: Arc<dyn Fn() + Send + Sync> = Arc::new(wake);
+        (DialogClient { sender, busy: busy.clone(), wake: wake.clone() }, Self { queue, busy, state: None, wake, check: Arc::new(check) })
+    }
+    /// Whether a queued, preparing or live picker still owns the transport reservation.
+    pub fn pending(&self) -> bool {
+        self.busy.load(Ordering::SeqCst)
+    }
+    /// Advance requests on the event-loop thread and publish completed replies.
+    /// Call before consuming replies and after enqueuing work. `create` must eagerly open
+    /// the native picker on this thread and return its already-created future.
+    pub fn pump(&mut self, mut create: impl FnMut(R) -> DialogFuture<T>) {
+        if let Some(state) = self.state.take() {
+            match state {
+                State::Waiting(completion) => {
+                    if let Some(outcome) = completion.poll() {
+                        // Only the UI pump publishes replies, after releasing the transport.
+                        // A continuation can therefore immediately request its next picker.
+                        self.busy.store(false, Ordering::SeqCst);
+                        let _ = completion.answer.send(outcome);
+                    } else {
+                        self.state = Some(State::Waiting(completion));
+                    }
+                }
+                State::Preparing(preparing) => {
+                    if let Some(outcome) = preparing.completion.poll() {
+                        self.busy.store(false, Ordering::SeqCst);
+                        let _ = preparing.completion.answer.send(outcome);
+                    } else if preparing.ready.try_recv().is_ok() {
+                        let future = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| create(preparing.request)))
+                            .unwrap_or_else(|_| Box::pin(async { Outcome::Failed(worker_error("The file-dialog factory failed")) }));
+                        let _ = preparing.send.send(future);
+                        self.state = Some(State::Waiting(preparing.completion));
+                    } else {
+                        self.state = Some(State::Preparing(preparing));
+                    }
+                }
+            }
+        }
+        if self.state.is_none()
+            && let Ok((request, answer)) = self.queue.try_recv()
+        {
+            let (ready_send, ready) = mpsc::channel();
+            let (send, receive) = mpsc::channel::<DialogFuture<T>>();
+            let (done_send, done) = mpsc::channel();
+            let check = self.check.clone();
+            let wake = self.wake.clone();
+            let started = std::thread::Builder::new().name("file-dialog".into()).spawn(move || {
+                let output = guarded(|| {
+                    if let Err(error) = check() {
+                        return Outcome::Failed(error);
+                    }
+                    if ready_send.send(()).is_err() {
+                        return Outcome::Failed(worker_error("The file-dialog host stopped"));
+                    }
+                    notify(wake.as_ref());
+                    match receive.recv() {
+                        Ok(future) => block_on(future),
+                        Err(_) => Outcome::Failed(worker_error("The file-dialog host stopped")),
+                    }
+                });
+                let _ = done_send.send(output);
+                notify(wake.as_ref());
+            });
+            match started {
+                Ok(_) => self.state = Some(State::Preparing(Preparing { request, ready, send, completion: Completion { done, answer } })),
+                Err(error) => {
+                    self.busy.store(false, Ordering::SeqCst);
+                    let _ = answer.send(Outcome::Failed(worker_error(error.to_string())));
+                    notify(self.wake.as_ref());
+                }
+            }
+        }
+    }
+}
+/// Holds close intent while a picker/continuation owns the parent. A retry never authorizes
+/// discarding documents: the caller must run its ordinary unsaved-work policy again.
+#[cfg(feature = "egui")]
+#[derive(Default, Debug)]
+pub struct DeferredClose {
+    held: bool,
+}
+#[cfg(feature = "egui")]
+impl DeferredClose {
+    /// Hold actual close requests while a picker or app continuation is pending.
+    /// Return `true` once after settlement so the host retries its unsaved-work policy;
+    /// this never grants permission to discard changes or closes the viewport itself.
+    pub fn update(&mut self, ctx: &egui::Context, pending: bool) -> bool {
+        let outgoing = ctx.viewport(|v| {
+            v.commands
+                .iter()
+                .rev()
+                .find_map(|c| match c {
+                    egui::ViewportCommand::Close => Some(true),
+                    egui::ViewportCommand::CancelClose => Some(false),
+                    _ => None,
+                })
+                .unwrap_or(false)
+        });
+        if pending {
+            let requested = outgoing || ctx.input(|i| i.viewport().close_requested());
+            self.held |= requested;
+            // Every viewport command requests a repaint. An idle native picker must sleep.
+            if requested {
+                ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+            }
+            false
+        } else if std::mem::take(&mut self.held) {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+            ctx.request_repaint();
+            true
+        } else {
+            false
+        }
+    }
+}
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
new file mode 100644
index 00000000..ba43fbfb
--- /dev/null
+++ b/crates/platform/src/lib.rs
@@ -0,0 +1,5 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+//! Shared lifecycle mechanics; application state, theme choices and file policy stay in hosts.
+pub mod dialog_outcome;
+#[cfg(all(feature = "dialogs", not(target_arch = "wasm32")))]
+pub mod dialogs;
diff --git a/crates/platform/tests/dialog_lifecycle.rs b/crates/platform/tests/dialog_lifecycle.rs
new file mode 100644
index 00000000..1b78d031
--- /dev/null
+++ b/crates/platform/tests/dialog_lifecycle.rs
@@ -0,0 +1,248 @@
+#![cfg(all(feature = "dialogs", not(target_arch = "wasm32")))]
+use craft_platform::{
+    dialog_outcome::{DialogError, ErrorKind, Outcome},
+    dialogs::{NativeDialogs, wait_prepared},
+};
+use std::sync::{
+    Arc,
+    atomic::{AtomicUsize, Ordering},
+    mpsc,
+};
+use std::time::{Duration, Instant};
+fn pump_until<R, T: Send + 'static>(
+    service: &mut NativeDialogs<R, T>,
+    mut create: impl FnMut(R) -> craft_platform::dialogs::DialogFuture<T>,
+    until: impl Fn() -> bool,
+) {
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while !until() {
+        assert!(Instant::now() < deadline, "worker did not settle");
+        service.pump(&mut create);
+        std::thread::yield_now();
+    }
+}
+#[test]
+fn factory_is_eager_on_caller_and_completion_on_worker() -> Result<(), Box<dyn std::error::Error>> {
+    let caller = std::thread::current().id();
+    let (tx, rx) = mpsc::channel();
+    let worker = wait_prepared(
+        || {
+            assert_eq!(caller, std::thread::current().id());
+            async { Outcome::Selected(42) }
+        },
+        move |outcome| {
+            let _ = tx.send((outcome, std::thread::current().id()));
+        },
+    )?;
+    let (outcome, thread) = rx.recv_timeout(Duration::from_secs(3))?;
+    assert_eq!(outcome, Outcome::Selected(42));
+    assert_ne!(caller, thread);
+    assert!(worker.join().is_ok());
+    Ok(())
+}
+#[test]
+fn constructor_and_poll_failures_are_not_cancellation() -> Result<(), Box<dyn std::error::Error>> {
+    for construct in [false, true] {
+        let (tx, rx) = mpsc::channel();
+        let worker = wait_prepared(
+            || {
+                if construct {
+                    std::panic::resume_unwind(Box::new("constructor"));
+                }
+                async {
+                    std::panic::resume_unwind(Box::new("poll"));
+                    #[allow(unreachable_code)]
+                    Outcome::<u8>::Cancelled
+                }
+            },
+            move |outcome| {
+                let _ = tx.send(outcome);
+            },
+        )?;
+        assert!(matches!(rx.recv_timeout(Duration::from_secs(3))?, Outcome::Failed(DialogError { kind: ErrorKind::Worker, .. })));
+        assert!(worker.join().is_ok());
+    }
+    Ok(())
+}
+#[test]
+fn queued_and_dropped_replies_keep_live_picker_busy() -> Result<(), Box<dyn std::error::Error>> {
+    let (c, mut service) = NativeDialogs::<(), u8>::new(|| {});
+    let reply = c.request(());
+    assert!(service.pending());
+    drop(reply);
+    let (release, wait) = mpsc::channel();
+    let mut wait = Some(wait);
+    let created = Arc::new(AtomicUsize::new(0));
+    let count = created.clone();
+    pump_until(
+        &mut service,
+        move |()| {
+            count.fetch_add(1, Ordering::SeqCst);
+            let wait = wait.take();
+            Box::pin(async move {
+                let _ = wait.map(|w| w.recv());
+                Outcome::Selected(1)
+            })
+        },
+        || created.load(Ordering::SeqCst) == 1,
+    );
+    assert!(service.pending());
+    assert!(matches!(c.request(()).recv_timeout(Duration::from_secs(3))?, Outcome::Failed(_)));
+    release.send(())?;
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while service.pending() {
+        assert!(Instant::now() < deadline);
+        service.pump(|()| Box::pin(async { Outcome::Indeterminate }));
+        std::thread::yield_now();
+    }
+    Ok(())
+}
+#[test]
+fn proven_absence_skips_native_factory() -> Result<(), Box<dyn std::error::Error>> {
+    let (c, mut service) = NativeDialogs::<(), u8>::with_preflight(|| {}, || Err(DialogError::new(ErrorKind::Unavailable, "test backend missing")));
+    let reply = c.request(());
+    let called = Arc::new(AtomicUsize::new(0));
+    let count = called.clone();
+    let mut result = None;
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while result.is_none() {
+        assert!(Instant::now() < deadline);
+        service.pump(|()| {
+            count.fetch_add(1, Ordering::SeqCst);
+            Box::pin(async { Outcome::Selected(1) })
+        });
+        result = reply.try_recv().ok();
+        std::thread::yield_now();
+    }
+    assert_eq!(called.load(Ordering::SeqCst), 0);
+    assert!(matches!(result, Some(Outcome::Failed(DialogError { kind: ErrorKind::Unavailable, .. }))));
+    Ok(())
+}
+#[test]
+fn missing_backend_answer_is_ambiguous() {
+    assert_eq!(Outcome::<u8>::from_rfd(None), Outcome::Indeterminate);
+}
+#[cfg(feature = "egui")]
+#[test]
+fn held_close_retries_policy_without_granting_discard() {
+    let ctx = egui::Context::default();
+    let mut close = craft_platform::dialogs::DeferredClose::default();
+    let mut input = egui::RawInput::default();
+    input.viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+    let mut output = ctx.run_ui(input, |ui| assert!(!close.update(ui.ctx(), true)));
+    assert!(output.viewport_output[&egui::ViewportId::ROOT].commands.contains(&egui::ViewportCommand::CancelClose));
+    output.textures_delta.clear();
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| assert!(close.update(ui.ctx(), false)));
+    assert!(!output.viewport_output[&egui::ViewportId::ROOT].commands.contains(&egui::ViewportCommand::Close));
+    output.textures_delta.clear();
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| assert!(!close.update(ui.ctx(), false)));
+    output.textures_delta.clear();
+}
+#[test]
+fn notification_panic_cannot_kill_reserved_picker_worker() -> Result<(), Box<dyn std::error::Error>> {
+    let (c, mut service) = NativeDialogs::<(), u8>::new(|| std::panic::resume_unwind(Box::new("wake failure")));
+    let reply = c.request(());
+    let mut result = None;
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while result.is_none() {
+        assert!(Instant::now() < deadline);
+        service.pump(|()| Box::pin(async { Outcome::Selected(7) }));
+        result = reply.try_recv().ok();
+        std::thread::yield_now();
+    }
+    assert_eq!(result, Some(Outcome::Selected(7)));
+    Ok(())
+}
+
+#[test]
+fn completion_between_pumps_cannot_reject_a_chained_request() -> Result<(), Box<dyn std::error::Error>> {
+    let wakes = Arc::new(AtomicUsize::new(0));
+    let count = wakes.clone();
+    let (client, mut service) = NativeDialogs::<u8, u8>::new(move || {
+        count.fetch_add(1, Ordering::SeqCst);
+    });
+    let first = client.request(1);
+    let (release, wait) = mpsc::channel();
+    let mut wait = Some(wait);
+    let created = Arc::new(AtomicUsize::new(0));
+    let count = created.clone();
+    pump_until(
+        &mut service,
+        move |value| {
+            count.fetch_add(1, Ordering::SeqCst);
+            let wait = wait.take();
+            Box::pin(async move {
+                let _ = wait.map(|wait| wait.recv());
+                Outcome::Selected(value)
+            })
+        },
+        || created.load(Ordering::SeqCst) == 1,
+    );
+    // Finish after the host's pump, before its app continuation polls the reply.
+    release.send(())?;
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while wakes.load(Ordering::SeqCst) < 3 {
+        assert!(Instant::now() < deadline, "worker did not publish completion");
+        std::thread::yield_now();
+    }
+    assert!(matches!(first.try_recv(), Err(mpsc::TryRecvError::Empty)));
+    assert!(service.pending(), "an unpublished completion still retains the parent");
+    service.pump(|value| Box::pin(async move { Outcome::Selected(value) }));
+    assert_eq!(first.try_recv()?, Outcome::Selected(1));
+    assert!(!service.pending());
+    // The app can chain the next dialog immediately upon observing the first answer.
+    let second = client.request(2);
+    assert!(matches!(second.try_recv(), Err(mpsc::TryRecvError::Empty)));
+    let mut result = None;
+    while result.is_none() {
+        assert!(Instant::now() < deadline, "chained picker did not settle");
+        service.pump(|value| Box::pin(async move { Outcome::Selected(value) }));
+        result = second.try_recv().ok();
+        std::thread::yield_now();
+    }
+    assert_eq!(result, Some(Outcome::Selected(2)));
+    assert!(!service.pending());
+    Ok(())
+}
+
+#[cfg(feature = "egui")]
+#[test]
+fn pending_dialog_without_close_intent_does_not_schedule_viewport_work() {
+    let ctx = egui::Context::default();
+    let mut close = craft_platform::dialogs::DeferredClose::default();
+    // Let egui settle its own initial font/style passes before testing the idle host.
+    for _ in 0..4 {
+        let mut output = ctx.run_ui(egui::RawInput::default(), |_| {});
+        output.textures_delta.clear();
+    }
+    for _ in 0..3 {
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            assert!(!close.update(ui.ctx(), true));
+        });
+        output.textures_delta.clear();
+        let viewport = output.viewport_output.get(&egui::ViewportId::ROOT).unwrap();
+        assert!(viewport.commands.is_empty(), "an idle picker must not enqueue commands: {:?}", viewport.commands);
+        assert_ne!(viewport.repaint_delay, std::time::Duration::ZERO, "an idle picker must not request another frame");
+    }
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| assert!(!close.update(ui.ctx(), false)));
+    output.textures_delta.clear();
+}
+
+#[cfg(feature = "egui")]
+#[test]
+fn programmatic_close_is_held_until_the_pending_dialog_settles() {
+    let ctx = egui::Context::default();
+    let mut close = craft_platform::dialogs::DeferredClose::default();
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+        ui.ctx().send_viewport_cmd(egui::ViewportCommand::Close);
+        assert!(!close.update(ui.ctx(), true));
+    });
+    output.textures_delta.clear();
+    let commands = &output.viewport_output.get(&egui::ViewportId::ROOT).unwrap().commands;
+    let last_close = commands.iter().rev().find(|command| matches!(command, egui::ViewportCommand::Close | egui::ViewportCommand::CancelClose));
+    assert_eq!(last_close, Some(&egui::ViewportCommand::CancelClose));
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| assert!(close.update(ui.ctx(), false)));
+    output.textures_delta.clear();
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| assert!(!close.update(ui.ctx(), false)));
+    output.textures_delta.clear();
+}

From ffe7f8fce82dc6b2325a83d2e8a64f0452ba2573 Mon Sep 17 00:00:00 2001
From: skylar taylor-barrick <hi@skylar.cc>
Date: Thu, 22 Oct 2026 08:13:09 -0600
Subject: [PATCH 07/29] Share Linux and BSD desktop appearance observation
 (#225)

* platform: share desktop appearance observation

* Align appearance target guards and document watcher contracts

* Replace appearance wildcard imports with explicit dependencies

---------

Co-authored-by: skylartaylor <skylartaylor@users.noreply.github.com>
---
 Cargo.lock                                    | 382 +++++++++++
 NOTICE                                        |  18 +-
 README.md                                     |   2 +-
 crates/platform/Cargo.toml                    |   8 +
 crates/platform/NOTICE                        |  18 +-
 crates/platform/README.md                     |  30 +-
 crates/platform/src/appearance.rs             | 635 ++++++++++++++++++
 .../appearance/portal/appearance_bus_tests.rs | 147 ++++
 crates/platform/src/lib.rs                    |   4 +
 crates/platform/src/process.rs                |  53 ++
 10 files changed, 1287 insertions(+), 10 deletions(-)
 create mode 100644 crates/platform/src/appearance.rs
 create mode 100644 crates/platform/src/appearance/portal/appearance_bus_tests.rs
 create mode 100644 crates/platform/src/process.rs

diff --git a/Cargo.lock b/Cargo.lock
index fc190e00..50ffab2e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -135,6 +135,126 @@ dependencies = [
  "libloading",
 ]
 
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix 1.1.5",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+dependencies = [
+ "async-channel",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if",
+ "event-listener",
+ "futures-lite",
+ "rustix 1.1.5",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f8abc12baad266b1c8cec146854c195b5864b4221d4b2ca7296a7ae82d9e451"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if",
+ "futures-core",
+ "futures-io",
+ "rustix 1.1.5",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
 [[package]]
 name = "async-trait"
 version = "0.1.92"
@@ -273,6 +393,19 @@ dependencies = [
  "objc2 0.6.5",
 ]
 
+[[package]]
+name = "blocking"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a70e4329df6cb94385eed412ec92375c3cdd8a6e502493d1229b6414e4036dfa"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
 [[package]]
 name = "borsh"
 version = "1.8.1"
@@ -690,7 +823,12 @@ dependencies = [
 name = "craft-platform"
 version = "0.1.0"
 dependencies = [
+ "async-channel",
+ "async-io",
+ "async-process",
  "egui",
+ "futures-lite",
+ "zbus",
 ]
 
 [[package]]
@@ -1120,6 +1258,12 @@ dependencies = [
  "simdutf8",
 ]
 
+[[package]]
+name = "endi"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
 [[package]]
 name = "enum-map"
 version = "2.7.3"
@@ -1140,6 +1284,27 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "epaint"
 version = "0.36.2"
@@ -1202,6 +1367,26 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.5.0"
@@ -1387,6 +1572,19 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "futures-sink"
 version = "0.3.34"
@@ -2306,6 +2504,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -2855,6 +3062,22 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3012,6 +3235,17 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
@@ -3817,6 +4051,17 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "1.1.2"
@@ -3866,6 +4111,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
 [[package]]
 name = "signature"
 version = "2.2.0"
@@ -4724,6 +4979,17 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "unarray"
 version = "0.1.4"
@@ -4868,6 +5134,11 @@ name = "uuid"
 version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
+dependencies = [
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
 
 [[package]]
 name = "vello_common"
@@ -5932,6 +6203,76 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zbus"
+version = "5.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5db4be7c075cb421e4b7ee645541604239bd243ba7c357511f4ff3a74b555907"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix 1.1.5",
+ "serde",
+ "serde_repr",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2990635d09ade6df1868f72f8cac69a876a90981e8bd3c40b1be413f8dc88f40"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812a12be4ead7a59e18ea8f047d08add0066b73bc62fc1467066a2472ae088dd"
+dependencies = [
+ "serde",
+ "winnow",
+ "zvariant",
+]
+
+[[package]]
+name = "zcheapstr"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.8.62"
@@ -6053,3 +6394,44 @@ checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
  "zune-core",
 ]
+
+[[package]]
+name = "zvariant"
+version = "5.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80bf6d6cd6a4b601acb64cfb8284cdc643fcfa75ef26ae3c46ec8aa4e8a1fbb7"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow",
+ "zcheapstr",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef2672456ba1cb54b5eaec136e63135b3c7495fb938e53b28a62e633496d486d"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad0294361a320b694a328460dc73add56c306150f5cb6bfafc44446120008a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 3.0.6",
+ "winnow",
+]
diff --git a/NOTICE b/NOTICE
index 49a34553..8703347b 100644
--- a/NOTICE
+++ b/NOTICE
@@ -107,9 +107,19 @@ Their licences and per-file hashes are retained in vendor/hayro-interpret/assets
 licenses/pdf-backend and ATTRIBUTION.md. These are existing reader dependency assets;
 applications retain their own document-font selection and licensing policy.
 
-Platform dialog lifecycle provenance
+Platform lifecycle source provenance
 
-The dialog outcomes and lifecycle adapt preserved local platform candidate
-9b135779a1e7136438a217c18afe1693ea23f1ab.
-Copyright (c) 2026 ArtCraft Team and the craft-libs contributors.
+The optional crates/platform services adapt the preserved local platform candidate
+9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and lifecycle),
+and current application implementations:
+- PdfCraft crates/platform/src/desktop_theme.rs, a8cd797a917b1007544575c7280c9a0ce6a17e8f.
+- CADCraft apps/cadcraft/src/desktop_theme.rs, 0cc66ad3066e71f2c3d4cacb7de905e79ba1c95b.
+- ArtCraft Launcher apps/artcraft-launcher/src/system_theme.rs, f1676dfb41c226b5be490721f486ee6427419d80.
+- Earlier PhotoCraft, FilmCraft and EffectCraft appearance services at revisions
+  0c72d95425dece90ef9a1cceb49e3315c96e22d5, 794a25fc9ed2e3f6fab51a254625bc9b99a88015
+  and 1b4d47f34f2b1c1b4a89f4b7348889def8fd648b respectively.
+Sources: https://github.com/storytold/pdfcraft, https://github.com/storytold/cadcraft,
+https://github.com/storytold/craft-launcher, https://github.com/storytold/photocraft,
+https://github.com/storytold/filmcraft, https://github.com/storytold/effectcraft.
+Copyright (c) 2026 ArtCraft Team and the respective application and craft-libs contributors.
 All adapted source is licensed MIT OR Apache-2.0.
diff --git a/README.md b/README.md
index 4629d9a5..7de7d010 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
 
 ## Libraries
 
-- [`craft-platform`](crates/platform/README.md): optional native dialog lifecycle; application policy stays in the apps.
+- [`craft-platform`](crates/platform/README.md): optional native dialog lifecycle and Linux/BSD desktop appearance observation; application policy stays in the apps.
 
 - [`craft-ai-core`](crates/ai-core/README.md): the data model and contract for AI in the Craft Apps (connections, models, tools, requests, jobs, consent, history, route spec). Pure, no I/O, wasm-safe. Contract in [docs/ai-shared-layer.md](docs/ai-shared-layer.md).
 - [`craft-pdf`](crates/pdf/README.md): independently optional PDF parsing, interpretation, rasterization and guarded authoring. Apps retain layout, fonts, editing and export policy; writer-only consumers do not enable the shared reader.
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index 68eba168..528a9a97 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -13,7 +13,15 @@ workspace = true
 [features]
 default = []
 dialogs = []
+appearance = ["dep:zbus", "dep:futures-lite", "dep:async-channel", "dep:async-io", "dep:async-process"]
 egui = ["dep:egui"]
 
 [dependencies]
 egui = { workspace = true, optional = true }
+
+[target.'cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))'.dependencies]
+zbus = { version = "5", default-features = false, features = ["async-io"], optional = true }
+futures-lite = { version = "2", optional = true }
+async-channel = { version = "2", optional = true }
+async-io = { version = "2", optional = true }
+async-process = { version = "2", optional = true }
diff --git a/crates/platform/NOTICE b/crates/platform/NOTICE
index 3e8bf4b1..3f99d579 100644
--- a/crates/platform/NOTICE
+++ b/crates/platform/NOTICE
@@ -1,6 +1,16 @@
-Platform dialog lifecycle provenance
+Platform lifecycle source provenance
 
-The dialog outcomes and lifecycle adapt preserved local platform candidate
-9b135779a1e7136438a217c18afe1693ea23f1ab.
-Copyright (c) 2026 ArtCraft Team and the craft-libs contributors.
+The optional crates/platform services adapt the preserved local platform candidate
+9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and lifecycle),
+and current application implementations:
+- PdfCraft crates/platform/src/desktop_theme.rs, a8cd797a917b1007544575c7280c9a0ce6a17e8f.
+- CADCraft apps/cadcraft/src/desktop_theme.rs, 0cc66ad3066e71f2c3d4cacb7de905e79ba1c95b.
+- ArtCraft Launcher apps/artcraft-launcher/src/system_theme.rs, f1676dfb41c226b5be490721f486ee6427419d80.
+- Earlier PhotoCraft, FilmCraft and EffectCraft appearance services at revisions
+  0c72d95425dece90ef9a1cceb49e3315c96e22d5, 794a25fc9ed2e3f6fab51a254625bc9b99a88015
+  and 1b4d47f34f2b1c1b4a89f4b7348889def8fd648b respectively.
+Sources: https://github.com/storytold/pdfcraft, https://github.com/storytold/cadcraft,
+https://github.com/storytold/craft-launcher, https://github.com/storytold/photocraft,
+https://github.com/storytold/filmcraft, https://github.com/storytold/effectcraft.
+Copyright (c) 2026 ArtCraft Team and the respective application and craft-libs contributors.
 All adapted source is licensed MIT OR Apache-2.0.
diff --git a/crates/platform/README.md b/crates/platform/README.md
index cebf8683..ba9d4cea 100644
--- a/crates/platform/README.md
+++ b/crates/platform/README.md
@@ -8,7 +8,8 @@ third-party dependencies. Enable only the services a host uses.
 | --- | --- |
 | default | Typed dialog outcomes; no backend or toolkit. |
 | `dialogs` | Reserve waiting workers before eager UI-thread native picker creation; serial requests, failure delivery and completion wakeups. The backend factory belongs to the app. |
-| `egui` | Combine with `dialogs` for the deferred-close guard. |
+| `egui` | Combine with `dialogs` for the deferred-close guard or with `appearance` for native theme mapping. |
+| `appearance` | Linux/BSD XDG desktop preference observation, owned cancellable subscriptions, bounded reads/helper capture, legacy compatibility and reconnect. |
 
 
 ## Native dialogs
@@ -35,6 +36,33 @@ unconsumed application continuation. `DeferredClose::update` cancels close durin
 returns a request to retry the application's normal close policy afterward. It never grants
 permission to discard work. Run those guards before `craft_quit::on_close_request` in `App::logic`.
 
+## Desktop appearance
+
+`appearance::Watcher` caches the desktop preference and wakes only on changes. Subscription precedes
+the first read. ReadOne/legacy Read, the standard namespace and GNOME fallback are handled together;
+malformed values retain the last valid answer, and explicit no-preference clears it. Disconnection
+retains the last valid value until a fresh answer. A later service owner triggers a reread; session
+reconnection has bounded backoff. Dropping cancels asynchronous work and waits at most 100 ms
+for acknowledgement, joining only an already-finished worker. A synchronously blocked OS call or caller wake callback can outlive
+the watcher: that exceptional worker is detached and retains its resources until it returns,
+possibly until process exit. Wake callbacks must be nonblocking. No per-helper reader threads
+are created.
+
+App-selected Light/Dark/System, custom palettes, window decorations and unknown-theme fallback remain
+application policy. `set_active(false)` suppresses wake notifications while continuing to cache.
+Four existing custom-palette service hooks retain their current signatures and receive change-only
+notifications even in manual mode; they do not change the chosen palette. Never infer Auto from the
+egui theme preference when an app implements Auto by explicitly applying a Light/Dark palette.
+
+`sync_native_window_theme(ctx, observed)` forwards the cached Linux/BSD desktop answer to native
+decorations when egui's window policy is System, falling back to the current toolkit answer.
+Its output hook runs after egui's automatic
+window synchronization, including child-window output. Concrete Light/Dark preferences retain
+precedence, absence of both answers releases the native pin, and `sync_window_theme = false` opts out.
+It does not change styles or theme preference. Hosts whose custom palette is manual but whose
+native window follows System keep observation active for the native window. Native decoration
+rendering still depends on the window manager and requires visible acceptance testing.
+
 ## Integration
 
 Enable only the services a host uses. Applications retain palettes, settings, document identity,
diff --git a/crates/platform/src/appearance.rs b/crates/platform/src/appearance.rs
new file mode 100644
index 00000000..c696510d
--- /dev/null
+++ b/crates/platform/src/appearance.rs
@@ -0,0 +1,635 @@
+//! Desktop colour preference through the XDG Settings portal.
+//!
+//! Derived from PdfCraft's activation-safe subscription and GNOME schema fallback,
+//! CADCraft's BSD support, and ArtCraft Launcher's ReadOne/Read compatibility.
+//! Palettes, manual choices and the fallback when no preference exists belong to the host.
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, AtomicU8, Ordering},
+};
+
+/// Desktop color preference observed independently of the application palette.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Theme {
+    /// The desktop requests a dark appearance.
+    Dark,
+    /// The desktop requests a light appearance.
+    Light,
+}
+
+struct Shared {
+    value: AtomicU8,
+    active: AtomicBool,
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    wake: Box<dyn Fn() + Send + Sync>,
+}
+impl Shared {
+    fn get(&self) -> Option<Theme> {
+        match self.value.load(Ordering::Acquire) {
+            1 => Some(Theme::Dark),
+            2 => Some(Theme::Light),
+            _ => None,
+        }
+    }
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    fn publish(&self, theme: Option<Theme>) {
+        let code = match theme {
+            Some(Theme::Dark) => 1,
+            Some(Theme::Light) => 2,
+            None => 0,
+        };
+        if self.value.swap(code, Ordering::AcqRel) != code && self.active.load(Ordering::Acquire) {
+            (self.wake)();
+        }
+    }
+}
+/// An owned subscription. Dropping cancels connection setup, reads, backoff and helper capture,
+/// and waits at most 100 ms for acknowledgement. Only a finished worker is joined: an OS call
+/// or caller wake callback can block synchronously, so an exceptional unfinished worker is
+/// detached and retains its resources until it returns (possibly until process exit).
+/// Cache reads never block the UI; callers should keep wake callbacks nonblocking.
+pub struct Watcher {
+    shared: Arc<Shared>,
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    stop: async_channel::Sender<()>,
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    worker: Option<std::thread::JoinHandle<()>>,
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    finished: std::sync::mpsc::Receiver<()>,
+}
+impl Watcher {
+    /// Start an active subscription, or return `None` on unsupported targets or worker failure.
+    /// `wake` runs on the worker and must not block.
+    pub fn start(wake: impl Fn() + Send + Sync + 'static) -> Option<Self> {
+        Self::start_active(true, wake)
+    }
+    /// Start observing with explicit control over wake notifications.
+    /// An inactive subscription still updates its cache. Unsupported targets and worker
+    /// startup failure return `None`; browser targets never start a desktop watcher.
+    pub fn start_active(active: bool, wake: impl Fn() + Send + Sync + 'static) -> Option<Self> {
+        #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+        {
+            Self::spawn(active, wake, portal::watch)
+        }
+        #[cfg(not(all(unix, not(target_os = "macos"), not(target_arch = "wasm32"))))]
+        {
+            let _ = (active, wake);
+            None
+        }
+    }
+    /// Read the cached preference without blocking; `None` means no known preference.
+    pub fn current(&self) -> Option<Theme> {
+        self.shared.get()
+    }
+    /// Enable or suppress future change notifications without stopping observation.
+    /// Changing this flag does not itself wake the host or clear the cached preference.
+    pub fn set_active(&self, active: bool) {
+        self.shared.active.store(active, Ordering::Release);
+    }
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    fn spawn<F: std::future::Future<Output = ()> + 'static>(
+        active: bool,
+        wake: impl Fn() + Send + Sync + 'static,
+        source: impl FnOnce(Arc<Shared>) -> F + Send + 'static,
+    ) -> Option<Self> {
+        let shared = Arc::new(Shared { value: AtomicU8::new(0), active: AtomicBool::new(active), wake: Box::new(wake) });
+        let worker_shared = Arc::clone(&shared);
+        let (stop, stopped) = async_channel::bounded::<()>(1);
+        let (done, finished) = std::sync::mpsc::channel();
+        let worker = std::thread::Builder::new()
+            .name("desktop-appearance".into())
+            .spawn(move || {
+                futures_lite::future::block_on(futures_lite::future::race(
+                    async {
+                        let _ = stopped.recv().await;
+                    },
+                    source(worker_shared),
+                ));
+                let _ = done.send(());
+            })
+            .ok()?;
+        Some(Self { shared, stop, worker: Some(worker), finished })
+    }
+}
+impl Drop for Watcher {
+    fn drop(&mut self) {
+        self.set_active(false);
+        #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+        {
+            self.stop.close();
+            if let Some(worker) = self.worker.take() {
+                let _ = self.finished.recv_timeout(std::time::Duration::from_millis(100));
+                // Acknowledgement precedes thread-local destructors. They can block too, so
+                // never join solely on the acknowledgement (or channel disconnection).
+                if worker.is_finished() {
+                    let _ = worker.join();
+                }
+            }
+        }
+    }
+}
+
+#[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+mod portal {
+    use super::{Shared, Theme};
+    use futures_lite::StreamExt;
+    use std::{sync::Arc, time::Duration};
+    use zbus::zvariant::{OwnedValue, Value};
+    const DEST: &str = "org.freedesktop.portal.Desktop";
+    const PATH: &str = "/org/freedesktop/portal/desktop";
+    const IFACE: &str = "org.freedesktop.portal.Settings";
+    const STANDARD: &str = "org.freedesktop.appearance";
+    const GNOME: &str = "org.gnome.desktop.interface";
+    const KEY: &str = "color-scheme";
+    const TIMEOUT: Duration = Duration::from_secs(2);
+
+    // Outer None means unknown/malformed; Some(None) is an explicit no-preference answer.
+    fn decode(namespace: &str, value: &Value<'_>) -> Option<Option<Theme>> {
+        match (namespace, value) {
+            (STANDARD, Value::U32(n)) => Some(match n {
+                1 => Some(Theme::Dark),
+                2 => Some(Theme::Light),
+                _ => None,
+            }),
+            (GNOME, Value::Str(s)) => Some(match s.as_str() {
+                "prefer-dark" => Some(Theme::Dark),
+                "prefer-light" => Some(Theme::Light),
+                _ => None,
+            }),
+            _ => None,
+        }
+    }
+    fn reply(namespace: &str, value: &Value<'_>, legacy: bool) -> Option<Option<Theme>> {
+        if legacy {
+            let Value::Value(inner) = value else { return None };
+            decode(namespace, inner)
+        } else {
+            decode(namespace, value)
+        }
+    }
+    fn combined(standard: Option<Option<Theme>>, gnome: Option<Option<Theme>>) -> Option<Option<Theme>> {
+        if standard.is_none() && gnome.is_none() { None } else { Some(standard.flatten().or(gnome.flatten())) }
+    }
+    async fn bounded<T>(future: impl std::future::Future<Output = T>) -> Option<T> {
+        futures_lite::future::race(async { Some(future.await) }, async {
+            async_io::Timer::after(TIMEOUT).await;
+            None
+        })
+        .await
+    }
+    async fn read(connection: &zbus::Connection, namespace: &str) -> Option<Option<Theme>> {
+        for (method, legacy) in [("ReadOne", false), ("Read", true)] {
+            if let Some(Ok(message)) = bounded(connection.call_method(Some(DEST), PATH, Some(IFACE), method, &(namespace, KEY))).await
+                && let Ok(value) = message.body().deserialize::<OwnedValue>()
+                && let Some(answer) = reply(namespace, &value, legacy)
+            {
+                return Some(answer);
+            }
+        }
+        None
+    }
+    fn rule() -> zbus::Result<zbus::MatchRule<'static>> {
+        Ok(zbus::MatchRule::builder()
+            .msg_type(zbus::message::Type::Signal)
+            .sender(DEST)?
+            .path(PATH)?
+            .interface(IFACE)?
+            .member("SettingChanged")?
+            .arg(1, KEY)?
+            .build())
+    }
+    fn owner_rule() -> zbus::Result<zbus::MatchRule<'static>> {
+        Ok(zbus::MatchRule::builder()
+            .msg_type(zbus::message::Type::Signal)
+            .sender("org.freedesktop.DBus")?
+            .interface("org.freedesktop.DBus")?
+            .member("NameOwnerChanged")?
+            .arg(0, DEST)?
+            .build())
+    }
+    pub(super) async fn watch(shared: Arc<Shared>) {
+        let mut retry = Duration::from_secs(5);
+        let mut fallback_used = false;
+        loop {
+            let mut connected = false;
+            let _ = session(&shared, &mut fallback_used, &mut connected).await;
+            if connected {
+                retry = Duration::from_secs(5);
+            }
+            // Keep the last valid answer during disconnect; a new explicit no-preference clears it.
+            async_io::Timer::after(retry).await;
+            retry = (retry * 2).min(Duration::from_secs(300));
+        }
+    }
+    // Keep Nix/profile PATH entries, but never execute a helper from a relative search folder.
+    fn gsettings_exe(path: Option<&std::ffi::OsStr>) -> Option<std::path::PathBuf> {
+        let dirs = path.map(std::env::split_paths).into_iter().flatten().filter(|p| p.is_absolute());
+        dirs.chain(["/usr/bin", "/bin", "/usr/local/bin"].map(std::path::PathBuf::from)).map(|p| p.join("gsettings")).find(|p| p.is_file())
+    }
+    async fn fallback(shared: &Shared, used: &mut bool) {
+        if *used {
+            return;
+        }
+        *used = true;
+        if let Some(exe) = gsettings_exe(std::env::var_os("PATH").as_deref())
+            && let Some(text) = crate::process::capture(&exe, &["get", GNOME, KEY], TIMEOUT).await
+        {
+            let text = text.trim().trim_matches('\'');
+            if let Some(answer) = decode(GNOME, &Value::from(text)) {
+                shared.publish(answer);
+            }
+        }
+    }
+    async fn session(shared: &Shared, fallback_used: &mut bool, connected: &mut bool) -> Option<()> {
+        let connection = match zbus::connection::Builder::session() {
+            Ok(builder) => bounded(builder.method_timeout(TIMEOUT).build()).await.and_then(Result::ok),
+            Err(_) => None,
+        };
+        let Some(connection) = connection else {
+            fallback(shared, fallback_used).await;
+            return None;
+        };
+        watch_connection(shared, fallback_used, connected, connection).await
+    }
+    async fn watch_connection(shared: &Shared, fallback_used: &mut bool, connected: &mut bool, connection: zbus::Connection) -> Option<()> {
+        // MatchRule installs before activation: unlike a proxy subscription it needs no current owner.
+        let mut changes = bounded(zbus::MessageStream::for_match_rule(rule().ok()?, &connection, Some(64))).await?.ok()?;
+        let mut owners = bounded(zbus::MessageStream::for_match_rule(owner_rule().ok()?, &connection, Some(8))).await?.ok()?;
+        let mut standard = read(&connection, STANDARD).await;
+        let mut gnome = read(&connection, GNOME).await;
+        match combined(standard, gnome) {
+            Some(answer) => {
+                *connected = true;
+                shared.publish(answer);
+            }
+            None => {
+                fallback(shared, fallback_used).await;
+                return None;
+            }
+        }
+        loop {
+            let message =
+                futures_lite::future::race(async { changes.next().await.map(|m| (false, m)) }, async { owners.next().await.map(|m| (true, m)) })
+                    .await?;
+            let (owner, message) = message;
+            let message = message.ok()?;
+            if owner {
+                // Activation is already covered by the initial read. Loss/replacement reconnects.
+                if let Ok((_, old, _)) = message.body().deserialize::<(String, String, String)>()
+                    && !old.is_empty()
+                {
+                    return None;
+                }
+                continue;
+            }
+            let Ok((namespace, key, value)) = message.body().deserialize::<(String, String, OwnedValue)>() else { continue };
+            if key != KEY {
+                continue;
+            }
+            let Some(answer) = decode(&namespace, &value) else { continue };
+            match namespace.as_str() {
+                STANDARD => standard = Some(answer),
+                GNOME => gnome = Some(answer),
+                _ => continue,
+            }
+            if let Some(answer) = combined(standard, gnome) {
+                shared.publish(answer);
+            }
+        }
+    }
+    #[cfg(test)]
+    #[path = "appearance_bus_tests.rs"]
+    mod bus_tests;
+    #[cfg(test)]
+    mod tests {
+        #[test]
+        fn gsettings_respects_absolute_nix_style_path_without_using_relative_folders() -> Result<(), Box<dyn std::error::Error>> {
+            struct Fixture(std::path::PathBuf);
+            impl Drop for Fixture {
+                fn drop(&mut self) {
+                    let _ = std::fs::remove_dir_all(&self.0);
+                }
+            }
+            let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos();
+            let directory = std::env::temp_dir().join(format!("craft-platform-gsettings-{}-{nonce}", std::process::id()));
+            std::fs::create_dir(&directory)?;
+            let fixture = Fixture(directory);
+            let helper = fixture.0.join("gsettings");
+            std::fs::write(&helper, b"fixture")?;
+            let path = std::env::join_paths([std::path::Path::new("relative-untrusted"), fixture.0.as_path()])?;
+            assert_eq!(super::gsettings_exe(Some(path.as_os_str())), Some(helper));
+            assert!(super::gsettings_exe(Some(std::ffi::OsStr::new("relative-untrusted"))).is_none_or(|p| p.is_absolute()));
+            Ok(())
+        }
+
+        use super::{GNOME, STANDARD, combined, decode, reply};
+        use crate::appearance::{Theme, Watcher};
+        use std::{
+            sync::{Arc, atomic::Ordering},
+            time::Duration,
+        };
+        use zbus::zvariant::Value;
+        #[test]
+        fn no_preference_is_an_answer_and_gnome_only_fills_missing_preference() {
+            assert_eq!(combined(None, None), None);
+            assert_eq!(combined(Some(None), None), Some(None));
+            assert_eq!(combined(Some(None), Some(Some(Theme::Dark))), Some(Some(Theme::Dark)));
+            assert_eq!(combined(Some(Some(Theme::Light)), Some(Some(Theme::Dark))), Some(Some(Theme::Light)));
+            assert_eq!(combined(None, Some(None)), Some(None));
+        }
+        #[test]
+        fn malformed_is_distinct_from_no_preference_and_legacy_is_exact() {
+            assert_eq!(decode(STANDARD, &Value::U32(0)), Some(None));
+            assert_eq!(decode(STANDARD, &Value::U32(77)), Some(None));
+            assert_eq!(decode(STANDARD, &Value::from("dark")), None);
+            assert_eq!(reply(STANDARD, &Value::Value(Box::new(Value::U32(1))), true), Some(Some(Theme::Dark)));
+            assert_eq!(reply(STANDARD, &Value::U32(1), true), None);
+            assert_eq!(reply(STANDARD, &Value::Value(Box::new(Value::Value(Box::new(Value::U32(1))))), true), None);
+            assert_eq!(decode(STANDARD, &Value::Value(Box::new(Value::U32(1)))), None);
+            assert_eq!(decode(STANDARD, &Value::I32(1)), None);
+            assert_eq!(decode(GNOME, &Value::from("default")), Some(None));
+            assert_eq!(decode(GNOME, &Value::U32(1)), None);
+
+            assert_eq!(reply(GNOME, &Value::from("prefer-light"), false), Some(Some(Theme::Light)));
+        }
+        #[test]
+        fn manual_cache_changes_do_not_wake_and_drop_cancels_pending_source() -> Result<(), Box<dyn std::error::Error>> {
+            let (tx, rx) = std::sync::mpsc::channel();
+            let (cancelled, cancellation) = std::sync::mpsc::channel();
+            struct Cancelled(std::sync::mpsc::Sender<()>);
+            impl Drop for Cancelled {
+                fn drop(&mut self) {
+                    let _ = self.0.send(());
+                }
+            }
+            let wakes = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+            let observed = Arc::clone(&wakes);
+            let watcher = Watcher::spawn(
+                false,
+                move || {
+                    observed.fetch_add(1, Ordering::Relaxed);
+                },
+                move |shared| async move {
+                    let _cancelled = Cancelled(cancelled);
+                    shared.publish(Some(Theme::Dark));
+                    let _ = tx.send(());
+                    futures_lite::future::pending::<()>().await;
+                },
+            )
+            .ok_or("worker creation failed")?;
+            rx.recv_timeout(Duration::from_secs(2))?;
+            assert_eq!(watcher.current(), Some(Theme::Dark));
+            assert_eq!(wakes.load(Ordering::Relaxed), 0);
+            watcher.set_active(true);
+            watcher.shared.publish(Some(Theme::Dark));
+            assert_eq!(wakes.load(Ordering::Relaxed), 0);
+            watcher.shared.publish(Some(Theme::Light));
+            assert_eq!(watcher.current(), Some(Theme::Light));
+            watcher.shared.publish(Some(Theme::Dark));
+            assert_eq!(watcher.current(), Some(Theme::Dark));
+            watcher.shared.publish(None);
+            assert_eq!(watcher.current(), None);
+            assert_eq!(wakes.load(Ordering::Relaxed), 3);
+            drop(watcher);
+            cancellation.recv_timeout(Duration::from_secs(2))?;
+            Ok(())
+        }
+        #[test]
+        fn drop_does_not_wait_for_a_synchronously_blocked_source() -> Result<(), Box<dyn std::error::Error>> {
+            let (started, ready) = std::sync::mpsc::channel();
+            let (release, blocked) = std::sync::mpsc::channel();
+            let (exited, exit) = std::sync::mpsc::channel();
+            struct Release(Option<std::sync::mpsc::Sender<()>>);
+            impl Drop for Release {
+                fn drop(&mut self) {
+                    if let Some(release) = self.0.take() {
+                        let _ = release.send(());
+                    }
+                }
+            }
+            // Declared before the watcher: every error/unwind releases the synchronous poll.
+            let release = Release(Some(release));
+            let watcher = Watcher::spawn(
+                false,
+                || {},
+                move |_| async move {
+                    let _ = started.send(());
+                    let _ = blocked.recv();
+                    let _ = exited.send(());
+                },
+            )
+            .ok_or("worker creation failed")?;
+            ready.recv_timeout(Duration::from_secs(2))?;
+            let (dropped, drop_result) = std::sync::mpsc::channel();
+            let dropper = std::thread::spawn(move || {
+                drop(watcher);
+                let _ = dropped.send(());
+            });
+            let bounded = drop_result.recv_timeout(Duration::from_secs(1)).is_ok();
+            // Release before asserting, including when an unbounded implementation regresses.
+            drop(release);
+            exit.recv_timeout(Duration::from_secs(2))?;
+            assert!(dropper.join().is_ok(), "watcher drop panicked");
+            assert!(bounded, "watcher drop waited for a blocked synchronous poll");
+            Ok(())
+        }
+    }
+}
+/// Owned callback that supplies an observed theme and updates egui native-window hints.
+#[cfg(feature = "egui")]
+pub type SystemThemeFn = Box<dyn Fn(&egui::Context) -> Option<egui::Theme>>;
+/// Create an egui theme callback that owns the subscription and wakes its first context.
+/// Return `None` when no desktop watcher can start; the host retains its fallback policy.
+#[cfg(feature = "egui")]
+pub fn egui_service() -> Option<SystemThemeFn> {
+    let context = Arc::new(std::sync::OnceLock::<egui::Context>::new());
+    let worker_context = Arc::clone(&context);
+    let watcher = Watcher::start(move || {
+        if let Some(ctx) = worker_context.get() {
+            ctx.request_repaint();
+        }
+    })?;
+    Some(Box::new(move |ctx| {
+        let _ = context.set(ctx.clone());
+        sync_native_window_theme(ctx, watcher.current());
+        watcher.current().map(|t| match t {
+            Theme::Dark => egui::Theme::Dark,
+            Theme::Light => egui::Theme::Light,
+        })
+    }))
+}
+
+/// Supply the portal answer for native window decorations without changing egui's theme choice
+/// or either palette. A missing portal answer falls back to the current toolkit system theme;
+/// when both are absent the native pin is released. Linux/BSD window backends cannot reliably
+/// resolve `SystemDefault` themselves.
+/// The output hook runs after egui's own window-theme synchronization, so it cannot be overwritten
+/// by a later automatic `SetTheme(SystemDefault)` in the same pass.
+#[cfg(feature = "egui")]
+pub fn sync_native_window_theme(ctx: &egui::Context, observed: Option<Theme>) {
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    {
+        ctx.add_plugin(NativeWindowTheme::default());
+        ctx.with_plugin(|plugin: &mut NativeWindowTheme| plugin.observed = observed);
+    }
+    #[cfg(not(all(unix, not(target_os = "macos"), not(target_arch = "wasm32"))))]
+    let _ = (ctx, observed);
+}
+
+#[cfg(all(feature = "egui", unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+#[derive(Default)]
+struct NativeWindowTheme {
+    observed: Option<Theme>,
+    sent: std::collections::HashMap<egui::ViewportId, egui::SystemTheme>,
+}
+#[cfg(all(feature = "egui", unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+impl egui::Plugin for NativeWindowTheme {
+    fn debug_name(&self) -> &'static str {
+        "desktop window appearance"
+    }
+    fn output_hook(&mut self, ctx: &egui::Context, output: &mut egui::FullOutput) {
+        if !ctx.options(|o| o.sync_window_theme) {
+            // Another owner may alter the native theme while synchronization is disabled.
+            self.sent.clear();
+            return;
+        }
+        let desired = match ctx.options(|o| o.theme_preference) {
+            egui::ThemePreference::Dark => egui::SystemTheme::Dark,
+            egui::ThemePreference::Light => egui::SystemTheme::Light,
+            egui::ThemePreference::System => match self.observed.or_else(|| {
+                ctx.system_theme().map(|theme| match theme {
+                    egui::Theme::Dark => Theme::Dark,
+                    egui::Theme::Light => Theme::Light,
+                })
+            }) {
+                Some(Theme::Dark) => egui::SystemTheme::Dark,
+                Some(Theme::Light) => egui::SystemTheme::Light,
+                None => egui::SystemTheme::SystemDefault,
+            },
+        };
+        // FullOutput can carry child-window commands too. Rewrite every viewport so a deferred
+        // or immediate child cannot reintroduce egui's inherited hint after its own UI pass.
+        for (id, viewport) in &mut output.viewport_output {
+            let had_sync = viewport.commands.iter().any(|command| matches!(command, egui::ViewportCommand::SetTheme(_)));
+            viewport.commands.retain(|command| !matches!(command, egui::ViewportCommand::SetTheme(_)));
+            if had_sync || self.sent.get(id) != Some(&desired) {
+                viewport.commands.push(egui::ViewportCommand::SetTheme(desired));
+                self.sent.insert(*id, desired);
+            }
+        }
+        // Forget destroyed native windows: a reused viewport identifier must receive its hint.
+        self.sent.retain(|id, _| output.viewport_output.contains_key(id));
+    }
+}
+
+#[cfg(all(test, feature = "egui", unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+mod native_window_tests {
+    use super::{Theme, sync_native_window_theme};
+    fn pass(ctx: &egui::Context, observed: Option<Theme>, preference: egui::ThemePreference) -> Vec<egui::SystemTheme> {
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            sync_native_window_theme(ui.ctx(), observed);
+            // Deliberately apply the host's choice AFTER the observer, as real palette adapters do.
+            ui.ctx().set_theme(preference);
+        });
+        output.textures_delta.clear(); // Headless policy test; no renderer consumes uploads.
+        output
+            .viewport_output
+            .values()
+            .flat_map(|v| &v.commands)
+            .filter_map(|command| match command {
+                egui::ViewportCommand::SetTheme(theme) => Some(*theme),
+                _ => None,
+            })
+            .collect()
+    }
+    #[test]
+    fn actual_end_pass_maps_system_manual_and_reset_without_overwriting_palettes() {
+        use egui::{SystemTheme as Native, ThemePreference as Choice};
+        let ctx = egui::Context::default();
+        let marker = egui::Color32::from_rgb(12, 34, 56);
+        ctx.all_styles_mut(|s| s.visuals.panel_fill = marker);
+        assert_eq!(pass(&ctx, Some(Theme::Light), Choice::System), vec![Native::Light]);
+        assert_eq!(ctx.options(|o| o.theme_preference), Choice::System);
+        assert!(pass(&ctx, Some(Theme::Light), Choice::System).is_empty());
+        assert_eq!(pass(&ctx, Some(Theme::Dark), Choice::System), vec![Native::Dark]);
+        // A portal change cannot override a concrete manual native preference.
+        assert_eq!(pass(&ctx, Some(Theme::Light), Choice::Dark), vec![Native::Dark]);
+        assert_eq!(pass(&ctx, Some(Theme::Dark), Choice::Light), vec![Native::Light]);
+        assert_eq!(pass(&ctx, Some(Theme::Dark), Choice::System), vec![Native::Dark]);
+        assert_eq!(pass(&ctx, None, Choice::System), vec![Native::SystemDefault]);
+        assert!(pass(&ctx, None, Choice::System).is_empty());
+        assert_eq!(ctx.style_of(egui::Theme::Dark).visuals.panel_fill, marker);
+        assert_eq!(ctx.style_of(egui::Theme::Light).visuals.panel_fill, marker);
+    }
+    #[test]
+    fn native_system_hint_uses_current_toolkit_fallback_without_retaining_stale_input() {
+        let ctx = egui::Context::default();
+        for (raw_theme, observed, expected) in [
+            (Some(egui::Theme::Light), None, egui::SystemTheme::Light),
+            (Some(egui::Theme::Dark), None, egui::SystemTheme::Dark),
+            (Some(egui::Theme::Dark), Some(Theme::Light), egui::SystemTheme::Light),
+            (None, None, egui::SystemTheme::SystemDefault),
+        ] {
+            let mut output = ctx.run_ui(egui::RawInput { system_theme: raw_theme, ..Default::default() }, |ui| {
+                sync_native_window_theme(ui.ctx(), observed);
+                ui.ctx().set_theme(egui::ThemePreference::System);
+            });
+            let hints: Vec<_> = output
+                .viewport_output
+                .values()
+                .flat_map(|v| &v.commands)
+                .filter_map(|command| match command {
+                    egui::ViewportCommand::SetTheme(theme) => Some(*theme),
+                    _ => None,
+                })
+                .collect();
+            output.textures_delta.clear();
+            assert_eq!(hints, vec![expected]);
+        }
+    }
+    #[test]
+    fn deferred_windows_receive_the_same_hint_and_reset() {
+        let ctx = egui::Context::default();
+        ctx.set_embed_viewports(false);
+        let child = egui::ViewportId::from_hash_of("appearance-child");
+        for observed in [Some(Theme::Light), Some(Theme::Dark), None] {
+            let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+                sync_native_window_theme(ui.ctx(), observed);
+                ui.ctx().set_theme(egui::ThemePreference::System);
+                ui.ctx().show_viewport_deferred(child, egui::ViewportBuilder::default(), |_, _| {});
+            });
+            output.textures_delta.clear();
+            let expected = match observed {
+                Some(Theme::Light) => egui::SystemTheme::Light,
+                Some(Theme::Dark) => egui::SystemTheme::Dark,
+                None => egui::SystemTheme::SystemDefault,
+            };
+            for id in [egui::ViewportId::ROOT, child] {
+                let commands: Vec<_> = output
+                    .viewport_output
+                    .get(&id)
+                    .into_iter()
+                    .flat_map(|v| &v.commands)
+                    .filter_map(|c| match c {
+                        egui::ViewportCommand::SetTheme(t) => Some(*t),
+                        _ => None,
+                    })
+                    .collect();
+                assert_eq!(commands, vec![expected]);
+            }
+        }
+    }
+    #[test]
+    fn custom_palette_system_policy_and_explicit_sync_opt_out_are_preserved() {
+        use egui::{SystemTheme as Native, ThemePreference as Choice};
+        let ctx = egui::Context::default();
+        // Photo/PDF/Sound keep System native policy even when their custom palette is manual.
+        ctx.all_styles_mut(|s| s.visuals = egui::Visuals::dark());
+        assert_eq!(pass(&ctx, Some(Theme::Light), Choice::System), vec![Native::Light]);
+        assert!(ctx.style_of(egui::Theme::Light).visuals.dark_mode);
+        ctx.options_mut(|o| o.sync_window_theme = false);
+        assert!(pass(&ctx, Some(Theme::Dark), Choice::System).is_empty());
+        ctx.options_mut(|o| o.sync_window_theme = true);
+        assert_eq!(pass(&ctx, Some(Theme::Dark), Choice::System), vec![Native::Dark]);
+    }
+}
diff --git a/crates/platform/src/appearance/portal/appearance_bus_tests.rs b/crates/platform/src/appearance/portal/appearance_bus_tests.rs
new file mode 100644
index 00000000..d5923bc2
--- /dev/null
+++ b/crates/platform/src/appearance/portal/appearance_bus_tests.rs
@@ -0,0 +1,147 @@
+//! Private-bus regression based on PdfCraft's queued-update test (storytold/pdfcraft#881).
+use super::{DEST, GNOME, IFACE, KEY, PATH, STANDARD, watch_connection};
+use crate::appearance::{Theme, Watcher};
+use std::time::Duration;
+use zbus::zvariant::{OwnedValue, Value};
+
+#[test]
+#[ignore = "requires dbus-daemon; private session bus only"]
+fn legacy_read_keeps_queued_signals_and_drop_cancels_idle_subscription() -> Result<(), Box<dyn std::error::Error>> {
+    use std::io::BufRead;
+    use std::process::{Command, Stdio};
+    struct Daemon(std::process::Child);
+    impl Drop for Daemon {
+        fn drop(&mut self) {
+            let _ = self.0.kill();
+            let _ = self.0.wait();
+        }
+    }
+    struct Settings {
+        captured: std::sync::mpsc::Sender<()>,
+        released: async_channel::Receiver<()>,
+    }
+    #[zbus::interface(name = "org.freedesktop.portal.Settings")]
+    impl Settings {
+        async fn read(&self, namespace: &str, _key: &str) -> zbus::fdo::Result<OwnedValue> {
+            if namespace != STANDARD {
+                return Err(zbus::fdo::Error::InvalidArgs("unknown namespace".into()));
+            }
+            self.captured.send(()).map_err(|e| zbus::fdo::Error::Failed(e.to_string()))?;
+            self.released.recv().await.map_err(|e| zbus::fdo::Error::Failed(e.to_string()))?;
+            OwnedValue::try_from(Value::Value(Box::new(Value::U32(2)))).map_err(|e| zbus::fdo::Error::Failed(e.to_string()))
+        }
+    }
+    let mut daemon = Daemon(
+        Command::new("dbus-daemon")
+            .args(["--session", "--nofork", "--print-address=1"])
+            .arg(format!("--address=unix:abstract=craft-appearance-test-{}", std::process::id()))
+            .stdout(Stdio::piped())
+            .stderr(Stdio::null())
+            .spawn()?,
+    );
+    let mut address = String::new();
+    std::io::BufReader::new(daemon.0.stdout.take().ok_or("no daemon stdout")?).read_line(&mut address)?;
+    let (captured, seen) = std::sync::mpsc::channel();
+    let (release, released) = async_channel::bounded(1);
+    let server = futures_lite::future::block_on(
+        zbus::connection::Builder::address(address.trim())?.name(DEST)?.serve_at(PATH, Settings { captured, released })?.build(),
+    )?;
+    let client = futures_lite::future::block_on(zbus::connection::Builder::address(address.trim())?.build())?;
+    let (woke, wakes) = std::sync::mpsc::channel();
+    let tracker = Watcher::spawn(
+        true,
+        move || {
+            let _ = woke.send(());
+        },
+        move |shared| async move {
+            let _ = watch_connection(&shared, &mut true, &mut false, client).await;
+        },
+    )
+    .ok_or("could not start observer")?;
+    seen.recv_timeout(Duration::from_secs(2))?;
+    futures_lite::future::block_on(server.emit_signal(None::<&str>, PATH, IFACE, "SettingChanged", &(STANDARD, KEY, OwnedValue::from(1u32))))?;
+    release.send_blocking(())?;
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    assert_eq!(tracker.current(), Some(Theme::Dark));
+    // A malformed update must not clear the valid value or cause a wake.
+    futures_lite::future::block_on(server.emit_signal(None::<&str>, PATH, IFACE, "SettingChanged", &(STANDARD, KEY, OwnedValue::from(true))))?;
+    assert!(wakes.recv_timeout(Duration::from_millis(50)).is_err());
+    assert_eq!(tracker.current(), Some(Theme::Dark));
+    let before = std::time::Instant::now();
+    drop(tracker);
+    assert!(before.elapsed() < Duration::from_secs(1));
+    // Drop also cancels a backend that has entered Read and never replies.
+    let client = futures_lite::future::block_on(zbus::connection::Builder::address(address.trim())?.build())?;
+    let pending = Watcher::spawn(
+        true,
+        || {},
+        move |shared| async move {
+            let _ = watch_connection(&shared, &mut true, &mut false, client).await;
+        },
+    )
+    .ok_or("could not start pending-read observer")?;
+    seen.recv_timeout(Duration::from_secs(2))?;
+    let before = std::time::Instant::now();
+    drop(pending);
+    assert!(before.elapsed() < Duration::from_secs(1));
+    // A newly available portal uses ReadOne, and a replacement owner must trigger a reread.
+    futures_lite::future::block_on(server.release_name(DEST))?;
+    struct ModernSettings(u32);
+    #[zbus::interface(name = "org.freedesktop.portal.Settings")]
+    impl ModernSettings {
+        fn read_one(&self, namespace: &str, _key: &str) -> zbus::fdo::Result<OwnedValue> {
+            if namespace == STANDARD { Ok(OwnedValue::from(self.0)) } else { Err(zbus::fdo::Error::InvalidArgs("unknown namespace".into())) }
+        }
+    }
+    let client = futures_lite::future::block_on(zbus::connection::Builder::address(address.trim())?.build())?;
+    let (woke, wakes) = std::sync::mpsc::channel();
+    let (attempted, attempts) = std::sync::mpsc::channel();
+    let tracker = Watcher::spawn(
+        true,
+        move || {
+            let _ = woke.send(());
+        },
+        move |shared| async move {
+            // The production observer repeats this session after its bounded reconnect backoff.
+            loop {
+                let _ = watch_connection(&shared, &mut true, &mut false, client.clone()).await;
+                let _ = attempted.send(());
+                async_io::Timer::after(Duration::from_millis(10)).await;
+            }
+        },
+    )
+    .ok_or("could not start modern observer")?;
+    attempts.recv_timeout(Duration::from_secs(2))?;
+    let modern =
+        futures_lite::future::block_on(zbus::connection::Builder::address(address.trim())?.name(DEST)?.serve_at(PATH, ModernSettings(2))?.build())?;
+
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    assert_eq!(tracker.current(), Some(Theme::Light));
+    futures_lite::future::block_on(modern.release_name(DEST))?;
+    let replacement =
+        futures_lite::future::block_on(zbus::connection::Builder::address(address.trim())?.name(DEST)?.serve_at(PATH, ModernSettings(1))?.build())?;
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    assert_eq!(tracker.current(), Some(Theme::Dark));
+    futures_lite::future::block_on(replacement.emit_signal(None::<&str>, PATH, IFACE, "SettingChanged", &(STANDARD, KEY, OwnedValue::from(0u32))))?;
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    assert_eq!(tracker.current(), None);
+    // GNOME's string schema fills the empty standard preference. Manual mode still caches it,
+    // and opting back into System sees that latest cache without a redundant wake.
+    tracker.set_active(false);
+    futures_lite::future::block_on(replacement.emit_signal(None::<&str>, PATH, IFACE, "SettingChanged", &(GNOME, KEY, Value::from("prefer-dark"))))?;
+    let deadline = std::time::Instant::now() + Duration::from_secs(2);
+    while tracker.current() != Some(Theme::Dark) {
+        assert!(std::time::Instant::now() < deadline, "GNOME change was not cached");
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    assert!(matches!(wakes.try_recv(), Err(std::sync::mpsc::TryRecvError::Empty)));
+    tracker.set_active(true);
+    assert_eq!(tracker.current(), Some(Theme::Dark));
+    assert!(matches!(wakes.try_recv(), Err(std::sync::mpsc::TryRecvError::Empty)));
+    futures_lite::future::block_on(replacement.emit_signal(None::<&str>, PATH, IFACE, "SettingChanged", &(GNOME, KEY, Value::from("default"))))?;
+    wakes.recv_timeout(Duration::from_secs(2))?;
+    assert_eq!(tracker.current(), None);
+    drop(tracker);
+    Ok(())
+}
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
index ba43fbfb..2335afc6 100644
--- a/crates/platform/src/lib.rs
+++ b/crates/platform/src/lib.rs
@@ -1,5 +1,9 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 //! Shared lifecycle mechanics; application state, theme choices and file policy stay in hosts.
+#[cfg(feature = "appearance")]
+pub mod appearance;
 pub mod dialog_outcome;
 #[cfg(all(feature = "dialogs", not(target_arch = "wasm32")))]
 pub mod dialogs;
+#[cfg(all(feature = "appearance", unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+mod process;
diff --git a/crates/platform/src/process.rs b/crates/platform/src/process.rs
new file mode 100644
index 00000000..24c4f7f4
--- /dev/null
+++ b/crates/platform/src/process.rs
@@ -0,0 +1,53 @@
+//! Bounded, cancellable output capture for the desktop's one-shot settings fallback.
+
+/// Reads at most 8193 bytes from a pipe, without a detached reader or disk spool.
+/// Cancellation/timeout drops the reader and kills the owned child; async-process reaps it.
+pub(crate) async fn capture(program: &std::path::Path, args: &[&str], timeout: std::time::Duration) -> Option<String> {
+    use futures_lite::io::AsyncReadExt;
+    use std::process::Stdio;
+    let mut child = async_process::Command::new(program)
+        .args(args)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .kill_on_drop(true)
+        .reap_on_drop(true)
+        .spawn()
+        .ok()?;
+    let stdout = child.stdout.take()?;
+    futures_lite::future::race(
+        async {
+            let mut bytes = Vec::new();
+            stdout.take(8193).read_to_end(&mut bytes).await.ok()?;
+            if bytes.len() > 8192 {
+                return None;
+            }
+            if !child.status().await.ok()?.success() {
+                return None;
+            }
+            String::from_utf8(bytes).ok()
+        },
+        async {
+            async_io::Timer::after(timeout).await;
+            None
+        },
+    )
+    .await
+}
+#[cfg(all(test, feature = "appearance", unix, not(target_os = "macos")))]
+mod tests {
+    use super::capture;
+    #[test]
+    fn capture_checks_exit_status_size_and_deadline() {
+        use std::time::{Duration, Instant};
+        futures_lite::future::block_on(async {
+            let shell = std::path::Path::new("/bin/sh");
+            assert_eq!(capture(shell, &["-c", "printf hello"], Duration::from_secs(1)).await.as_deref(), Some("hello"));
+            assert_eq!(capture(shell, &["-c", "printf failure; exit 7"], Duration::from_secs(1)).await, None);
+            let before = Instant::now();
+            assert_eq!(capture(shell, &["-c", "exec sleep 5"], Duration::from_millis(30)).await, None);
+            assert!(before.elapsed() < Duration::from_secs(1));
+            assert_eq!(capture(shell, &["-c", "head -c 10000 /dev/zero"], Duration::from_secs(1)).await, None);
+        });
+    }
+}

From f20f364d554eb23e315f7697afee7a2675eaea71 Mon Sep 17 00:00:00 2001
From: James Chapman <james@uplinkzero.com>
Date: Thu, 22 Oct 2026 18:10:36 +0100
Subject: [PATCH 08/29] hayro-jbig2: cap long-form referred-to segment count
 (#176)

* hayro-jbig2: cap long-form referred-to-segment count

A crafted JBIG2 segment header can claim a 29-bit referred-to-segment count;
Vec::with_capacity reserved ~2 GiB from that field before a single
referred-to number was read, and the resulting allocation failure aborts
the process in a way catch_unwind cannot contain (fatal on wasm32, where
memory is capped well below 2 GiB). A ~100 KB Flate-compressed PDF was
enough to reach it inside the 256 MiB stream budget.

Real files refer to a handful of segments, so the count is now capped at
u16::MAX; larger claims fail as InvalidReferredCount before any
retention-flag bytes are consumed. Regression test included.

Updates SOURCE.json's local hash for src/segment.rs and records the patch
in vendor/README.craft-reader.md, following the vendored tree's provenance
practice.

Co-Authored-By: Claude Code <noreply@anthropic.com>

* hayro-jbig2: record git-blob sha256 for patched segment.rs

The previous entry hashed the Windows working-tree checkout (CRLF) of
src/segment.rs instead of the LF content git stores, so every other
manifest entry's convention (git-blob content hash) was broken by this
one file. Re-hash against `git show HEAD:vendor/hayro-jbig2/src/segment.rs`
as the vendored manifests' other 30 entries do.

Co-Authored-By: Claude Code <noreply@anthropic.com>

---------

Co-authored-by: Claude Code <noreply@anthropic.com>
---
 vendor/README.craft-reader.md     |  6 +++++
 vendor/hayro-jbig2/SOURCE.json    |  2 +-
 vendor/hayro-jbig2/src/segment.rs | 37 +++++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/vendor/README.craft-reader.md b/vendor/README.craft-reader.md
index 704ce25d..e7ab08cf 100644
--- a/vendor/README.craft-reader.md
+++ b/vendor/README.craft-reader.md
@@ -36,6 +36,12 @@ Byte transfer-function samples use rounded 8-bit values; failed or non-finite ev
 leave the sample unchanged. Historical source hashes remain in each `SOURCE.json`,
 alongside local hashes and the compatibility reference.
 
+The JBIG2 segment parser caps the long-form referred-to-segment count at `u16::MAX`
+and rejects a larger claim as an invalid count before any retention-flag or
+referred-to-number bytes are consumed, so a crafted header cannot turn
+`Vec::with_capacity` into a multi-gigabyte reservation that aborts on allocation
+failure.
+
 This remains the patched 0.7 backend. It retains the existing Bradford Lab conversion,
 floating component precision and codec versions, rather than claiming full 0.8
 equivalence. The independent color oracles, backend tests and facade contracts cover
diff --git a/vendor/hayro-jbig2/SOURCE.json b/vendor/hayro-jbig2/SOURCE.json
index 50ec8937..bb9d6a70 100644
--- a/vendor/hayro-jbig2/SOURCE.json
+++ b/vendor/hayro-jbig2/SOURCE.json
@@ -176,7 +176,7 @@
       "path": "src/segment.rs",
       "source_sha256": "58d9fd05a15358b4ca945ffa3b8c1872f4ea57f8bbe50e8db3c6fce5bcac2914",
       "source_git_blob": "35c17c38af62b1fece4e280cda923cdcb23a8661",
-      "sha256": "58d9fd05a15358b4ca945ffa3b8c1872f4ea57f8bbe50e8db3c6fce5bcac2914"
+      "sha256": "c64e2845dbdd26e33b5461acde399ba4820f9942e9090a32782f44ff0fd5e61f"
     },
     {
       "path": "src/simd.rs",
diff --git a/vendor/hayro-jbig2/src/segment.rs b/vendor/hayro-jbig2/src/segment.rs
index 35c17c38..1c6fcf31 100644
--- a/vendor/hayro-jbig2/src/segment.rs
+++ b/vendor/hayro-jbig2/src/segment.rs
@@ -8,6 +8,14 @@ use alloc::vec::Vec;
 use crate::error::{ParseError, Result, SegmentError, bail, err};
 use crate::reader::Reader;
 
+/// PdfCraft patch: the most segments one segment may refer to. A crafted long-form
+/// header can claim a 29-bit count, which `Vec::with_capacity` below would turn into
+/// a multi-gigabyte reservation before a single referred-to number is read — an
+/// allocation failure then aborts the process in a way `catch_unwind` cannot contain.
+/// Real files refer to a handful of segments, so `u16::MAX` is far beyond any
+/// legitimate need.
+pub(crate) const MAX_REFERRED_TO_SEGMENTS: u32 = u16::MAX as u32;
+
 /// "The segment type is a number between 0 and 63, inclusive. Not all values
 /// are allowed." (7.3)
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -183,6 +191,12 @@ pub(crate) fn parse_segment_header(reader: &mut Reader<'_>) -> Result<SegmentHea
         u32::from_be_bytes([count_and_retention & 0x1F, rest[0], rest[1], rest[2]])
     };
 
+    // Reject an absurd count before reserving memory for it, and before
+    // skipping the retention-flag bytes it claims to own.
+    if referred_to_count > MAX_REFERRED_TO_SEGMENTS {
+        bail!(SegmentError::InvalidReferredCount);
+    }
+
     // Skip retention flag bytes in long form.
     // "The first one-byte field following the initial four-byte field is formatted
     // as follows: Bit 0: Retain bit for this segment. Bit 1-7: Retain bits for
@@ -416,4 +430,27 @@ mod tests {
 
         assert_eq!(header.data_length, Some(32));
     }
+
+    #[test]
+    fn test_referred_to_count_is_capped() {
+        use crate::error::DecodeError;
+
+        // A long-form header claiming the 29-bit maximum of 536,870,911
+        // referred-to segments would otherwise make `Vec::with_capacity`
+        // reserve ~2 GiB before a single referred-to number is read.
+        // The first byte is 0xFF: long form, count bits 0x1F; the count is
+        // 0x1FFFFFFF.
+        let data = [
+            0x00, 0x01, 0x00, 0x00, // Segment number = 65536
+            0x86, // Flags: type 6, page assoc 1 byte, deferred non-retain
+            0xFF, 0xFF, 0xFF, 0xFF, // Long form, count = 536,870,911
+        ];
+
+        let mut reader = Reader::new(&data);
+        let error = parse_segment_header(&mut reader).unwrap_err();
+        assert!(matches!(
+            error,
+            DecodeError::Segment(SegmentError::InvalidReferredCount)
+        ));
+    }
 }

From b1401e33b105ca2861575ede90f67f4d54449001 Mon Sep 17 00:00:00 2001
From: skylar taylor-barrick <hi@skylar.cc>
Date: Thu, 22 Oct 2026 12:49:41 -0600
Subject: [PATCH 09/29] Share browser download resource ownership (#226)

Add opt-in browser download helpers that own detached links and object URLs, clean up failed or abandoned preparation, and register delayed URL cleanup before issuing a click. Applications retain filename, MIME type, pacing, and user-activation policy.

Include browser lifecycle and failure-path tests, public API documentation, and Sonar test-source classification. All 32 PR checks passed; targeted WASM Clippy and formatting passed in local validation.
---
 Cargo.lock                                 |  5 ++
 NOTICE                                     |  2 +-
 README.md                                  |  2 +-
 crates/platform/Cargo.toml                 | 10 +++
 crates/platform/NOTICE                     |  2 +-
 crates/platform/README.md                  | 13 ++-
 crates/platform/src/browser.rs             | 89 ++++++++++++++++++++
 crates/platform/src/lib.rs                 |  2 +
 crates/platform/tests/browser_downloads.rs | 98 ++++++++++++++++++++++
 crates/platform/tests/browser_harness.js   | 42 ++++++++++
 sonar-project.properties                   |  4 +
 11 files changed, 265 insertions(+), 4 deletions(-)
 create mode 100644 crates/platform/src/browser.rs
 create mode 100644 crates/platform/tests/browser_downloads.rs
 create mode 100644 crates/platform/tests/browser_harness.js

diff --git a/Cargo.lock b/Cargo.lock
index 50ffab2e..ea00f1fb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -828,6 +828,11 @@ dependencies = [
  "async-process",
  "egui",
  "futures-lite",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-bindgen-test",
+ "web-sys",
  "zbus",
 ]
 
diff --git a/NOTICE b/NOTICE
index 8703347b..38a65fcf 100644
--- a/NOTICE
+++ b/NOTICE
@@ -110,7 +110,7 @@ applications retain their own document-font selection and licensing policy.
 Platform lifecycle source provenance
 
 The optional crates/platform services adapt the preserved local platform candidate
-9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and lifecycle),
+9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and browser resource ownership),
 and current application implementations:
 - PdfCraft crates/platform/src/desktop_theme.rs, a8cd797a917b1007544575c7280c9a0ce6a17e8f.
 - CADCraft apps/cadcraft/src/desktop_theme.rs, 0cc66ad3066e71f2c3d4cacb7de905e79ba1c95b.
diff --git a/README.md b/README.md
index 7de7d010..2dc92f8a 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
 
 ## Libraries
 
-- [`craft-platform`](crates/platform/README.md): optional native dialog lifecycle and Linux/BSD desktop appearance observation; application policy stays in the apps.
+- [`craft-platform`](crates/platform/README.md): optional native dialog lifecycle, Linux/BSD desktop appearance observation and browser download ownership; application policy stays in the apps.
 
 - [`craft-ai-core`](crates/ai-core/README.md): the data model and contract for AI in the Craft Apps (connections, models, tools, requests, jobs, consent, history, route spec). Pure, no I/O, wasm-safe. Contract in [docs/ai-shared-layer.md](docs/ai-shared-layer.md).
 - [`craft-pdf`](crates/pdf/README.md): independently optional PDF parsing, interpretation, rasterization and guarded authoring. Apps retain layout, fonts, editing and export policy; writer-only consumers do not enable the shared reader.
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index 528a9a97..c71d6dbd 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -14,6 +14,7 @@ workspace = true
 default = []
 dialogs = []
 appearance = ["dep:zbus", "dep:futures-lite", "dep:async-channel", "dep:async-io", "dep:async-process"]
+browser = ["dep:wasm-bindgen", "dep:js-sys", "dep:web-sys"]
 egui = ["dep:egui"]
 
 [dependencies]
@@ -25,3 +26,12 @@ futures-lite = { version = "2", optional = true }
 async-channel = { version = "2", optional = true }
 async-io = { version = "2", optional = true }
 async-process = { version = "2", optional = true }
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wasm-bindgen = { version = "0.2", optional = true }
+js-sys = { version = "0.3", optional = true }
+web-sys = { version = "0.3", features = ["Window", "Document", "HtmlElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Node", "Element"], optional = true }
+
+[target.'cfg(target_arch = "wasm32")'.dev-dependencies]
+wasm-bindgen-test = "0.3"
+wasm-bindgen-futures = "0.4"
diff --git a/crates/platform/NOTICE b/crates/platform/NOTICE
index 3f99d579..c369e009 100644
--- a/crates/platform/NOTICE
+++ b/crates/platform/NOTICE
@@ -1,7 +1,7 @@
 Platform lifecycle source provenance
 
 The optional crates/platform services adapt the preserved local platform candidate
-9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and lifecycle),
+9b135779a1e7136438a217c18afe1693ea23f1ab (dialog outcomes and browser resource ownership),
 and current application implementations:
 - PdfCraft crates/platform/src/desktop_theme.rs, a8cd797a917b1007544575c7280c9a0ce6a17e8f.
 - CADCraft apps/cadcraft/src/desktop_theme.rs, 0cc66ad3066e71f2c3d4cacb7de905e79ba1c95b.
diff --git a/crates/platform/README.md b/crates/platform/README.md
index ba9d4cea..14494d61 100644
--- a/crates/platform/README.md
+++ b/crates/platform/README.md
@@ -10,6 +10,7 @@ third-party dependencies. Enable only the services a host uses.
 | `dialogs` | Reserve waiting workers before eager UI-thread native picker creation; serial requests, failure delivery and completion wakeups. The backend factory belongs to the app. |
 | `egui` | Combine with `dialogs` for the deferred-close guard or with `appearance` for native theme mapping. |
 | `appearance` | Linux/BSD XDG desktop preference observation, owned cancellable subscriptions, bounded reads/helper capture, legacy compatibility and reconnect. |
+| `browser` | Wasm download link/object URL ownership, cleanup on setup failure or abandonment, and cleanup timer registration before clicking. |
 
 
 ## Native dialogs
@@ -63,8 +64,18 @@ It does not change styles or theme preference. Hosts whose custom palette is man
 native window follows System keep observation active for the native window. Native decoration
 rendering still depends on the window manager and requires visible acceptance testing.
 
+## Browser downloads
+
+`PreparedDownload::{bytes,blob}` owns a detached anchor and URL until click or drop. Call `click`
+with the application's positive URL lifetime; setup/attachment/timer failure releases resources
+without clicking. A successful return means a click was issued, not that the browser saved a file.
+Applications own names, MIME types, pacing, capture hooks and user activation. File System Access
+and print iframe lifetimes remain separate. This service has no native filesystem semantics.
+
 ## Integration
 
 Enable only the services a host uses. Applications retain palettes, settings, document identity,
 close policy, filters, names, MIME types and native command routing. Existing craft-settings,
-craft-atomic, craft-print, craft-docpath and craft-quit remain canonical.
+craft-atomic, craft-print, craft-docpath and craft-quit remain canonical. `craft-window` owns
+decoration selection and window-button layout; appearance observation and native color hints here
+do not choose a frame or draw an application header.
diff --git a/crates/platform/src/browser.rs b/crates/platform/src/browser.rs
new file mode 100644
index 00000000..965eb925
--- /dev/null
+++ b/crates/platform/src/browser.rs
@@ -0,0 +1,89 @@
+//! Browser downloads. Caller owns MIME/name decisions and pacing; this module owns resource cleanup.
+use wasm_bindgen::{JsCast, JsValue, closure::Closure};
+use web_sys::{Blob, BlobPropertyBag, HtmlAnchorElement, Url, Window};
+
+/// Object-URL lifetime for a requested download; the default is 60 seconds.
+#[derive(Clone, Copy, Debug)]
+pub struct DownloadOptions {
+    /// Positive delay in milliseconds before cleanup; nonpositive values reject the click.
+    pub revoke_after_ms: i32,
+}
+impl Default for DownloadOptions {
+    fn default() -> Self {
+        Self { revoke_after_ms: 60_000 }
+    }
+}
+
+/// Prepared DOM link and object URL. Dropping without clicking cleans both up.
+/// Preparation can occur before an app's download pacer yields.
+pub struct PreparedDownload {
+    window: Window,
+    anchor: HtmlAnchorElement,
+    url: Option<String>,
+}
+impl PreparedDownload {
+    /// Prepare an owned Blob and hidden link using the caller's bytes, MIME and filename.
+    /// No download is requested until [`Self::click`]; browser setup failures return an error.
+    pub fn bytes(name: &str, mime: &str, bytes: &[u8]) -> Result<Self, JsValue> {
+        let parts = js_sys::Array::of1(&js_sys::Uint8Array::from(bytes));
+        let options = BlobPropertyBag::new();
+        options.set_type(mime);
+        Self::blob(name, &Blob::new_with_u8_array_sequence_and_options(&parts, &options)?)
+    }
+    /// Prepare a hidden link and owned object URL for an existing Blob.
+    /// Blank filenames, missing browser DOM and setup failures return an error.
+    pub fn blob(name: &str, blob: &Blob) -> Result<Self, JsValue> {
+        if name.trim().is_empty() {
+            return Err(JsValue::from_str("a file name is required"));
+        }
+        let window = web_sys::window().ok_or_else(|| JsValue::from_str("no browser window"))?;
+        let document = window.document().ok_or_else(|| JsValue::from_str("no browser document"))?;
+        document.body().ok_or_else(|| JsValue::from_str("the page has no body"))?;
+        let anchor = document.create_element("a")?.dyn_into::<HtmlAnchorElement>()?;
+        anchor.set_download(name);
+        anchor.set_attribute("style", "display:none")?;
+        let download = Self { window, anchor, url: Some(Url::create_object_url_with_blob(blob)?) };
+        if let Some(url) = &download.url {
+            download.anchor.set_href(url);
+        }
+        Ok(download)
+    }
+    /// Register cleanup before clicking: a timer failure returns an error without triggering
+    /// a partial download. Success only means a click was issued; browser acceptance is unobservable.
+    pub fn click(mut self, options: DownloadOptions) -> Result<(), JsValue> {
+        if options.revoke_after_ms <= 0 {
+            return Err(JsValue::from_str("download lifetime must be positive"));
+        }
+        let Some(url) = self.url.as_ref().cloned() else {
+            return Err(JsValue::from_str("download has no object URL"));
+        };
+        let body = self.window.document().and_then(|d| d.body()).ok_or_else(|| JsValue::from_str("the page has no body"))?;
+        body.append_child(&self.anchor)?;
+        let revoke = Closure::once(move || {
+            let _ = Url::revoke_object_url(&url);
+        });
+        self.window.set_timeout_with_callback_and_timeout_and_arguments_0(revoke.as_ref().unchecked_ref(), options.revoke_after_ms)?;
+        revoke.forget(); // Ownership transfers only after successful timer registration.
+        self.url = None;
+        self.anchor.click();
+        Ok(())
+    }
+}
+impl Drop for PreparedDownload {
+    fn drop(&mut self) {
+        self.anchor.remove();
+        if let Some(url) = self.url.take() {
+            let _ = Url::revoke_object_url(&url);
+        }
+    }
+}
+/// Prepare bytes and request a download with the specified URL lifetime.
+/// Success means the click was issued, not that the browser accepted or saved the file.
+pub fn download_bytes(name: &str, mime: &str, bytes: &[u8], options: DownloadOptions) -> Result<(), JsValue> {
+    PreparedDownload::bytes(name, mime, bytes)?.click(options)
+}
+/// Prepare a Blob and request a download with the specified URL lifetime.
+/// Setup or scheduling failures clean up owned resources and return an error.
+pub fn download_blob(name: &str, blob: &Blob, options: DownloadOptions) -> Result<(), JsValue> {
+    PreparedDownload::blob(name, blob)?.click(options)
+}
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
index 2335afc6..b3fa54e0 100644
--- a/crates/platform/src/lib.rs
+++ b/crates/platform/src/lib.rs
@@ -2,6 +2,8 @@
 //! Shared lifecycle mechanics; application state, theme choices and file policy stay in hosts.
 #[cfg(feature = "appearance")]
 pub mod appearance;
+#[cfg(all(feature = "browser", target_arch = "wasm32"))]
+pub mod browser;
 pub mod dialog_outcome;
 #[cfg(all(feature = "dialogs", not(target_arch = "wasm32")))]
 pub mod dialogs;
diff --git a/crates/platform/tests/browser_downloads.rs b/crates/platform/tests/browser_downloads.rs
new file mode 100644
index 00000000..a9dd94ae
--- /dev/null
+++ b/crates/platform/tests/browser_downloads.rs
@@ -0,0 +1,98 @@
+#![cfg(all(target_arch = "wasm32", feature = "browser"))]
+use craft_platform::browser::{DownloadOptions, PreparedDownload, download_bytes};
+use wasm_bindgen::{JsValue, prelude::wasm_bindgen};
+use wasm_bindgen_test::{wasm_bindgen_test, wasm_bindgen_test_configure};
+wasm_bindgen_test_configure!(run_in_browser);
+
+#[wasm_bindgen(module = "/tests/browser_harness.js")]
+extern "C" {
+    fn setup(mode: &str);
+    fn restore();
+    fn created_count() -> u32;
+    fn revoked_count() -> u32;
+    fn clicked_count() -> u32;
+    fn anchor_count() -> u32;
+    fn last_name() -> String;
+    fn last_mime() -> String;
+    fn timer_before_click() -> bool;
+    fn wait_for_cleanup() -> js_sys::Promise;
+}
+struct Restore;
+impl Drop for Restore {
+    fn drop(&mut self) {
+        restore();
+    }
+}
+
+#[wasm_bindgen_test]
+fn abandoning_a_prepared_download_releases_its_url() -> Result<(), JsValue> {
+    setup("");
+    let _restore = Restore;
+    let prepared = PreparedDownload::bytes("export.txt", "text/plain", b"content")?;
+    assert_eq!(created_count(), 1);
+    drop(prepared);
+    assert_eq!(revoked_count(), 1);
+    assert_eq!(clicked_count(), 0);
+    assert_eq!(anchor_count(), 0);
+    Ok(())
+}
+
+#[wasm_bindgen_test]
+fn failed_attachment_and_timer_do_not_click_or_leak() {
+    for mode in ["attach-error", "timer-error"] {
+        setup(mode);
+        let _restore = Restore;
+        assert!(download_bytes("export.txt", "text/plain", b"content", Default::default()).is_err());
+        assert_eq!(created_count(), 1);
+        assert_eq!(revoked_count(), 1);
+        assert_eq!(clicked_count(), 0);
+        assert_eq!(anchor_count(), 0);
+    }
+}
+
+#[wasm_bindgen_test]
+async fn successful_download_releases_its_url_after_the_click() -> Result<(), JsValue> {
+    setup("");
+    let _restore = Restore;
+    download_bytes("export.txt", "text/plain", b"content", DownloadOptions { revoke_after_ms: 5 })?;
+    assert_eq!(clicked_count(), 1);
+    assert_eq!(last_name(), "export.txt");
+    assert_eq!(last_mime(), "text/plain");
+    assert!(timer_before_click());
+    assert_eq!(revoked_count(), 0);
+    assert_eq!(anchor_count(), 0);
+    wasm_bindgen_futures::JsFuture::from(wait_for_cleanup()).await?;
+    assert_eq!(revoked_count(), 1);
+    Ok(())
+}
+
+#[wasm_bindgen_test]
+fn invalid_lifetime_cleans_a_prepared_download() {
+    setup("");
+    let _restore = Restore;
+    assert!(download_bytes("export.txt", "text/plain", b"content", DownloadOptions { revoke_after_ms: 0 }).is_err());
+    assert_eq!(revoked_count(), 1);
+    assert_eq!(clicked_count(), 0);
+}
+
+#[wasm_bindgen_test]
+fn failed_setup_does_not_allocate_a_url_or_click() {
+    for mode in ["element-error", "style-error"] {
+        setup(mode);
+        let _restore = Restore;
+        assert!(download_bytes("export.txt", "text/plain", b"content", Default::default()).is_err());
+        assert_eq!(created_count(), 0);
+        assert_eq!(revoked_count(), 0);
+        assert_eq!(clicked_count(), 0);
+        assert_eq!(anchor_count(), 0);
+    }
+}
+
+#[wasm_bindgen_test]
+fn empty_name_is_rejected_before_allocating_resources() {
+    setup("");
+    let _restore = Restore;
+    assert!(download_bytes("  ", "text/plain", b"content", Default::default()).is_err());
+    assert_eq!(created_count(), 0);
+    assert_eq!(clicked_count(), 0);
+}
diff --git a/crates/platform/tests/browser_harness.js b/crates/platform/tests/browser_harness.js
new file mode 100644
index 00000000..fc652c31
--- /dev/null
+++ b/crates/platform/tests/browser_harness.js
@@ -0,0 +1,42 @@
+// Test-only browser fault injection; no app runtime depends on this module.
+let originals;
+let created, revoked, clicked, scheduled, lastName, lastMime, timerBeforeClick;
+export function setup(mode) {
+    created = 0; revoked = 0; clicked = 0; scheduled = 0;
+    lastName = ''; lastMime = ''; timerBeforeClick = false;
+    originals = {
+        create: URL.createObjectURL, revoke: URL.revokeObjectURL,
+        click: HTMLAnchorElement.prototype.click,
+        append: Node.prototype.appendChild, timer: window.setTimeout,
+        element: Document.prototype.createElement,
+        attribute: Element.prototype.setAttribute,
+    };
+    URL.createObjectURL = function(blob) { created++; lastMime = blob.type; return originals.create.call(URL, blob); };
+    URL.revokeObjectURL = function(url) { revoked++; return originals.revoke.call(URL, url); };
+    HTMLAnchorElement.prototype.click = function() {
+        clicked++; lastName = this.download; timerBeforeClick = scheduled > 0;
+    };
+    window.setTimeout = function(...args) {
+        if (mode === 'timer-error') throw new Error('timer failed');
+        scheduled++;
+        return originals.timer.apply(window, args);
+    };
+    if (mode === 'attach-error') Node.prototype.appendChild = function() { throw new Error('attachment failed'); };
+    if (mode === 'element-error') Document.prototype.createElement = function() { throw new Error('element failed'); };
+    if (mode === 'style-error') Element.prototype.setAttribute = function() { throw new Error('style failed'); };
+}
+export function restore() {
+    URL.createObjectURL = originals.create; URL.revokeObjectURL = originals.revoke;
+    HTMLAnchorElement.prototype.click = originals.click;
+    Node.prototype.appendChild = originals.append; window.setTimeout = originals.timer;
+    Document.prototype.createElement = originals.element;
+    Element.prototype.setAttribute = originals.attribute;
+}
+export function created_count() { return created; }
+export function revoked_count() { return revoked; }
+export function clicked_count() { return clicked; }
+export function anchor_count() { return document.querySelectorAll('a[download]').length; }
+export function last_name() { return lastName; }
+export function last_mime() { return lastMime; }
+export function timer_before_click() { return timerBeforeClick; }
+export function wait_for_cleanup() { return new Promise(resolve => originals.timer.call(window, resolve, 50)); }
diff --git a/sonar-project.properties b/sonar-project.properties
index b2368f5d..8265ddc1 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,2 +1,6 @@
 sonar.projectKey=storytold_craft-libs
 sonar.organization=storytold
+
+# Browser fault-injection fixtures belong to the test analysis scope.
+sonar.tests=crates/platform/tests
+sonar.test.inclusions=crates/platform/tests/**

From 7a6d60a285bc721ee330792111698f412ac5cf23 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 19:17:00 -0400
Subject: [PATCH 10/29] security: enforce HTTPS redirects and atomic write in
 fetch-pdf-test-fonts.py

---
 scripts/fetch-pdf-test-fonts.py | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/scripts/fetch-pdf-test-fonts.py b/scripts/fetch-pdf-test-fonts.py
index 99ce3946..5da6d9cd 100644
--- a/scripts/fetch-pdf-test-fonts.py
+++ b/scripts/fetch-pdf-test-fonts.py
@@ -4,14 +4,27 @@
 import argparse
 import hashlib
 import json
+import os
 from pathlib import Path
+import tempfile
 import time
 import urllib.error
+import urllib.parse
 import urllib.request
 
 
+class _HttpsOnlyRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        if urllib.parse.urlsplit(newurl).scheme != "https":
+            raise ValueError("refusing to follow a non-HTTPS redirect")
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+urllib.request.install_opener(urllib.request.build_opener(_HttpsOnlyRedirectHandler))
+
+
 def fetch(url):
-    if not url.startswith("https://"):
+    if urllib.parse.urlsplit(url).scheme != "https":
         raise ValueError("refusing to fetch a non-HTTPS URL")
     for attempt in range(3):
         try:
@@ -53,7 +66,17 @@ def main():
         data = fetch(url)
         if len(data) > 16 * 1024 * 1024 or hashlib.sha256(data).hexdigest() != digest:
             raise ValueError(f"fixture size or SHA-256 mismatch: {name}")
-        path.write_bytes(data)
+        fd, tmp = tempfile.mkstemp(dir=destination, prefix=f".{name}.", suffix=".tmp")
+        try:
+            with os.fdopen(fd, "wb") as handle:
+                handle.write(data)
+            os.replace(tmp, destination / name)
+        except BaseException:
+            try:
+                os.unlink(tmp)
+            except OSError:
+                pass
+            raise
         print(f"Fetched and verified {name}")
 
 

From a719521c13855a49625e62de0f6d198ad1e1efa6 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:37:34 -0400
Subject: [PATCH 11/29] security: bound ai-core redaction, template rendering
 and model checks; consent for params-only requests

- redact matches secrets in the original text only, so markers are never searched again
  (CodeRabbit CWE-400, secret.rs:47)
- render_text/render_value share one MAX_RENDERED_BYTES budget across repeated slots
  (CodeRabbit CWE-400, spec/template.rs:122)
- Connection::validate checks model-ID uniqueness with a set instead of a pairwise scan
  (CodeRabbit CWE-407, connection.rs:205)
- Disclosure::kinds counts parameters as text, so a request carrying only params still needs
  an agreement (CodeRabbit CWE-863, consent.rs:123)
---
 crates/ai-core/src/connection.rs      |  5 +--
 crates/ai-core/src/consent.rs         | 17 +++++++++-
 crates/ai-core/src/secret.rs          | 45 ++++++++++++++++++++++++---
 crates/ai-core/src/spec.rs            |  5 ++-
 crates/ai-core/src/spec/template.rs   | 33 +++++++++++++++-----
 crates/ai-core/tests/spec_template.rs | 12 +++++++
 6 files changed, 101 insertions(+), 16 deletions(-)

diff --git a/crates/ai-core/src/connection.rs b/crates/ai-core/src/connection.rs
index d23dca5d..2ae692d6 100644
--- a/crates/ai-core/src/connection.rs
+++ b/crates/ai-core/src/connection.rs
@@ -202,8 +202,9 @@ impl Connection {
                 return Err(ConnectionError::KeyHeader("a header name needs a connection that uses a key"));
             }
         }
-        for (i, m) in self.models.iter().enumerate() {
-            if self.models.iter().skip(i + 1).any(|o| o.id == m.id) {
+        let mut seen = std::collections::HashSet::with_capacity(self.models.len());
+        for m in &self.models {
+            if !seen.insert(&m.id) {
                 return Err(ConnectionError::DuplicateModel(m.id.to_string()));
             }
         }
diff --git a/crates/ai-core/src/consent.rs b/crates/ai-core/src/consent.rs
index ca5c3635..2b6a860d 100644
--- a/crates/ai-core/src/consent.rs
+++ b/crates/ai-core/src/consent.rs
@@ -67,9 +67,13 @@ impl Disclosure {
         }
     }
 
-    /// The distinct kinds of data this request sends.
+    /// The distinct kinds of data this request sends. Parameters carry values the app chose,
+    /// free text among them, so a request with any counts as sending text even with no inputs.
     pub fn kinds(&self) -> Vec<PayloadKind> {
         let mut kinds: Vec<PayloadKind> = self.items.iter().map(|i| i.kind).collect();
+        if !self.param_names.is_empty() {
+            kinds.push(PayloadKind::Text);
+        }
         kinds.sort();
         kinds.dedup();
         kinds
@@ -242,6 +246,17 @@ mod tests {
         assert!(ledger.needs_consent(&d, 0));
     }
 
+    #[test]
+    fn parameters_alone_still_need_consent() {
+        let only_params = Request::new(CapabilityId::parse("image.inpaint").unwrap()).with_param("negative", "a private note".into());
+        let d = disclosure_for(&only_params);
+        assert_eq!(d.kinds(), vec![PayloadKind::Text]);
+        let mut ledger = ConsentLedger::default();
+        assert!(ledger.needs_consent(&d, 0));
+        ledger.grant(&d);
+        assert!(!ledger.needs_consent(&d, 0));
+    }
+
     fn upscale_req() -> Request {
         Request::new(CapabilityId::parse("image.upscale").unwrap()).with_input(InputRole::Source, Payload::inline("image/png", vec![0; 10]).unwrap())
     }
diff --git a/crates/ai-core/src/secret.rs b/crates/ai-core/src/secret.rs
index b6bb9c94..0a40b834 100644
--- a/crates/ai-core/src/secret.rs
+++ b/crates/ai-core/src/secret.rs
@@ -40,13 +40,32 @@ impl fmt::Display for SecretString {
 }
 
 /// Replaces every occurrence of each non-empty secret in `text` with `[redacted]`.
+///
+/// Matches are found in `text` itself, never in the markers already written, so the output is at
+/// most a fixed multiple of the input whatever the secrets are. Overlapping matches of different
+/// secrets become one marker.
 pub fn redact(text: &str, secrets: &[&SecretString]) -> String {
-    let mut out = text.to_owned();
-    for secret in secrets {
-        if !secret.is_empty() {
-            out = out.replace(secret.expose(), "[redacted]");
+    const MARKER: &str = "[redacted]";
+    let mut values: Vec<&str> = secrets.iter().map(|s| s.expose()).filter(|v| !v.is_empty()).collect();
+    values.sort_unstable();
+    values.dedup();
+    let mut spans: Vec<(usize, usize)> = values.iter().flat_map(|v| text.match_indices(v).map(|(at, m)| (at, at + m.len()))).collect();
+    spans.sort_unstable();
+    let mut out = String::with_capacity(text.len());
+    let mut done = 0;
+    let mut i = 0;
+    while i < spans.len() {
+        let (start, mut end) = spans[i];
+        i += 1;
+        while i < spans.len() && spans[i].0 < end {
+            end = end.max(spans[i].1);
+            i += 1;
         }
+        out.push_str(&text[done..start]);
+        out.push_str(MARKER);
+        done = end;
     }
+    out.push_str(&text[done..]);
     out
 }
 
@@ -69,6 +88,24 @@ mod tests {
         assert_eq!(out, "bad key [redacted] ([redacted])");
     }
 
+    #[test]
+    fn redact_never_searches_its_own_markers() {
+        // Each secret matches the marker the one before it wrote; replacing in turn doubled the
+        // text for every secret.
+        let r = SecretString::new("r");
+        let marker = SecretString::new("[redacted]");
+        let secrets: Vec<&SecretString> = std::iter::once(&r).chain(std::iter::repeat_n(&marker, 64)).collect();
+        assert_eq!(redact("rrrr", &secrets), "[redacted][redacted][redacted][redacted]");
+    }
+
+    #[test]
+    fn redact_merges_overlapping_secrets() {
+        let a = SecretString::new("abc");
+        let b = SecretString::new("bcd");
+        assert_eq!(redact("xabcdx", &[&a, &b]), "x[redacted]x");
+        assert_eq!(redact("abcabc", &[&a]), "[redacted][redacted]");
+    }
+
     #[test]
     fn redact_ignores_empty_secret() {
         let s = SecretString::new("");
diff --git a/crates/ai-core/src/spec.rs b/crates/ai-core/src/spec.rs
index 424ac905..0712e266 100644
--- a/crates/ai-core/src/spec.rs
+++ b/crates/ai-core/src/spec.rs
@@ -37,8 +37,11 @@ pub const SPEC_VERSION: u32 = 1;
 pub const MAX_SPEC_BYTES: usize = 32 * 1024;
 /// Most models one spec may offer.
 pub const MAX_MODELS: usize = 16;
-/// Largest rendered or stored template (a body, serialized).
+/// Largest stored template (a body, serialized).
 pub const MAX_TEMPLATE_BYTES: usize = 4 * 1024;
+/// Most text one rendered template may hold, summed over its strings with every substitution made.
+/// A slot may repeat, so this, not [`MAX_TEMPLATE_BYTES`], bounds what a prompt can grow to.
+pub const MAX_RENDERED_BYTES: usize = 4 * 1024 * 1024;
 /// Deepest JSON pointer.
 pub const MAX_POINTER_DEPTH: usize = 8;
 /// Most entries in a status table.
diff --git a/crates/ai-core/src/spec/template.rs b/crates/ai-core/src/spec/template.rs
index d276ab61..bc1d79b4 100644
--- a/crates/ai-core/src/spec/template.rs
+++ b/crates/ai-core/src/spec/template.rs
@@ -114,23 +114,40 @@ pub fn value_slots(template: &Value) -> Result<Vec<Slot>, String> {
     Ok(out)
 }
 
+/// Renders one string. Fails past [`MAX_RENDERED_BYTES`](crate::spec::MAX_RENDERED_BYTES).
 pub fn render_text(text: &str, values: &Values<'_>) -> Result<String, String> {
+    let mut left = crate::spec::MAX_RENDERED_BYTES;
+    render_text_within(text, values, &mut left)
+}
+
+/// Renders `text`, taking its length from `left`; a template that repeats a slot cannot outgrow it.
+fn render_text_within(text: &str, values: &Values<'_>, left: &mut usize) -> Result<String, String> {
     let mut out = String::new();
     for piece in pieces(text)? {
-        match piece {
-            Piece::Text(t) => out.push_str(&t),
-            Piece::Slot(slot, name) => out.push_str(values.get(slot).ok_or_else(|| format!("{{{name}}} is not available in this call"))?),
-        }
+        let add = match &piece {
+            Piece::Text(t) => t.as_str(),
+            Piece::Slot(slot, name) => values.get(*slot).ok_or_else(|| format!("{{{name}}} is not available in this call"))?,
+        };
+        *left = left.checked_sub(add.len()).ok_or_else(|| format!("a rendered template is at most {} bytes", crate::spec::MAX_RENDERED_BYTES))?;
+        out.push_str(add);
     }
     Ok(out)
 }
 
-/// Renders every string value of `template`. Keys are never substituted.
+/// Renders every string value of `template`. Keys are never substituted. All strings together
+/// share one [`MAX_RENDERED_BYTES`](crate::spec::MAX_RENDERED_BYTES) budget.
 pub fn render_value(template: &Value, values: &Values<'_>) -> Result<Value, String> {
+    let mut left = crate::spec::MAX_RENDERED_BYTES;
+    render_value_within(template, values, &mut left)
+}
+
+fn render_value_within(template: &Value, values: &Values<'_>, left: &mut usize) -> Result<Value, String> {
     Ok(match template {
-        Value::String(s) => Value::String(render_text(s, values)?),
-        Value::Array(items) => Value::Array(items.iter().map(|i| render_value(i, values)).collect::<Result<_, _>>()?),
-        Value::Object(map) => Value::Object(map.iter().map(|(k, v)| Ok((k.clone(), render_value(v, values)?))).collect::<Result<_, String>>()?),
+        Value::String(s) => Value::String(render_text_within(s, values, left)?),
+        Value::Array(items) => Value::Array(items.iter().map(|i| render_value_within(i, values, left)).collect::<Result<_, _>>()?),
+        Value::Object(map) => {
+            Value::Object(map.iter().map(|(k, v)| Ok((k.clone(), render_value_within(v, values, left)?))).collect::<Result<_, String>>()?)
+        }
         other => other.clone(),
     })
 }
diff --git a/crates/ai-core/tests/spec_template.rs b/crates/ai-core/tests/spec_template.rs
index f5689f67..8c7deeed 100644
--- a/crates/ai-core/tests/spec_template.rs
+++ b/crates/ai-core/tests/spec_template.rs
@@ -65,3 +65,15 @@ fn a_slot_with_no_value_is_an_error_not_an_empty_string() {
     let why = render_text("/jobs/{job_id}", &v).unwrap_err();
     assert!(why.contains("{job_id} is not available"), "{why}");
 }
+
+#[test]
+fn repeated_slots_share_one_rendered_budget() {
+    let prompt = "x".repeat(64 * 1024);
+    let v = Values { prompt: Some(&prompt), ..values() };
+    let slots = vec![json!("{prompt}"); 16];
+    assert!(render_value(&json!({ "a": slots }), &v).is_ok());
+    let slots = vec![json!("{prompt}{prompt}{prompt}{prompt}"); 32];
+    let why = render_value(&json!({ "a": slots }), &v).unwrap_err();
+    assert!(why.contains("at most"), "{why}");
+    assert!(render_text(&"{prompt}".repeat(128), &v).is_err());
+}

From c900c69553d0e2856b39a3ec36497c053d061853 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:39:20 -0400
Subject: [PATCH 12/29] security: bound cms CLUT interpolation and
 inverse-curve table construction

- Clut::multilinear enumerates corners only for dimensions between two grid points, so
  singleton dimensions no longer multiply per-pixel work (CodeRabbit CWE-407, clut.rs:238)
- Transform::from_pipeline finds a sampled curve's flat ends once per curve via
  Curve::inverse64_many instead of rescanning the table for each of the 4096 output entries
  (CodeRabbit CWE-407, curve.rs:276)
---
 crates/cms/src/clut.rs      | 42 ++++++++++++++++++++++++++++++++-----
 crates/cms/src/curve.rs     | 40 +++++++++++++++++++++++++++++++++--
 crates/cms/src/transform.rs |  3 ++-
 3 files changed, 77 insertions(+), 8 deletions(-)

diff --git a/crates/cms/src/clut.rs b/crates/cms/src/clut.rs
index e551638d..59b27cad 100644
--- a/crates/cms/src/clut.rs
+++ b/crates/cms/src/clut.rs
@@ -223,15 +223,21 @@ impl Clut {
     }
 
     fn multilinear(&self, input: &[f32], out: &mut [f32]) {
-        let n = self.inputs;
+        // Only dimensions that sit between two grid points spread over corners. A singleton
+        // dimension, or an input on a node, takes its lower corner with weight 1, so a table of
+        // many such dimensions costs no more than the dimensions that actually interpolate.
         let mut base = 0usize;
         let mut r = [0.0f32; MAX_CHANNELS];
         let mut s = [0usize; MAX_CHANNELS];
-        for d in 0..n {
-            let (b, rr, ss) = self.locate(d, input[d]);
+        let mut n = 0;
+        for (d, &v) in input.iter().enumerate().take(self.inputs) {
+            let (b, rr, ss) = self.locate(d, v);
             base += b;
-            r[d] = rr;
-            s[d] = ss;
+            if ss > 0 && rr > 0.0 {
+                r[n] = rr;
+                s[n] = ss;
+                n += 1;
+            }
         }
         let o = self.outputs;
         out[..o].iter_mut().for_each(|v| *v = 0.0);
@@ -309,4 +315,30 @@ mod tests {
         c.eval(&[0.5, 0.25], &mut o).unwrap();
         assert!((o[0] - 0.75).abs() < 1e-6);
     }
+
+    #[test]
+    fn singleton_dimensions_do_not_multiply_corners() {
+        // Fifteen inputs, all but two on a single grid point: the result interpolates only those
+        // two, and matches the same table built with two inputs.
+        let mut grid = vec![1usize; 15];
+        grid[3] = 2;
+        grid[9] = 3;
+        let wide = Clut::sample(grid, 2, |p, o| {
+            o[0] = p[3] * 0.5 + p[9] * 0.25;
+            o[1] = p[3] * p[9];
+        })
+        .unwrap();
+        let narrow = Clut::sample(vec![2, 3], 2, |p, o| {
+            o[0] = p[0] * 0.5 + p[1] * 0.25;
+            o[1] = p[0] * p[1];
+        })
+        .unwrap();
+        let mut input = [0.4f32; 15];
+        input[3] = 0.3;
+        input[9] = 0.7;
+        let (mut a, mut b) = ([0.0; 2], [0.0; 2]);
+        wide.eval_multilinear(&input, &mut a).unwrap();
+        narrow.eval_multilinear(&[0.3, 0.7], &mut b).unwrap();
+        assert!((a[0] - b[0]).abs() < 1e-6 && (a[1] - b[1]).abs() < 1e-6, "{a:?} {b:?}");
+    }
 }
diff --git a/crates/cms/src/curve.rs b/crates/cms/src/curve.rs
index f50f2d66..2ea74a91 100644
--- a/crates/cms/src/curve.rs
+++ b/crates/cms/src/curve.rs
@@ -85,6 +85,20 @@ impl Curve {
         }
     }
 
+    /// [`eval_inverse64`](Self::eval_inverse64) for many values. A table's flat ends are found
+    /// once here instead of on every call, so building an output table from a long, flat table
+    /// costs one scan of it, not one per entry.
+    pub fn inverse64_many(&self) -> impl Fn(f64) -> f64 + '_ {
+        let edges = match self {
+            Curve::Table(t) if t.len() >= 2 => Some((edge_index(t, true), edge_index(t, false))),
+            _ => None,
+        };
+        move |y| match (self, edges) {
+            (Curve::Table(t), Some((first, last))) => table_inverse_with(t, y as f32, |start| if start { first } else { last }) as f64,
+            _ => self.eval_inverse64(y),
+        }
+    }
+
     #[inline]
     pub fn eval_inverse(&self, y: f32) -> f32 {
         match self {
@@ -240,6 +254,11 @@ fn table(t: &[f32], x: f32) -> f32 {
 
 /// Exact inverse of a piecewise-linear table (binary search), for increasing or decreasing tables.
 fn table_inverse(t: &[f32], y: f32) -> f32 {
+    table_inverse_with(t, y, |start| edge_index(t, start))
+}
+
+/// [`table_inverse`] with the flat-run ends from `edge` (see [`edge_index`]).
+fn table_inverse_with(t: &[f32], y: f32, edge: impl Fn(bool) -> f32) -> f32 {
     let n = t.len();
     if n < 2 {
         return y;
@@ -248,10 +267,10 @@ fn table_inverse(t: &[f32], y: f32) -> f32 {
     let (lo_v, hi_v) = if increasing { (t[0], t[n - 1]) } else { (t[n - 1], t[0]) };
     if y <= lo_v {
         // Flat start: choose the last index still at the lowest value.
-        return if increasing { edge_index(t, true) } else { edge_index(t, false) };
+        return edge(increasing);
     }
     if y >= hi_v {
-        return if increasing { edge_index(t, false) } else { edge_index(t, true) };
+        return edge(!increasing);
     }
     let (mut lo, mut hi) = (0usize, n - 1);
     while hi - lo > 1 {
@@ -329,6 +348,23 @@ mod tests {
         assert!((dec.eval_inverse(0.25) - 0.75).abs() < 1e-6);
     }
 
+    #[test]
+    fn batch_inverse_matches_single_inverse() {
+        let mut flat = vec![0.25f32; 300];
+        flat.extend((0..300).map(|i| 0.25 + i as f32 / 600.0));
+        flat.extend([0.75f32; 300]);
+        for t in [flat.clone(), flat.iter().rev().copied().collect(), vec![0.5; 1000], Curve::Gamma(2.2).sample(256)] {
+            let c = Curve::Table(t);
+            let many = c.inverse64_many();
+            for i in 0..=200 {
+                let y = i as f64 / 200.0;
+                assert_eq!(many(y), c.eval_inverse64(y), "{y}");
+            }
+        }
+        let g = Curve::Gamma(2.2);
+        assert_eq!(g.inverse64_many()(0.3), g.eval_inverse64(0.3));
+    }
+
     #[test]
     fn hdr_and_negative_extension() {
         let c = srgb_trc();
diff --git a/crates/cms/src/transform.rs b/crates/cms/src/transform.rs
index 1dc59e82..7a8aeb0a 100644
--- a/crates/cms/src/transform.rs
+++ b/crates/cms/src/transform.rs
@@ -150,10 +150,11 @@ impl Transform {
             let tables = cs
                 .iter()
                 .map(|c| {
+                    let inverse = c.inverse64_many();
                     (0..OUT_TABLE)
                         .map(|i| {
                             let u = i as f64 / (OUT_TABLE - 1) as f64;
-                            c.eval_inverse64(u * u * u * u).clamp(0.0, 1.0) as f32
+                            inverse(u * u * u * u).clamp(0.0, 1.0) as f32
                         })
                         .collect()
                 })

From 08109be362dc23645d16dd6a52aa13205d2c3709 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:42:13 -0400
Subject: [PATCH 13/29] security: validate settings sections against the
 defaults alone

deserialize_sections tried each top-level key against a document holding every key accepted
before it, cloning and deserializing the growing document per key. A config.toml with many
unknown keys took quadratic time (20k keys: >2 minutes, now <1 s). Each key is now checked
against the defaults plus that key, and accepted keys are merged once.

CodeRabbit CWE-407, crates/settings/src/document.rs:47
---
 crates/settings/src/document.rs   | 12 ++++++++----
 crates/settings/tests/recovery.rs | 17 +++++++++++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/crates/settings/src/document.rs b/crates/settings/src/document.rs
index d5c80025..4e0a16f6 100644
--- a/crates/settings/src/document.rs
+++ b/crates/settings/src/document.rs
@@ -36,18 +36,22 @@ pub fn new_document(version: u32) -> DocumentMut {
 /// is kept. This is what keeps a renamed enum variant from resetting the whole file.
 pub fn deserialize_sections<T: Settings>(doc: &DocumentMut) -> (T, Vec<SectionError>) {
     let defaults = T::default();
-    let Ok(mut merged) = toml_edit::ser::to_document(&defaults) else {
+    let Ok(base) = toml_edit::ser::to_document(&defaults) else {
         return (defaults, Vec::new());
     };
+    let mut merged = base.clone();
     let mut errors = Vec::new();
     for (key, item) in doc.iter() {
         if key == SCHEMA_VERSION_KEY {
             continue;
         }
-        let mut candidate = merged.clone();
+        // Each section is tried against the defaults alone, never against the sections accepted
+        // before it, so a file of many keys costs the defaults plus that key per key instead of
+        // the whole document so far.
+        let mut candidate = base.clone();
         candidate[key] = item.clone();
-        match toml_edit::de::from_document::<T>(candidate.clone()) {
-            Ok(_) => merged = candidate,
+        match toml_edit::de::from_document::<T>(candidate) {
+            Ok(_) => merged[key] = item.clone(),
             Err(e) => errors.push(SectionError { section: key.to_owned(), message: e.to_string() }),
         }
     }
diff --git a/crates/settings/tests/recovery.rs b/crates/settings/tests/recovery.rs
index 4af90bb4..437d18cf 100644
--- a/crates/settings/tests/recovery.rs
+++ b/crates/settings/tests/recovery.rs
@@ -47,6 +47,23 @@ fn bad_value_only_resets_its_section() {
     assert!(config_path(tmp.path()).exists(), "the file is not moved aside");
 }
 
+#[test]
+fn many_unknown_keys_load_in_linear_time() {
+    // Each key was once tried against every key accepted before it.
+    let tmp = tempfile::tempdir().unwrap();
+    let mut text = String::from("schema_version = 2\n");
+    for i in 0..20_000 {
+        text.push_str(&format!("unknown_{i} = \"{}\"\n", "x".repeat(64)));
+    }
+    text.push_str("[general]\nlanguage = \"de\"\n");
+    write_config(tmp.path(), &text);
+    let started = std::time::Instant::now();
+    let (store, report) = open_in(tmp.path());
+    assert!(report.section_errors.is_empty(), "{report:?}");
+    assert_eq!(store.get().general.language, "de");
+    assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+}
+
 #[test]
 fn newer_schema_opens_read_only_and_never_overwrites() {
     let tmp = tempfile::tempdir().unwrap();

From d66e345cc7807afd6764d723bafcfc1a8998a702 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:46:25 -0400
Subject: [PATCH 14/29] security: require every floating-group member to be
 movable for MoveFloating

MoveFloating checked only the panel it named, but changes the rectangle shared by that
panel's whole floating group, so naming a movable sibling moved a panel whose policy forbids
it. The model now refuses the action unless every member is movable, and the floating
window's resize grip no longer emits it for such a group.

CodeRabbit CWE-863, crates/ui/src/docking/model.rs:392
---
 crates/ui/src/docking/model.rs   |  8 +++++++-
 crates/ui/src/docking/surface.rs |  4 +++-
 crates/ui/src/docking/tests.rs   | 15 +++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/crates/ui/src/docking/model.rs b/crates/ui/src/docking/model.rs
index babb3e2f..36c3bdbc 100644
--- a/crates/ui/src/docking/model.rs
+++ b/crates/ui/src/docking/model.rs
@@ -389,7 +389,13 @@ impl<P: Clone + Eq + Hash> Layout<P> {
             }
             Action::Float { panel, .. } if !permissions(panel).floatable || !permissions(panel).movable => return Err(DockError::NotAllowed),
             Action::Close { panel } if !permissions(panel).closable => return Err(DockError::NotAllowed),
-            Action::MoveFloating { panel, .. } if !permissions(panel).movable => return Err(DockError::NotAllowed),
+            // The rectangle belongs to the whole floating group, so every member must allow it.
+            Action::MoveFloating { panel, .. }
+                if !permissions(panel).movable
+                    || self.floating.iter().find(|g| g.panels.contains(panel)).is_some_and(|g| g.panels.iter().any(|p| !permissions(p).movable)) =>
+            {
+                return Err(DockError::NotAllowed);
+            }
             Action::Open { anchor: Some(anchor), .. } if !permissions(anchor).accepts_tabs => return Err(DockError::NotAllowed),
             _ => {}
         }
diff --git a/crates/ui/src/docking/surface.rs b/crates/ui/src/docking/surface.rs
index b0e5badd..76d92089 100644
--- a/crates/ui/src/docking/surface.rs
+++ b/crates/ui/src/docking/surface.rs
@@ -793,7 +793,9 @@ impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
                         }
                     });
                 }
-                if response.enabled() && delta != Vec2::ZERO {
+                // Resizing changes the group's shared rectangle, which the model allows only when
+                // every member is movable.
+                if response.enabled() && delta != Vec2::ZERO && group.panels.iter().all(|p| (self.permissions)(p).movable) {
                     let size = (rect.size() + delta).max(limits.min.max(vec2(40.0, self.style.tab_height + 20.0))).min(limits.max).min(screen.size());
                     self.output.actions.push(Action::MoveFloating { panel: first.clone(), rect: [rect.left(), rect.top(), size.x, size.y] });
                 }
diff --git a/crates/ui/src/docking/tests.rs b/crates/ui/src/docking/tests.rs
index 54d37df6..ce2d3b9e 100644
--- a/crates/ui/src/docking/tests.rs
+++ b/crates/ui/src/docking/tests.rs
@@ -129,6 +129,21 @@ fn protected_canvas_remains_present_and_cannot_be_grouped_with_panels() {
     assert!(next.contains(&1) && next.contains(&7));
 }
 
+#[test]
+fn moving_a_floating_group_needs_every_member_movable() {
+    // sample() floats 5 and 6 together; 6 may not move, so naming 5 cannot move it either.
+    let permissions = |panel: &u32| Permissions { movable: *panel != 6, ..Permissions::default() };
+    let layout = sample();
+    let mut next = layout.clone();
+    assert_eq!(
+        next.apply_with_permissions(Action::MoveFloating { panel: 5, rect: [0.0, 0.0, 300.0, 220.0] }, permissions),
+        Err(DockError::NotAllowed)
+    );
+    assert_eq!(next, layout);
+    next.apply_with_permissions(Action::MoveFloating { panel: 5, rect: [0.0, 0.0, 300.0, 220.0] }, |_: &u32| Permissions::default()).unwrap();
+    assert_eq!(next.floating[0].rect, [0.0, 0.0, 300.0, 220.0]);
+}
+
 #[test]
 fn close_and_restore_preserve_fixed_side_and_floating_geometry() {
     let mut layout = Layout {

From 4f85efb2b97779d4509bcb572851efde52f1f987 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:49:46 -0400
Subject: [PATCH 15/29] security: bound print dialog name resolution, PPD
 labels, lpstat merge and inherited geometry

- craft-ui shown_names resolves label collisions with hash-map counts and a worklist, so a
  crafted cascade is linear instead of cubic (CodeRabbit CWE-407, ui/src/printing.rs:32)
- parse_ppd caps group, option and choice labels at 256 characters before each option copies
  its group (CodeRabbit CWE-400, print/src/lib.rs:232)
- printers_parsed tracks seen destinations in a HashSet (CodeRabbit CWE-407, lib.rs:417)
- sheets::Reader::rect checks an inline array's length before reading it and borrows direct
  objects instead of deep-cloning the inherited MediaBox/CropBox/Rotate for every page
  (CodeRabbit CWE-400, print/src/sheets.rs:774)
---
 crates/print/src/lib.rs              | 16 +++++--
 crates/print/src/sheets.rs           | 26 ++++++++----
 crates/print/src/tests.rs            | 23 +++++++++++
 crates/print/src/tests/pdf_bounds.rs | 29 +++++++++++++
 crates/ui/src/printing.rs            | 40 ++++++++++++------
 crates/ui/src/printing/tests.rs      | 62 ++++++++++++++++++++++++++++
 6 files changed, 173 insertions(+), 23 deletions(-)

diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index 25e03ad5..3c26974a 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -195,6 +195,13 @@ pub const HANDLED_OPTIONS: &[&str] = &["PageSize", "PageRegion", "Duplex", "Coll
 /// Caps on what a PPD may make the dialog hold (PPDs are text files from the printer vendor).
 const MAX_OPTIONS: usize = 400;
 const MAX_CHOICES: usize = 400;
+/// Longest group, option or choice label kept, in characters; every option copies its group's.
+const MAX_PPD_LABEL: usize = 256;
+
+/// `label`, cut to [`MAX_PPD_LABEL`] characters.
+fn ppd_label(label: &str) -> String {
+    label.chars().take(MAX_PPD_LABEL).collect()
+}
 
 /// A PPD keyword: printable ASCII without spaces, `/`, `:` or `=`.
 fn is_ppd_keyword(s: &str) -> bool {
@@ -220,7 +227,7 @@ pub fn parse_ppd(ppd: &str) -> Vec<PrinterOption> {
         let line = line.trim_end_matches('\r');
         if let Some(rest) = line.strip_prefix("*OpenGroup:") {
             let (k, l) = name_label(rest);
-            (group_key, group) = (k.to_string(), l.to_string());
+            (group_key, group) = (k.to_string(), ppd_label(l));
         } else if line.starts_with("*CloseGroup") {
             (group_key, group) = (String::new(), String::new());
         } else if let Some(rest) = line.strip_prefix("*OpenUI") {
@@ -228,7 +235,7 @@ pub fn parse_ppd(ppd: &str) -> Vec<PrinterOption> {
             let (key, label) = name_label(head.trim().trim_start_matches('*'));
             open = is_ppd_keyword(key).then(|| PrinterOption {
                 key: key.to_string(),
-                label: label.to_string(),
+                label: ppd_label(label),
                 group: group.clone(),
                 choices: Vec::new(),
                 default: String::new(),
@@ -251,7 +258,7 @@ pub fn parse_ppd(ppd: &str) -> Vec<PrinterOption> {
                 let head = rest.split_once(':').map_or(rest, |(h, _)| h);
                 let (choice, label) = name_label(head);
                 if is_ppd_keyword(choice) && o.choices.len() < MAX_CHOICES && o.choices.iter().all(|(c, _)| c != choice) {
-                    o.choices.push((choice.to_string(), label.to_string()));
+                    o.choices.push((choice.to_string(), ppd_label(label)));
                 }
             }
         }
@@ -413,8 +420,9 @@ pub fn printers_parsed(queues: &str, available: Option<&str>) -> Vec<Printer> {
     let mut printers = parse_lpstat(queues);
     let default = default_destination(queues);
     if let Some(names) = available {
+        let mut seen: std::collections::HashSet<String> = printers.iter().map(|p| p.name.clone()).collect();
         for name in parse_lpstat_e(names) {
-            if !printers.iter().any(|p| p.name == name) {
+            if seen.insert(name.clone()) {
                 printers.push(Printer { default: default == Some(name.as_str()), name, description: String::new(), two_sided: None });
             }
         }
diff --git a/crates/print/src/sheets.rs b/crates/print/src/sheets.rs
index d3c989cd..bbb4c7c7 100644
--- a/crates/print/src/sheets.rs
+++ b/crates/print/src/sheets.rs
@@ -11,6 +11,7 @@
 //! Every length, count and depth is bounded, and anything unreadable is an [`Error`], never a
 //! panic: the caller's PDF is input like any other.
 
+use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
@@ -781,16 +782,27 @@ impl Reader<'_> {
         None
     }
 
-    fn rect(&mut self, obj: Option<&Obj>) -> Option<[f64; 4]> {
-        let obj = self.resolve(obj?)?;
-        let items = obj.array()?;
-        let mut v = [0.0; 4];
-        for (slot, item) in v.iter_mut().zip(items) {
-            *slot = self.resolve(item)?.num()?;
+    /// Like [`resolve`](Self::resolve), but a direct object is borrowed, not copied. Inherited
+    /// page attributes are read once per page, so copying a large inline value would repeat that
+    /// work for every page outside the budget.
+    fn resolve_borrowed<'o>(&mut self, obj: &'o Obj) -> Option<Cow<'o, Obj>> {
+        match obj {
+            Obj::Ref(..) => self.resolve(obj).map(Cow::Owned),
+            direct => Some(Cow::Borrowed(direct)),
         }
+    }
+
+    fn rect(&mut self, obj: Option<&Obj>) -> Option<[f64; 4]> {
+        let obj = self.resolve_borrowed(obj?)?;
+        let items = obj.array()?;
+        // The shape is checked before reading any element.
         if items.len() != 4 {
             return None;
         }
+        let mut v = [0.0; 4];
+        for (slot, item) in v.iter_mut().zip(items) {
+            *slot = self.resolve_borrowed(item)?.num()?;
+        }
         let [x0, y0, x1, y1] = v;
         Some([x0.min(x1), y0.min(y1), x0.max(x1), y0.max(y1)])
     }
@@ -938,7 +950,7 @@ pub(crate) fn read(data: &[u8]) -> Result<Sheets<'_>, Error> {
             .map(|c| [c[0].max(media[0]), c[1].max(media[1]), c[2].min(media[2]), c[3].min(media[3])])
             .filter(|c| c[2] > c[0] && c[3] > c[1])
             .unwrap_or(media);
-        let rotate = here.rotate.as_ref().and_then(|r| reader.resolve(r)).and_then(|r| r.int()).unwrap_or(0).rem_euclid(360);
+        let rotate = here.rotate.as_ref().and_then(|r| reader.resolve_borrowed(r).and_then(|r| r.int())).unwrap_or(0).rem_euclid(360);
         // Not a multiple of 90 is invalid; such a page is shown unrotated.
         let rotate = if rotate % 90 == 0 { u32::try_from(rotate).unwrap_or(0) } else { 0 };
         // Windows renders viewer visibility, not annotation print visibility. Only a plain
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index c3675b8b..db03fb8a 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -256,6 +256,29 @@ fn printer_options_come_from_the_ppd() {
     assert!(spool::parse_ppd("*OpenUI *Broken\n*Broken A/B\n").is_empty(), "unclosed or malformed blocks are skipped");
 }
 
+#[test]
+fn ppd_labels_are_capped_before_every_option_copies_its_group() {
+    let long = "G".repeat(100_000);
+    let mut ppd = format!("*OpenGroup: Big/{long}\n");
+    for i in 0..300 {
+        ppd += &format!("*OpenUI *Opt{i}/{long}: PickOne\n*Opt{i} A/{long}: \"\"\n*CloseUI: *Opt{i}\n");
+    }
+    let options = spool::parse_ppd(&ppd);
+    assert_eq!(options.len(), 300);
+    assert!(options.iter().all(|o| o.group.len() <= 256 && o.label.len() <= 256 && o.choices[0].1.len() <= 256));
+    assert_eq!(options[0].group, "G".repeat(256));
+}
+
+#[test]
+fn many_driverless_destinations_merge_in_linear_time() {
+    let names: String = (0..200_000).map(|i| format!("dest_{i}\n")).collect();
+    let started = std::time::Instant::now();
+    let printers = spool::printers_parsed("printer Office is idle.\n", Some(&format!("Office\n{names}dest_7\n")));
+    assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
+    assert_eq!(printers.len(), 200_001, "each destination once, queues first");
+    assert_eq!(printers[0].name, "Office");
+}
+
 #[test]
 fn printer_option_defaults_and_job_arguments() {
     let current =
diff --git a/crates/print/src/tests/pdf_bounds.rs b/crates/print/src/tests/pdf_bounds.rs
index a1729273..76b1409a 100644
--- a/crates/print/src/tests/pdf_bounds.rs
+++ b/crates/print/src/tests/pdf_bounds.rs
@@ -254,3 +254,32 @@ fn an_inflate_limit_stops_later_stream_and_object_work() {
     assert_eq!(reader.budget.nodes, 0);
     assert_eq!(reader.budget.tokens, 0);
 }
+
+#[test]
+fn an_oversized_inherited_media_box_is_not_copied_for_every_page() {
+    // One inline MediaBox far longer than four numbers, inherited by many small pages.
+    let pages = 4_000;
+    let media = vec!["0"; 25_000].join(" ");
+    let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", i + 3)).collect();
+    let mut objects = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [{media}] >>", kids.join(" ")),
+    ];
+    objects.extend((0..pages).map(|_| "<< /Type /Page /Parent 2 0 R >>".to_string()));
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f\r\n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        pdf.extend_from_slice(format!("{offset:010} 00000 n\r\n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    let started = std::time::Instant::now();
+    let sheets = read(&pdf).unwrap();
+    assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
+    assert_eq!(sheets.sheets.len(), pages);
+}
diff --git a/crates/ui/src/printing.rs b/crates/ui/src/printing.rs
index 30d7ad4b..bdcf5527 100644
--- a/crates/ui/src/printing.rs
+++ b/crates/ui/src/printing.rs
@@ -1,6 +1,7 @@
 //! Printer selection and asynchronous job feedback, independent of any spooler or document.
 //! Hosts provide workers; applications own PDF generation, commands and translated wording.
 
+use std::collections::HashMap;
 use std::sync::mpsc::{Receiver, TryRecvError};
 
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
@@ -19,26 +20,41 @@ pub struct Printer {
 /// printers show their names, which the spooler keeps distinct.
 pub fn shown_names(printers: &[Printer]) -> Vec<String> {
     let base: Vec<&str> = printers.iter().map(|p| if p.label.trim().is_empty() { p.name.as_str() } else { p.label.as_str() }).collect();
+    let mut base_count: HashMap<&str, usize> = HashMap::with_capacity(base.len());
+    for text in &base {
+        *base_count.entry(text).or_default() += 1;
+    }
     let mut shown: Vec<String> = printers
         .iter()
         .zip(&base)
         .map(|(printer, text)| {
-            let shared = base.iter().filter(|other| *other == text).count() > 1;
+            let shared = base_count.get(text).is_some_and(|n| *n > 1);
             if shared && *text != printer.name { format!("{text} ({})", printer.name) } else { (*text).to_owned() }
         })
         .collect();
-    // Each pass turns at least one shared text into its name, or stops: at most one per printer.
-    for _ in 0..printers.len() {
-        let shared: Vec<bool> = shown.iter().map(|text| shown.iter().filter(|other| *other == text).count() > 1).collect();
-        let mut changed = false;
-        for ((text, printer), shared) in shown.iter_mut().zip(printers).zip(shared) {
-            if shared && *text != printer.name {
-                text.clone_from(&printer.name);
-                changed = true;
-            }
+    // Which printers show each text. A shared text turns every printer showing it into its name;
+    // a printer that shows its name never changes again, so each moves at most once and the
+    // whole cascade stays linear in the number of printers.
+    let mut by_text: HashMap<String, Vec<usize>> = HashMap::with_capacity(shown.len());
+    for (i, text) in shown.iter().enumerate() {
+        by_text.entry(text.clone()).or_default().push(i);
+    }
+    let mut pending: Vec<String> = by_text.iter().filter(|(_, ids)| ids.len() > 1).map(|(text, _)| text.clone()).collect();
+    while let Some(text) = pending.pop() {
+        let Some(ids) = by_text.get_mut(&text) else { continue };
+        if ids.len() < 2 {
+            continue;
         }
-        if !changed {
-            break;
+        let (stay, moving): (Vec<usize>, Vec<usize>) = ids.iter().partition(|&&i| printers.get(i).is_some_and(|p| p.name == text));
+        *ids = stay;
+        for i in moving {
+            let (Some(printer), Some(slot)) = (printers.get(i), shown.get_mut(i)) else { continue };
+            slot.clone_from(&printer.name);
+            let ids = by_text.entry(printer.name.clone()).or_default();
+            ids.push(i);
+            if ids.len() == 2 {
+                pending.push(printer.name.clone());
+            }
         }
     }
     shown
diff --git a/crates/ui/src/printing/tests.rs b/crates/ui/src/printing/tests.rs
index 47f3587a..caddd58a 100644
--- a/crates/ui/src/printing/tests.rs
+++ b/crates/ui/src/printing/tests.rs
@@ -8,6 +8,68 @@ fn labelled(name: &str, label: &str) -> Printer {
     Printer { name: name.into(), label: label.into(), default: false }
 }
 
+/// The pass-by-pass resolution `shown_names` replaced, to check they agree.
+fn shown_names_by_passes(printers: &[Printer]) -> Vec<String> {
+    let base: Vec<&str> = printers.iter().map(|p| if p.label.trim().is_empty() { p.name.as_str() } else { p.label.as_str() }).collect();
+    let mut shown: Vec<String> = printers
+        .iter()
+        .zip(&base)
+        .map(|(printer, text)| {
+            let shared = base.iter().filter(|other| *other == text).count() > 1;
+            if shared && *text != printer.name { format!("{text} ({})", printer.name) } else { (*text).to_owned() }
+        })
+        .collect();
+    loop {
+        let shared: Vec<bool> = shown.iter().map(|text| shown.iter().filter(|other| *other == text).count() > 1).collect();
+        let mut changed = false;
+        for ((text, printer), shared) in shown.iter_mut().zip(printers).zip(shared) {
+            if shared && *text != printer.name {
+                text.clone_from(&printer.name);
+                changed = true;
+            }
+        }
+        if !changed {
+            return shown;
+        }
+    }
+}
+
+/// Each printer's label is the name the one before it falls back to, so every pass of the
+/// old resolution freed exactly one more printer.
+fn cascade(n: usize) -> Vec<Printer> {
+    let mut printers = vec![labelled("n0", "x"), labelled("n1", "x"), labelled("n2", "x (n0)")];
+    printers.extend((3..n).map(|i| labelled(&format!("n{i}"), &format!("n{}", i - 1))));
+    printers
+}
+
+#[test]
+fn collisions_resolve_like_the_pass_by_pass_rule() {
+    let names = ["a", "b", "c", "Office", "Office_1", "x"];
+    let labels = ["", "a", "b", "Office", "Office (Office_1)", "x (a)", "a (b)", "c"];
+    let mut seed = 7u32;
+    for _ in 0..2000 {
+        let printers: Vec<Printer> = (0..5)
+            .map(|_| {
+                seed = seed.wrapping_mul(1_103_515_245).wrapping_add(12_345);
+                labelled(names[(seed >> 8) as usize % names.len()], labels[(seed >> 16) as usize % labels.len()])
+            })
+            .collect();
+        assert_eq!(shown_names(&printers), shown_names_by_passes(&printers), "{printers:?}");
+    }
+    assert_eq!(shown_names(&cascade(40)), shown_names_by_passes(&cascade(40)));
+}
+
+#[test]
+fn a_long_collision_cascade_stays_fast() {
+    let printers = cascade(20_000);
+    let started = std::time::Instant::now();
+    let shown = shown_names(&printers);
+    assert!(started.elapsed() < std::time::Duration::from_secs(5), "{:?}", started.elapsed());
+    assert_eq!(shown[0], "n0");
+    assert_eq!(shown[1], "x (n1)");
+    assert!(shown[2..].iter().zip(&printers[2..]).all(|(s, p)| *s == p.name));
+}
+
 #[test]
 fn the_dialog_shows_a_printers_label_and_keeps_its_queue_name() {
     // CUPS can't put dots in a queue name: the printer added as 192.0.2.15 is `_192_0_2_15`.

From ecf0ad47ad10e0c0c79b0eec8f4accc1080ec965 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 21:53:10 -0400
Subject: [PATCH 16/29] security: bound craft-media metadata, sample
 reservation, header stripping and cue bookkeeping

Follow-up to the hostile-input fixes in #196, covering findings that PR does not:

- ISO BMFF metadata: all udta/meta entries share a 4 MiB budget charged before a keys name
  is copied, so many ilst items naming one long key cannot multiply it (CodeRabbit CWE-400,
  isobmff/demux.rs:939)
- ISO BMFF stbl: reserve only the samples the chunk map can place, fallibly, instead of the
  declared stsz count (CodeRabbit CWE-789, isobmff/demux.rs:767)
- Matroska: a header-stripping prefix over 256 bytes is treated as unsupported compression
  rather than copied in front of every frame; Track::sample_size no longer allocates the
  prefix (CodeRabbit CWE-409, matroska/track.rs:257)
- Matroska muxer: per-track cue flags use a cluster number, so starting a cluster no longer
  clears every declared track (CodeRabbit CWE-407, matroska/mux.rs:402)
---
 crates/media/src/isobmff/demux.rs  | 95 ++++++++++++++++++++++++++----
 crates/media/src/matroska/meta.rs  | 27 ++++++++-
 crates/media/src/matroska/mux.rs   | 33 +++++++++--
 crates/media/src/matroska/track.rs |  8 ++-
 4 files changed, 146 insertions(+), 17 deletions(-)

diff --git a/crates/media/src/isobmff/demux.rs b/crates/media/src/isobmff/demux.rs
index 323eac35..a1579ed3 100644
--- a/crates/media/src/isobmff/demux.rs
+++ b/crates/media/src/isobmff/demux.rs
@@ -10,6 +10,11 @@ use std::collections::HashMap;
 const MAX_SAMPLES: usize = 1 << 26;
 /// Hard cap on the size of an in-memory `moov`/`moof` box.
 const MAX_HEADER_BOX: u64 = 1 << 30;
+/// Most text all metadata entries may hold together; entries past it are dropped. One `keys`
+/// name can be named by many `ilst` items, each a copy, so the file's size does not bound this.
+const MAX_METADATA_BYTES: usize = 4 << 20;
+/// What an entry costs beyond its text, so that empty entries are bounded too.
+const METADATA_ENTRY_COST: usize = 64;
 
 /// What is left of the file-wide limits while tracks and fragments are parsed.
 struct SampleBudget {
@@ -305,6 +310,7 @@ pub fn open<S: ByteSource>(src: S) -> Result<Mp4File> {
     }
     let mut trex: HashMap<u32, Trex> = HashMap::new();
     let mut trak_payloads = Vec::new();
+    let mut meta_left = MAX_METADATA_BYTES;
     for b in boxes(&moov) {
         let b = b?;
         match &b.kind.0 {
@@ -334,8 +340,8 @@ pub fn open<S: ByteSource>(src: S) -> Result<Mp4File> {
                     }
                 }
             }
-            b"udta" => parse_udta(b.payload, &mut file.metadata),
-            b"meta" => parse_meta(b.payload, &mut file.metadata),
+            b"udta" => parse_udta(b.payload, &mut file.metadata, &mut meta_left),
+            b"meta" => parse_meta(b.payload, &mut file.metadata, &mut meta_left),
             _ => {}
         }
     }
@@ -764,7 +770,20 @@ fn parse_stbl(stbl: &[u8], t: &mut Track, is_qt: bool, file_len: u64, budget: &m
         if sample_count > budget.samples {
             return Err(Error::TooLarge("sample count"));
         }
-        samples.reserve(sample_count);
+        // Reserve only what the chunk map can place. A declared count far past it would keep
+        // capacity the budget below never charges, track after track.
+        let mut mapped = 0usize;
+        let mut map_i = 0usize;
+        for ci in 0..chunks.len() {
+            while map_i + 1 < stsc.len() && stsc[map_i + 1].0 as usize <= ci + 1 {
+                map_i += 1;
+            }
+            mapped = mapped.saturating_add(stsc.get(map_i).map_or(0, |e| e.1 as usize));
+            if mapped >= sample_count {
+                break;
+            }
+        }
+        samples.try_reserve(sample_count.min(mapped)).map_err(|_| Error::TooLarge("sample count"))?;
         let mut stss_i = 0usize;
         'chunks: for (ci, &off) in chunks.iter().enumerate() {
             while stsc_i + 1 < stsc.len() && stsc[stsc_i + 1].0 as usize <= ci + 1 {
@@ -903,20 +922,34 @@ fn parse_moof(
     Ok(())
 }
 
-fn parse_udta(p: &[u8], md: &mut Metadata) {
+/// Takes an entry of `key_len` and `value_len` bytes from `left`; false once it would not fit.
+fn charge_metadata(left: &mut usize, key_len: usize, value_len: usize) -> bool {
+    let cost = key_len.saturating_add(value_len).saturating_add(METADATA_ENTRY_COST);
+    match left.checked_sub(cost) {
+        Some(rest) => {
+            *left = rest;
+            true
+        }
+        None => false,
+    }
+}
+
+fn parse_udta(p: &[u8], md: &mut Metadata, left: &mut usize) {
     for b in boxes(p).map_while(|b| b.ok()) {
         if b.kind == b"meta" {
-            parse_meta(b.payload, md);
+            parse_meta(b.payload, md, left);
         } else if b.kind.0[0] == 0xA9 && b.payload.len() >= 4 {
             let n = u16::from_be_bytes([b.payload[0], b.payload[1]]) as usize;
-            if let Some(s) = b.payload.get(4..4 + n) {
+            if let Some(s) = b.payload.get(4..4 + n)
+                && charge_metadata(left, 4, s.len())
+            {
                 md.entries.push((b.kind.to_string_lossy(), String::from_utf8_lossy(s).into_owned()));
             }
         }
     }
 }
 
-fn parse_meta(p: &[u8], md: &mut Metadata) {
+fn parse_meta(p: &[u8], md: &mut Metadata, left: &mut usize) {
     // QuickTime `meta` is a plain box; ISO `meta` is a full box.
     let body = if p.len() >= 8 && &p[4..8] == b"hdlr" { p } else { p.get(4..).unwrap_or(&[]) };
     let mut keys: Vec<String> = Vec::new();
@@ -936,12 +969,14 @@ fn parse_meta(p: &[u8], md: &mut Metadata) {
     let Some(ilst) = find(body, b"ilst") else { return };
     for item in boxes(ilst).map_while(|b| b.ok()) {
         let idx = item.kind.as_u32() as usize;
-        let key = if !keys.is_empty() && idx >= 1 && idx <= keys.len() { keys[idx - 1].clone() } else { item.kind.to_string_lossy() };
+        let named = if idx >= 1 { keys.get(idx - 1) } else { None };
         if let Some(d) = find(item.payload, b"data")
             && d.len() >= 8
         {
             let ty = u32::from_be_bytes([d[0], d[1], d[2], d[3]]) & 0xFF_FFFF;
-            if ty == 1 || ty == 0 {
+            // Charged before the key is copied: every item naming one long key is another copy.
+            if (ty == 1 || ty == 0) && charge_metadata(left, named.map_or(4, String::len), d.len() - 8) {
+                let key = named.cloned().unwrap_or_else(|| item.kind.to_string_lossy());
                 md.entries.push((key, String::from_utf8_lossy(&d[8..]).into_owned()));
             }
         }
@@ -1002,7 +1037,7 @@ mod tests {
         b.end(il);
         b.end(meta);
         let mut md = Metadata::default();
-        parse_udta(&b.buf, &mut md);
+        parse_udta(&b.buf, &mut md, &mut { MAX_METADATA_BYTES });
         assert_eq!(md.title(), Some("hi"));
         assert_eq!(md.get("©ART"), Some("me"));
     }
@@ -1219,6 +1254,46 @@ mod tests {
         assert_eq!(open(d.as_slice()).unwrap().tracks[0].samples.len(), 4);
     }
 
+    #[test]
+    fn one_long_key_named_by_many_items_stays_within_the_metadata_budget() {
+        let key = vec![b'k'; 64 * 1024];
+        let mut b = BoxBuf::new();
+        b.leaf(b"hdlr", &[0; 24]);
+        let keys = b.start_full(b"keys", 0, 0);
+        b.u32(1);
+        b.u32(8 + key.len() as u32);
+        b.bytes(b"mdta");
+        b.bytes(&key);
+        b.end(keys);
+        let il = b.start(b"ilst");
+        for _ in 0..1000 {
+            let it = b.start(&1u32.to_be_bytes());
+            let d = b.start(b"data");
+            b.u32(1);
+            b.u32(0);
+            b.bytes(b"v");
+            b.end(d);
+            b.end(it);
+        }
+        b.end(il);
+        let mut payload = vec![0; 4];
+        payload.extend_from_slice(&b.buf);
+        let mut md = Metadata::default();
+        parse_meta(&payload, &mut md, &mut { MAX_METADATA_BYTES });
+        assert!(!md.entries.is_empty() && md.entries.len() < 1000, "{}", md.entries.len());
+        assert!(md.entries.iter().map(|(k, v)| k.len() + v.len()).sum::<usize>() <= MAX_METADATA_BYTES);
+        assert_eq!(md.entries[0].0.len(), key.len());
+    }
+
+    #[test]
+    fn a_declared_sample_count_past_the_chunk_map_reserves_only_what_it_maps() {
+        // stsz claims u32::MAX samples; the two chunks place four.
+        let d = handmade(Some((1, u32::MAX)));
+        let f = open(d.as_slice()).unwrap();
+        assert_eq!(f.tracks[0].samples.len(), 4);
+        assert!(f.tracks[0].samples.capacity() < 64, "{}", f.tracks[0].samples.capacity());
+    }
+
     #[test]
     fn absurd_counts_are_bounded() {
         // Constant-size stsz claiming 4 billion samples is clamped to what fits in the file.
diff --git a/crates/media/src/matroska/meta.rs b/crates/media/src/matroska/meta.rs
index 3843c91f..1b559bca 100644
--- a/crates/media/src/matroska/meta.rs
+++ b/crates/media/src/matroska/meta.rs
@@ -8,6 +8,11 @@ use crate::matroska::track::{AudioInfo, Color, ContentEncoding, MasteringMetadat
 
 // A malformed Matroska file may contain arbitrarily deep ChapterAtom and SimpleTag chains.
 const MAX_META_DEPTH: usize = 64;
+/// Longest header-stripping prefix accepted. It is copied in front of every frame, laced
+/// zero-length frames included, so its length multiplies what a small file can make a reader
+/// produce. Real files strip a few bytes of codec header; a longer one is treated as an
+/// unsupported compression and its frames are not reconstructed.
+const MAX_STRIPPED_HEADER: usize = 256;
 /// Largest accepted `TimestampScale` (about 4.3 s per tick). It keeps tick to nanosecond
 /// arithmetic on 64-bit timestamps within `i128`.
 const MAX_TIMESTAMP_SCALE: u64 = 1 << 32;
@@ -466,7 +471,7 @@ fn parse_encodings(d: &[u8]) -> Vec<ContentEncoding> {
             ContentEncoding::Encryption { scope }
         } else {
             let (algo, settings) = comp.unwrap_or((0, Vec::new()));
-            if algo == 3 {
+            if algo == 3 && settings.len() <= MAX_STRIPPED_HEADER {
                 ContentEncoding::HeaderStripping { bytes: settings, scope }
             } else {
                 ContentEncoding::Compression { algo, settings, scope }
@@ -560,6 +565,26 @@ pub(crate) fn parse_tracks(d: &[u8], timestamp_scale: u64) -> Vec<Track> {
 #[cfg(test)]
 mod metadata_depth_tests {
     use super::*;
+    use crate::matroska::mux::{el, el_uint};
+
+    fn header_stripping(bytes: &[u8]) -> Vec<ContentEncoding> {
+        let mut comp = Vec::new();
+        el_uint(&mut comp, CONTENT_COMP_ALGO, 3);
+        el(&mut comp, CONTENT_COMP_SETTINGS, bytes);
+        let mut enc = Vec::new();
+        el(&mut enc, CONTENT_COMPRESSION, &comp);
+        let mut encs = Vec::new();
+        el(&mut encs, CONTENT_ENCODING, &enc);
+        parse_encodings(&encs)
+    }
+
+    #[test]
+    fn a_long_stripped_header_is_not_put_in_front_of_frames() {
+        let kept = header_stripping(&[7; MAX_STRIPPED_HEADER]);
+        assert!(matches!(&kept[..], [ContentEncoding::HeaderStripping { bytes, .. }] if bytes.len() == MAX_STRIPPED_HEADER));
+        let refused = header_stripping(&[7; MAX_STRIPPED_HEADER + 1]);
+        assert!(matches!(&refused[..], [ContentEncoding::Compression { algo: 3, .. }]), "{refused:?}");
+    }
 
     #[test]
     fn deeply_nested_chapters_stop_at_depth_limit() {
diff --git a/crates/media/src/matroska/mux.rs b/crates/media/src/matroska/mux.rs
index 2ba663a4..8f90ed4e 100644
--- a/crates/media/src/matroska/mux.rs
+++ b/crates/media/src/matroska/mux.rs
@@ -136,7 +136,10 @@ pub struct MkvWriter<W: Write + Seek> {
     cluster_start_ns: i64,
     pending: Option<Pending>,
     cues: Vec<(u64, u64, u64)>, // (time ticks, track number, cluster position)
-    cued_tracks_in_cluster: Vec<bool>,
+    /// The cluster number in which each track last had a cue. Starting a cluster bumps
+    /// `cluster_number` instead of clearing an entry for every declared track.
+    track_cued_in: Vec<u64>,
+    cluster_number: u64,
     end_ns: i64,
     has_video: bool,
 }
@@ -253,7 +256,8 @@ impl<W: Write + Seek> MkvWriter<W> {
             cluster_start_ns: 0,
             pending: None,
             cues: Vec::new(),
-            cued_tracks_in_cluster: vec![false; n],
+            track_cued_in: vec![u64::MAX; n],
+            cluster_number: 0,
             end_ns: 0,
             has_video,
         })
@@ -294,8 +298,8 @@ impl<W: Write + Seek> MkvWriter<W> {
         }
         let cts = self.cluster_ts.unwrap_or(0);
         // cue: video keyframes, or the first frame of each track per cluster when there is no video
-        if (is_video && keyframe) || (!self.has_video && !self.cued_tracks_in_cluster[track]) {
-            self.cued_tracks_in_cluster[track] = true;
+        if (is_video && keyframe) || (!self.has_video && self.track_cued_in[track] != self.cluster_number) {
+            self.track_cued_in[track] = self.cluster_number;
             let pos = self.w.stream_position()? - self.segment_data_start;
             if self.cues.last().is_none_or(|c| c.2 != pos || c.1 != track as u64 + 1) {
                 self.cues.push((ts as u64, track as u64 + 1, pos));
@@ -399,7 +403,7 @@ impl<W: Write + Seek> MkvWriter<W> {
         }
         self.cluster.clear();
         self.cluster_ts = None;
-        self.cued_tracks_in_cluster.iter_mut().for_each(|c| *c = false);
+        self.cluster_number = self.cluster_number.wrapping_add(1);
         Ok(())
     }
 
@@ -568,4 +572,23 @@ mod tests {
         let got: Vec<_> = Demuxer::from_slice(&bytes).unwrap().map(|p| p.unwrap()).map(|p| (p.track, p.pts, p.lace)).collect();
         assert_eq!(got, [(0, 0, 0), (0, 100, 0), (0, 110, 1), (0, 120, 2), (0, 200, 0), (1, 300, 0), (1, 310, 0)]);
     }
+
+    #[test]
+    fn audio_only_files_cue_each_track_once_per_cluster() {
+        let mut a = TrackSpec::new(TrackKind::Audio, "A_PCM/INT/LIT");
+        a.audio = Some((48000.0, 1, Some(16)));
+        let opts = MuxOptions { cluster_duration_ns: 1, lacing: LacingMode::None, ..Default::default() };
+        let mut m = MkvWriter::new(Cursor::new(Vec::new()), vec![a.clone(), a], opts).unwrap();
+        for i in 0..4i64 {
+            m.write_frame(0, i * 10, true, &[1; 4], None).unwrap();
+            m.write_frame(1, i * 10, true, &[2; 4], None).unwrap();
+            m.write_frame(0, i * 10 + 1, true, &[3; 4], None).unwrap();
+        }
+        // Clusters hold [t0, t1] then [t0] at each step: one cue per track per cluster.
+        let mut seen: Vec<(u64, u64)> = m.cues.iter().map(|c| (c.1, c.2)).collect();
+        assert_eq!(seen.len(), 12, "{:?}", m.cues);
+        seen.sort_unstable();
+        seen.dedup();
+        assert_eq!(seen.len(), 12, "{:?}", m.cues);
+    }
 }
diff --git a/crates/media/src/matroska/track.rs b/crates/media/src/matroska/track.rs
index 2b0b4494..9a5dfd7a 100644
--- a/crates/media/src/matroska/track.rs
+++ b/crates/media/src/matroska/track.rs
@@ -265,10 +265,16 @@ impl Track {
         p
     }
 
+    /// Length of [`frame_prefix`](Self::frame_prefix), without building it.
+    pub fn frame_prefix_len(&self) -> u64 {
+        let stripped = self.stripped_header().map_or(0, <[u8]>::len) as u64;
+        if matches!(self.codec, Codec::ProRes { .. }) { stripped + 8 } else { stripped }
+    }
+
     /// Frame size of sample `i` as returned by `read_sample` / packets (stored size plus prefix).
     pub fn sample_size(&self, i: usize) -> Option<u64> {
         let s = self.samples.get(i)?;
-        Some(s.size as u64 + self.frame_prefix(s.size as u64).len() as u64)
+        Some(s.size as u64 + self.frame_prefix_len())
     }
 
     /// Indices of keyframe samples, ascending by file order.

From bc8fe0eb53f85c375e94defd994d7a3506b7d65d Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 22:22:39 -0400
Subject: [PATCH 17/29] cms: keep NaN propagation in multilinear interpolation

A NaN input gives a NaN fraction, which the active-dimension check dropped, returning a
finite node value. Keep any nonzero fraction, NaN included (CodeRabbit review).
---
 crates/cms/src/clut.rs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/crates/cms/src/clut.rs b/crates/cms/src/clut.rs
index 59b27cad..dd0315c2 100644
--- a/crates/cms/src/clut.rs
+++ b/crates/cms/src/clut.rs
@@ -233,7 +233,8 @@ impl Clut {
         for (d, &v) in input.iter().enumerate().take(self.inputs) {
             let (b, rr, ss) = self.locate(d, v);
             base += b;
-            if ss > 0 && rr > 0.0 {
+            // `!= 0.0` keeps a NaN fraction, so a NaN input still gives a NaN result.
+            if ss > 0 && rr != 0.0 {
                 r[n] = rr;
                 s[n] = ss;
                 n += 1;
@@ -316,6 +317,14 @@ mod tests {
         assert!((o[0] - 0.75).abs() < 1e-6);
     }
 
+    #[test]
+    fn a_nan_input_still_gives_nan() {
+        let c = Clut::sample(vec![2; 5], 1, |p, o| o[0] = p.iter().sum()).unwrap();
+        let mut o = [0.0];
+        c.eval_multilinear(&[0.5, f32::NAN, 0.5, 0.5, 0.5], &mut o).unwrap();
+        assert!(o[0].is_nan(), "{o:?}");
+    }
+
     #[test]
     fn singleton_dimensions_do_not_multiply_corners() {
         // Fifteen inputs, all but two on a single grid point: the result interpolates only those

From fd9cf54c485cce1e6bd0e867e32fec87381b422c Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 22:23:27 -0400
Subject: [PATCH 18/29] ui: test that a protected member blocks the floating
 group's resize grip

Drags the resize grip of sample()'s floating group: a movable group emits MoveFloating,
one with a protected member emits none. Fails without the surface.rs check (CodeRabbit
review nitpick).
---
 crates/ui/src/docking/tests.rs | 42 ++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/crates/ui/src/docking/tests.rs b/crates/ui/src/docking/tests.rs
index ce2d3b9e..dfd3d8b0 100644
--- a/crates/ui/src/docking/tests.rs
+++ b/crates/ui/src/docking/tests.rs
@@ -867,6 +867,48 @@ fn protected_group_member_blocks_whole_group_gesture_and_host_drop() {
     }
 }
 
+/// Drags the floating group's resize grip in `sample()` and returns every action emitted.
+fn resize_floating_group(permissions: impl Fn(&u32) -> Permissions + Copy) -> Vec<Action<u32>> {
+    let ctx = Context::default();
+    let layout = sample();
+    // sample() floats 5 and 6 at [80, 70, 300, 220]; the grip is its bottom-right corner.
+    let (start, end) = (pos2(374.0, 284.0), pos2(398.0, 308.0));
+    let mut actions = Vec::new();
+    for events in [
+        vec![],
+        vec![],
+        vec![Event::PointerMoved(start), pointer_button(start, true)],
+        vec![Event::PointerMoved(end)],
+        vec![pointer_button(end, false)],
+    ] {
+        let mut out = DockOutput::default();
+        ctx.run_ui(RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), events, ..Default::default() }, |ui| {
+            let style = DockStyle::from_ui(ui);
+            out = DockArea::new(Id::new("resize-area")).show(
+                ui,
+                &layout,
+                &style,
+                |p| format!("Panel {p}"),
+                permissions,
+                |ui, _| {
+                    ui.label("Body");
+                },
+            );
+        })
+        .textures_delta
+        .clear();
+        actions.extend(out.actions);
+    }
+    actions
+}
+
+#[test]
+fn protected_group_member_blocks_floating_group_resize() {
+    let moved = |actions: &[Action<u32>]| actions.iter().any(|a| matches!(a, Action::MoveFloating { .. }));
+    assert!(moved(&resize_floating_group(|_| Permissions::default())), "the grip resizes a movable group");
+    assert!(!moved(&resize_floating_group(|p| if *p == 6 { Permissions::PROTECTED } else { Permissions::default() })));
+}
+
 #[test]
 fn chrome_focus_classifies_rendered_tab_but_excludes_body_text_field_and_invalid_layout() {
     let ctx = Context::default();

From c0a3d4c08c52e0dddc532cf33df91fd025fe933e Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 22:25:45 -0400
Subject: [PATCH 19/29] media: charge metadata at its converted length, before
 converting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lossy UTF-8 conversion can triple invalid bytes, and a fallback key such as ©nam is five
bytes, not four. The budget now charges the length the text will be stored at, computed
without allocating, before the value is converted (CodeRabbit review).
---
 crates/media/src/isobmff/demux.rs | 45 ++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 6 deletions(-)

diff --git a/crates/media/src/isobmff/demux.rs b/crates/media/src/isobmff/demux.rs
index a1579ed3..8926ddbd 100644
--- a/crates/media/src/isobmff/demux.rs
+++ b/crates/media/src/isobmff/demux.rs
@@ -934,16 +934,24 @@ fn charge_metadata(left: &mut usize, key_len: usize, value_len: usize) -> bool {
     }
 }
 
+/// Length of `String::from_utf8_lossy(bytes)` without building it: each invalid sequence
+/// becomes one three-byte U+FFFD.
+fn lossy_len(bytes: &[u8]) -> usize {
+    bytes.utf8_chunks().map(|c| c.valid().len() + if c.invalid().is_empty() { 0 } else { 3 }).sum()
+}
+
 fn parse_udta(p: &[u8], md: &mut Metadata, left: &mut usize) {
     for b in boxes(p).map_while(|b| b.ok()) {
         if b.kind == b"meta" {
             parse_meta(b.payload, md, left);
         } else if b.kind.0[0] == 0xA9 && b.payload.len() >= 4 {
             let n = u16::from_be_bytes([b.payload[0], b.payload[1]]) as usize;
+            // Charged at the stored text's length, before the value is converted.
+            let key = b.kind.to_string_lossy();
             if let Some(s) = b.payload.get(4..4 + n)
-                && charge_metadata(left, 4, s.len())
+                && charge_metadata(left, key.len(), lossy_len(s))
             {
-                md.entries.push((b.kind.to_string_lossy(), String::from_utf8_lossy(s).into_owned()));
+                md.entries.push((key, String::from_utf8_lossy(s).into_owned()));
             }
         }
     }
@@ -974,10 +982,15 @@ fn parse_meta(p: &[u8], md: &mut Metadata, left: &mut usize) {
             && d.len() >= 8
         {
             let ty = u32::from_be_bytes([d[0], d[1], d[2], d[3]]) & 0xFF_FFFF;
-            // Charged before the key is copied: every item naming one long key is another copy.
-            if (ty == 1 || ty == 0) && charge_metadata(left, named.map_or(4, String::len), d.len() - 8) {
-                let key = named.cloned().unwrap_or_else(|| item.kind.to_string_lossy());
-                md.entries.push((key, String::from_utf8_lossy(&d[8..]).into_owned()));
+            // Charged before the key is copied (every item naming one long key is another copy)
+            // and before the value is converted, at the lengths they will be stored at.
+            if ty == 1 || ty == 0 {
+                let fallback = if named.is_none() { Some(item.kind.to_string_lossy()) } else { None };
+                let key_len = named.or(fallback.as_ref()).map_or(0, String::len);
+                if charge_metadata(left, key_len, lossy_len(&d[8..])) {
+                    let key = named.cloned().or(fallback).unwrap_or_default();
+                    md.entries.push((key, String::from_utf8_lossy(&d[8..]).into_owned()));
+                }
             }
         }
     }
@@ -1285,6 +1298,26 @@ mod tests {
         assert_eq!(md.entries[0].0.len(), key.len());
     }
 
+    #[test]
+    fn metadata_is_charged_at_its_stored_length() {
+        assert_eq!(lossy_len(b"plain"), 5);
+        for bytes in [&b"a\xFFb"[..], b"\xFF\xFE\xFD", b"\xE2\x82", "\u{a9}nam".as_bytes()] {
+            assert_eq!(lossy_len(bytes), String::from_utf8_lossy(bytes).len(), "{bytes:?}");
+        }
+        // Invalid UTF-8 triples in size when converted; the budget sees the converted size.
+        let mut b = BoxBuf::new();
+        let m = b.start(&[0xA9, b'n', b'a', b'm']);
+        b.u16(1000);
+        b.u16(0);
+        b.bytes(&[0xFF; 1000]);
+        b.end(m);
+        let mut md = Metadata::default();
+        let mut left = 3000 + METADATA_ENTRY_COST + 5;
+        parse_udta(&b.buf, &mut md, &mut left);
+        assert_eq!(md.entries.len(), 1);
+        assert_eq!(md.entries[0].0.len() + md.entries[0].1.len(), 3000 + 5 - left);
+    }
+
     #[test]
     fn a_declared_sample_count_past_the_chunk_map_reserves_only_what_it_maps() {
         // stsz claims u32::MAX samples; the two chunks place four.

From 6cefd467fc0cd7b48c6252582e7110b67ddcb0c4 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 23 Oct 2026 08:39:26 -0400
Subject: [PATCH 20/29] security: bound vendored hayro
 xref/object-stream/JBIG2/graphics-state work and krilla PNG size (CodeRabbit)
 (#239)

* security: bound vendored hayro xref, object-stream, JBIG2 and graphics-state work; krilla PNG size

hayro-syntax:
- xref-stream subsections must be backed by decoded bytes: zero /W widths and counts
  longer than the data are refused before inserting (CodeRabbit CWE-400, xref.rs:962)
- object-stream offset tables are parsed once per document and cached in Data
  (CodeRabbit CWE-407, xref.rs:1079)
- embedded JBIG2 pages over 2^28 pixels are refused before allocating, with checked,
  fallible reservation (CodeRabbit CWE-789, filter/jbig2.rs:34)
- a JBIG2Globals stream with an image filter is ignored, so globals cannot recurse
  (CodeRabbit CWE-674, filter/jbig2.rs:20)

hayro-interpret:
- at most 4096 saved graphics states / 64 MiB retained; dash arrays over 256 entries stroke
  solid (CodeRabbit CWE-400, context.rs:226)

krilla:
- PNGs implying more than 1 GiB of decoded output are refused at Image::from_png and in
  the deferred decoder; the buffer is reserved fallibly (CodeRabbit CWE-789,
  graphics/image.rs:565)

SOURCE.json local hashes updated; patches recorded in vendor/README.craft-reader.md and
vendor/krilla/README.craft.md.

* vendor: fix SOURCE.json local hashes; reserve krilla's colour/alpha split buffers fallibly

- SOURCE.json: only the local sha256 changes; the source/upstream hashes of the patched
  files are restored (CodeRabbit review)
- krilla handle_u8_image/handle_u16_image reserve their split buffers with try_reserve_exact
  and return an error, so a valid image under the 1 GiB decode cap cannot abort the process
  on the second allocation (CodeRabbit review)
---
 vendor/README.craft-reader.md                 |  14 +++
 vendor/hayro-interpret/SOURCE.json            |   8 +-
 vendor/hayro-interpret/src/context.rs         | 117 +++++++++++++++++-
 vendor/hayro-interpret/src/interpret/mod.rs   |   6 +-
 vendor/hayro-interpret/src/interpret/state.rs |   8 +-
 vendor/hayro-interpret/src/types.rs           |  18 +++
 vendor/hayro-syntax/SOURCE.json               |   6 +-
 vendor/hayro-syntax/src/data.rs               |  19 +++
 vendor/hayro-syntax/src/filter/jbig2.rs       |  66 +++++++++-
 vendor/hayro-syntax/src/xref.rs               |  71 +++++++++--
 vendor/krilla/README.craft.md                 |   6 +
 vendor/krilla/SOURCE.json                     |   2 +-
 vendor/krilla/src/graphics/image.rs           | 112 ++++++++++++++---
 13 files changed, 407 insertions(+), 46 deletions(-)

diff --git a/vendor/README.craft-reader.md b/vendor/README.craft-reader.md
index e7ab08cf..a056e9e6 100644
--- a/vendor/README.craft-reader.md
+++ b/vendor/README.craft-reader.md
@@ -42,6 +42,20 @@ referred-to-number bytes are consumed, so a crafted header cannot turn
 `Vec::with_capacity` into a multi-gigabyte reservation that aborts on allocation
 failure.
 
+Hostile-input bounds (CodeRabbit findings):
+
+- An xref-stream subsection must be backed by its decoded bytes: all-zero `/W` widths
+  are refused, and a declared count longer than the data is refused before any entry is
+  inserted, so a tiny stream cannot declare billions of entries.
+- Each object stream's `/N` header pairs are parsed once per document and cached beside its
+  decoded data, instead of on every compressed-object lookup.
+- An embedded JBIG2 page over 2^28 pixels is refused before the output buffer is allocated,
+  and that buffer is reserved fallibly. A `JBIG2Globals` stream with an image filter is
+  ignored, so globals cannot recurse through further globals.
+- At most 4096 graphics states, holding at most 64 MiB together, are saved; a `q` past
+  either limit is counted but not copied, and its `Q` still removes the clips added since.
+  A dash array over 256 entries strokes solid.
+
 This remains the patched 0.7 backend. It retains the existing Bradford Lab conversion,
 floating component precision and codec versions, rather than claiming full 0.8
 equivalence. The independent color oracles, backend tests and facade contracts cover
diff --git a/vendor/hayro-interpret/SOURCE.json b/vendor/hayro-interpret/SOURCE.json
index 27811044..2ef84143 100644
--- a/vendor/hayro-interpret/SOURCE.json
+++ b/vendor/hayro-interpret/SOURCE.json
@@ -188,7 +188,7 @@
       "path": "src/context.rs",
       "source_sha256": "e6898005282196c77bf44357237c79f8c839e74f666e8157756230fd9e2f93ed",
       "source_git_blob": "3e83229c5f58cfbbefd15bf3b5e7b71380291c01",
-      "sha256": "86e838ca19dfc47f5bb0d7a2ffff80709f2fd51bc6b62d65151841bcba212e08"
+      "sha256": "c6f3ca9d12a53042a28dbb8088ee97ba8b2fc6b03ec35867b58fca99dd9b9807"
     },
     {
       "path": "src/convert.rs",
@@ -362,7 +362,7 @@
       "path": "src/interpret/mod.rs",
       "source_sha256": "2b286df0c34b8194e1bdd1b63c1e08354d24f8389958fd782f42e2cabf364673",
       "source_git_blob": "931b3388cef188cee0a5a1d495b69a6ff04f5e51",
-      "sha256": "6ae30906c8e6d0e869e0fac8ece4d97e0ac08d8abd7042c0242a069d4e609351"
+      "sha256": "72650303e920e855cf4c78c82bee2c4b72a4f251c58e16d27bd5ae3860c9983b"
     },
     {
       "path": "src/interpret/path.rs",
@@ -374,7 +374,7 @@
       "path": "src/interpret/state.rs",
       "source_sha256": "dce778291b13f6df83c8c13aee22f60edd033ec9f7d89309ef148d46d3ba9814",
       "source_git_blob": "95b773fb5cc434ab8db362d00e4e5180a8b740c9",
-      "sha256": "dce778291b13f6df83c8c13aee22f60edd033ec9f7d89309ef148d46d3ba9814"
+      "sha256": "a0d726f48645374f5cbf4ecb10906c13cabc747e3de878b9140c73b6d1303819"
     },
     {
       "path": "src/interpret/text.rs",
@@ -422,7 +422,7 @@
       "path": "src/types.rs",
       "source_sha256": "0e66569b8a7dc243b0a384cf1d3615ca62bf660b5324236f2594609bdfddfd46",
       "source_git_blob": "64d2b849bdd3fdcd4ebfd76845edcef77b625fbd",
-      "sha256": "0e66569b8a7dc243b0a384cf1d3615ca62bf660b5324236f2594609bdfddfd46"
+      "sha256": "542fafbfcf8a472466377cacd580eda2fc2d40b834a8d5ecd1ad35d75445f532"
     },
     {
       "path": "src/util.rs",
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index 9953b419..326aa201 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -166,6 +166,23 @@ pub struct Context<'a> {
     pub(crate) xref: &'a XRef,
     pub(crate) ocg_state: OcgState,
     nesting_depth: u32,
+    /// PdfCraft patch: estimated bytes held by saved states, and for each `q` not saved because
+    /// a limit was reached, the clip count to return to at its `Q`.
+    saved_bytes: usize,
+    skipped_saves: Vec<usize>,
+}
+
+/// PdfCraft patch: most graphics states saved at once. Every `q` copies the current state, dash
+/// array and clip list included, so without a limit short operators multiply one large state.
+const MAX_SAVED_STATES: usize = 4096;
+/// PdfCraft patch: most bytes all saved states may hold together.
+const MAX_SAVED_STATE_BYTES: usize = 64 << 20;
+
+/// Roughly what a saved copy of `state` holds.
+fn state_bytes(state: &State<'_>) -> usize {
+    size_of::<State<'_>>()
+        + state.graphics_state.stroke_props.dash_array.len() * size_of::<f32>()
+        + state.clips.len() * size_of::<ClipType>()
 }
 
 impl<'a> Context<'a> {
@@ -220,15 +237,33 @@ impl<'a> Context<'a> {
             interpreter_cache: cache.clone(),
             ocg_state,
             nesting_depth,
+            saved_bytes: 0,
+            skipped_saves: Vec::new(),
         }
     }
 
     pub(crate) fn save_state(&mut self) {
-        let Some(cur) = self.states.last().cloned() else {
+        let Some(cur) = self.states.last() else {
             warn!("attempted to save state without existing state");
             return;
         };
 
+        // PdfCraft patch: past either limit the `q` is recorded but nothing is copied. Its `Q`
+        // still removes the clips added since; other changes made in between are kept.
+        let bytes = state_bytes(cur);
+        if !self.skipped_saves.is_empty()
+            || self.states.len() >= MAX_SAVED_STATES
+            || self.saved_bytes.saturating_add(bytes) > MAX_SAVED_STATE_BYTES
+        {
+            if self.skipped_saves.is_empty() {
+                warn!("too many saved graphics states; further saves are not kept");
+            }
+            self.skipped_saves.push(cur.clips.len());
+            return;
+        }
+
+        let cur = cur.clone();
+        self.saved_bytes += bytes;
         self.states.push(cur);
     }
 
@@ -305,6 +340,14 @@ impl<'a> Context<'a> {
     }
 
     pub(crate) fn restore_state(&mut self, device: &mut impl Device<'a>) {
+        // PdfCraft patch: a save that was not kept is the most recent one.
+        if let Some(target_clips) = self.skipped_saves.pop() {
+            while self.get().clips.len() > target_clips {
+                self.pop_clip_path(device);
+            }
+            return;
+        }
+
         let Some(target_clips) = self
             .states
             .get(self.states.len().saturating_sub(2))
@@ -321,6 +364,10 @@ impl<'a> Context<'a> {
         // The first state should never be popped.
         if self.states.len() > 1 {
             self.states.pop();
+            // PdfCraft patch: the state now on top is the copy that was charged when saved.
+            if let Some(top) = self.states.last() {
+                self.saved_bytes = self.saved_bytes.saturating_sub(state_bytes(top));
+            }
         }
 
         device.set_soft_mask(
@@ -392,7 +439,8 @@ impl<'a> Context<'a> {
     }
 
     pub(crate) fn num_states(&self) -> usize {
-        self.states.len()
+        // PdfCraft patch: saves not kept still count, so callers restore back past them.
+        self.states.len() + self.skipped_saves.len()
     }
 
     pub(crate) fn nesting_depth(&self) -> u32 {
@@ -484,3 +532,68 @@ pub(crate) fn path_as_rect(path: &BezPath) -> Option<Rect> {
         None
     }
 }
+
+#[cfg(test)]
+mod saved_state_tests {
+    use super::*;
+    use crate::device::DummyDevice;
+    use hayro_syntax::Pdf;
+
+    fn pdf() -> Pdf {
+        let objects = ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Count 0 /Kids [] >>"];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, body) in objects.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(b"xref\n0 3\n0000000000 65535 f \n");
+        for offset in offsets {
+            out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size 3 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+        Pdf::new(out).expect("synthetic pdf")
+    }
+
+    #[test]
+    fn repeated_saves_of_a_large_state_stay_bounded_and_balanced() {
+        let pdf = pdf();
+        let cache = InterpreterCache::new();
+        let mut ctx = Context::new(Affine::IDENTITY, Rect::new(0.0, 0.0, 100.0, 100.0), &cache, pdf.xref(), InterpreterSettings::default());
+        ctx.get_mut().graphics_state.stroke_props.dash_array = crate::types::dash_array((0..crate::types::MAX_DASH_ENTRIES).map(|i| i as f32 + 1.0));
+        for _ in 0..20_000 {
+            ctx.save_state();
+        }
+        assert!(ctx.states.len() <= MAX_SAVED_STATES);
+        assert!(ctx.saved_bytes <= MAX_SAVED_STATE_BYTES);
+        assert_eq!(ctx.num_states(), 20_001, "every q still counts");
+
+        // A clip added after a save that was not kept is removed by its Q.
+        let mut device = DummyDevice;
+        let mut triangle = BezPath::new();
+        triangle.move_to((10.0, 10.0));
+        triangle.line_to((90.0, 10.0));
+        triangle.line_to((50.0, 90.0));
+        triangle.close_path();
+        let clips = ctx.get().clips.len();
+        ctx.push_clip_path(triangle, FillRule::NonZero, &mut device);
+        assert_eq!(ctx.get().clips.len(), clips + 1);
+        ctx.restore_state(&mut device);
+        assert_eq!(ctx.get().clips.len(), clips);
+
+        while ctx.num_states() > 1 {
+            ctx.restore_state(&mut device);
+        }
+        assert_eq!(ctx.states.len(), 1);
+        assert_eq!(ctx.saved_bytes, 0);
+    }
+
+    #[test]
+    fn an_overlong_dash_array_strokes_solid() {
+        let max = crate::types::MAX_DASH_ENTRIES;
+        assert_eq!(crate::types::dash_array((0..max).map(|_| 2.0)).len(), max);
+        assert!(crate::types::dash_array((0..max + 1).map(|_| 2.0)).is_empty());
+        assert_eq!(crate::types::dash_array([0.0, 3.0].into_iter()).as_slice(), &[0.01, 3.0]);
+    }
+}
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index a0c6308e..8af574c3 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -555,11 +555,9 @@ fn interpret_window<'a>(
             }
             TypedInstruction::DashPattern(p) => {
                 context.get_mut().graphics_state.stroke_props.dash_offset = p.1.as_f32();
-                // kurbo apparently cannot properly deal with offsets that are exactly 0.
+                // PdfCraft patch: bounded, see `types::dash_array`.
                 context.get_mut().graphics_state.stroke_props.dash_array =
-                    p.0.iter::<f32>()
-                        .map(|n| if n == 0.0 { 0.01 } else { n })
-                        .collect();
+                    crate::types::dash_array(p.0.iter::<f32>());
             }
             TypedInstruction::RenderingIntent(_) => {
                 // Ignore for now.
diff --git a/vendor/hayro-interpret/src/interpret/state.rs b/vendor/hayro-interpret/src/interpret/state.rs
index 95b773fb..8488144a 100644
--- a/vendor/hayro-interpret/src/interpret/state.rs
+++ b/vendor/hayro-interpret/src/interpret/state.rs
@@ -402,11 +402,9 @@ pub(crate) fn handle_gs_single<'a>(
             let dash_phase = iter.next()?.into_number()?.as_f32();
 
             context.get_mut().graphics_state.stroke_props.dash_offset = dash_phase;
-            context.get_mut().graphics_state.stroke_props.dash_array = dash_array
-                .iter::<f32>()
-                // kurbo apparently cannot properly deal with offsets that are exactly 0.
-                .map(|n| if n == 0.0 { 0.01 } else { n })
-                .collect();
+            // PdfCraft patch: bounded, see `types::dash_array`.
+            context.get_mut().graphics_state.stroke_props.dash_array =
+                crate::types::dash_array(dash_array.iter::<f32>());
         }
         "Type" => {}
         _ => {}
diff --git a/vendor/hayro-interpret/src/types.rs b/vendor/hayro-interpret/src/types.rs
index 64d2b849..ff7776f3 100644
--- a/vendor/hayro-interpret/src/types.rs
+++ b/vendor/hayro-interpret/src/types.rs
@@ -305,6 +305,24 @@ pub struct StrokeProps {
     pub dash_offset: f32,
 }
 
+/// PdfCraft patch: longest dash array kept. A longer one strokes solid; it is copied by every
+/// saved graphics state, and real dash patterns have a handful of entries.
+pub(crate) const MAX_DASH_ENTRIES: usize = 256;
+
+/// PdfCraft patch: the dash array a `d` operator or `/D` entry sets, from its numbers.
+pub(crate) fn dash_array(values: impl Iterator<Item = f32>) -> SmallVec<[f32; 4]> {
+    // kurbo apparently cannot properly deal with offsets that are exactly 0.
+    let dashes: SmallVec<[f32; 4]> = values
+        .take(MAX_DASH_ENTRIES + 1)
+        .map(|n| if n == 0.0 { 0.01 } else { n })
+        .collect();
+    if dashes.len() > MAX_DASH_ENTRIES {
+        warn!("dash array is too long; stroking solid");
+        return smallvec![];
+    }
+    dashes
+}
+
 impl Default for StrokeProps {
     fn default() -> Self {
         Self {
diff --git a/vendor/hayro-syntax/SOURCE.json b/vendor/hayro-syntax/SOURCE.json
index 721bac61..462194b2 100644
--- a/vendor/hayro-syntax/SOURCE.json
+++ b/vendor/hayro-syntax/SOURCE.json
@@ -128,7 +128,7 @@
       "path": "src/data.rs",
       "source_sha256": "c8dc5a157358e024d73e405333ecac01e94ba6880488d5a10b952bd3fc47fd41",
       "source_git_blob": "9d5e2030f8d6dab7167cd2c5d8da36a7e5688c34",
-      "sha256": "c8dc5a157358e024d73e405333ecac01e94ba6880488d5a10b952bd3fc47fd41"
+      "sha256": "83c4417cfe9b301ef0fce8dc2f6a7f694d025e1fd82a68db6acded31155d3bee"
     },
     {
       "path": "src/filter/ascii_85.rs",
@@ -158,7 +158,7 @@
       "path": "src/filter/jbig2.rs",
       "source_sha256": "0ac3c16e02cb13f2d5fe401edd35949320662906c3906cb39fe743acd5e32b09",
       "source_git_blob": "d87253f536e6b8ac18323f1f06164b516ad775df",
-      "sha256": "0ac3c16e02cb13f2d5fe401edd35949320662906c3906cb39fe743acd5e32b09"
+      "sha256": "4ce7d4c4f33528f5922395c99ddf2da67d15f166bfa593c43df5e5ebf75b3669"
     },
     {
       "path": "src/filter/jpx.rs",
@@ -338,7 +338,7 @@
       "path": "src/xref.rs",
       "source_sha256": "51ffeeb7d4ac035bae2cd5ba9288c180088ae06cdcefe2b29dfeda560a793aa0",
       "source_git_blob": "20e33a410489d42e438a3f2b87d70c7bb8d66eae",
-      "sha256": "2bd19a3df5f81c4c0babc80a473877714fe13d2542eafb5c8b5843f81af36d80"
+      "sha256": "d5463a6d629e31a33c1d5b9a735a6e87353752dc0b4156dd84247dcf9b485804"
     },
     {
       "path": "src/decode_limits_tests.rs",
diff --git a/vendor/hayro-syntax/src/data.rs b/vendor/hayro-syntax/src/data.rs
index 9d5e2030..7d47c4d3 100644
--- a/vendor/hayro-syntax/src/data.rs
+++ b/vendor/hayro-syntax/src/data.rs
@@ -68,6 +68,10 @@ pub(crate) struct Data {
     decoded: SegmentList<Option<Vec<u8>>, 32>,
     map: Mutex<HashMap<ObjectIdentifier, usize>>,
     loading: LoadGate,
+    // PdfCraft patch: each object stream's header pairs, parsed once. Looking up every object of
+    // a stream otherwise reparsed all /N pairs per lookup, quadratic in /N. An entry is at most
+    // one pair per four decoded bytes, and decoded streams are kept for the document anyway.
+    object_offsets: Mutex<HashMap<ObjectIdentifier, Arc<Vec<(u32, usize)>>>>,
 }
 
 impl Debug for Data {
@@ -84,6 +88,7 @@ impl Data {
             decoded: SegmentList::new(),
             map: Mutex::new(HashMap::new()),
             loading: LoadGate::default(),
+            object_offsets: Mutex::new(HashMap::new()),
         }
     }
 
@@ -92,6 +97,20 @@ impl Data {
         &self.data
     }
 
+    /// PdfCraft patch: the header pairs of object stream `id`, from `parse` on first use.
+    pub(crate) fn object_offsets(
+        &self,
+        id: ObjectIdentifier,
+        parse: impl FnOnce() -> Option<Vec<(u32, usize)>>,
+    ) -> Option<Arc<Vec<(u32, usize)>>> {
+        if let Some(offsets) = self.object_offsets.get().get(&id) {
+            return Some(offsets.clone());
+        }
+        // Parsed without the lock held; a racing parse of the same stream gives the same table.
+        let parsed = Arc::new(parse()?);
+        Some(self.object_offsets.get().entry(id).or_insert(parsed).clone())
+    }
+
     /// Get access to the data of a decoded object stream.
     pub(crate) fn get_with(&self, id: ObjectIdentifier, ctx: &ReaderContext<'_>) -> Option<&[u8]> {
         // PdfCraft patch: (#307, see vendor/README.md hayro-syntax (10)) register exactly once:
diff --git a/vendor/hayro-syntax/src/filter/jbig2.rs b/vendor/hayro-syntax/src/filter/jbig2.rs
index d87253f5..a0ab784b 100644
--- a/vendor/hayro-syntax/src/filter/jbig2.rs
+++ b/vendor/hayro-syntax/src/filter/jbig2.rs
@@ -1,13 +1,19 @@
 use crate::bit_reader::BitWriter;
+use crate::filter::Filter;
 use crate::object::Dict;
 use crate::object::Stream;
 use crate::object::dict::keys::JBIG2_GLOBALS;
 use crate::object::stream::{FilterResult, ImageColorSpace, ImageData, ImageDecodeParams};
 use alloc::borrow::Cow;
-use alloc::vec;
 use alloc::vec::Vec;
 use core::iter;
 
+/// PdfCraft patch: most pixels an embedded JBIG2 page may decode to, matching the renderer's
+/// `MAX_IMAGE_PIXELS` and `hayro_jbig2`'s region limit. The page header's own dimensions are
+/// checked here, before any output is allocated: the image dictionary's smaller ones say nothing
+/// about them.
+const MAX_PIXELS: u64 = 1 << 28;
+
 /// Decode JBIG2 data from a PDF stream.
 ///
 /// The `params` dictionary may contain a `JBIG2Globals` entry pointing to
@@ -17,12 +23,28 @@ pub(crate) fn decode(
     params: &Dict<'_>,
     image_params: &ImageDecodeParams,
 ) -> Option<FilterResult<'static>> {
+    // PdfCraft patch: globals are plain segment data. A globals stream filtered as an image
+    // could name further globals of its own, recursing once per stream in the chain.
     let globals = params
         .get::<Stream<'_>>(JBIG2_GLOBALS)
+        .filter(|g| {
+            !g.filters().iter().any(|f| {
+                matches!(
+                    f,
+                    Filter::Jbig2Decode | Filter::DctDecode | Filter::JpxDecode | Filter::CcittFaxDecode
+                )
+            })
+        })
         .and_then(|g| g.decoded().ok());
 
     let image = hayro_jbig2::Image::new_embedded(data, globals.as_deref()).ok()?;
 
+    if u64::from(image.width()) * u64::from(image.height()) > MAX_PIXELS {
+        warn!("embedded JBIG2 page is too large");
+
+        return None;
+    }
+
     // Whenever possible (if we don't have an indexed color space), we convert
     // the data as 8-bit instead of 1-bit, so that it can be easier converted
     // into an RGBA8 image.
@@ -31,7 +53,11 @@ pub(crate) fn decode(
     // white = 0, but PDF uses the opposite.
     let (decoded, bpc) = if image_params.is_indexed {
         let row_bytes = (image.width() as usize).div_ceil(8);
-        let mut packed = vec![0_u8; row_bytes * image.height() as usize];
+        // PdfCraft patch: checked and fallible, so a failed allocation is a decode error.
+        let len = row_bytes.checked_mul(image.height() as usize)?;
+        let mut packed = Vec::new();
+        packed.try_reserve_exact(len).ok()?;
+        packed.resize(len, 0_u8);
 
         struct BitWriterDecoder<'a> {
             writer: BitWriter<'a>,
@@ -77,7 +103,11 @@ pub(crate) fn decode(
             fn next_line(&mut self) {}
         }
 
-        let mut decoder = Luma8Decoder { output: Vec::new() };
+        let mut output = Vec::new();
+        output
+            .try_reserve_exact((image.width() as usize).checked_mul(image.height() as usize)?)
+            .ok()?;
+        let mut decoder = Luma8Decoder { output };
         image.decode(&mut decoder).ok()?;
 
         (decoder.output, 8)
@@ -94,3 +124,33 @@ pub(crate) fn decode(
         }),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A page information segment declaring `width` x `height`, and nothing else.
+    fn page_information(width: u32, height: u32) -> Vec<u8> {
+        let mut out = Vec::new();
+        out.extend_from_slice(&0u32.to_be_bytes()); // segment number
+        out.push(48); // page information
+        out.push(0); // no referred-to segments
+        out.push(1); // page 1
+        out.extend_from_slice(&19u32.to_be_bytes());
+        out.extend_from_slice(&width.to_be_bytes());
+        out.extend_from_slice(&height.to_be_bytes());
+        out.extend_from_slice(&[0; 8]); // resolution
+        out.push(0); // flags
+        out.extend_from_slice(&[0; 2]); // striping
+        out
+    }
+
+    #[test]
+    fn an_oversized_embedded_page_is_refused_before_allocating() {
+        let data = page_information(65_535, 65_535);
+        for is_indexed in [false, true] {
+            let params = ImageDecodeParams { is_indexed, bpc: Some(1), num_components: Some(1), target_dimension: None, width: 1, height: 1 };
+            assert!(decode(&data, &Dict::empty(), &params).is_none());
+        }
+    }
+}
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index d6f6b33d..ed504128 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -618,9 +618,13 @@ impl XRef {
                     return None;
                 }
 
-                let stream = self.get_with::<Stream<'_>>(obj_stream_id, &ctx)?;
                 let data = repr.data.get_with(obj_stream_id, &ctx)?;
-                let object_stream = ObjectStream::new(stream, data, &ctx)?;
+                // PdfCraft patch: the offset table is parsed once per stream (see Data).
+                let offsets = repr.data.object_offsets(obj_stream_id, || {
+                    let stream = self.get_with::<Stream<'_>>(obj_stream_id, &ctx)?;
+                    ObjectStream::offsets(stream, data)
+                })?;
+                let object_stream = ObjectStream::with_offsets(offsets, data, &ctx);
                 object_stream.get(index)
             }
         }
@@ -959,6 +963,22 @@ fn xref_stream_subsection<'a>(
     f3_len: u8,
     insert_map: &mut XrefMap,
 ) -> Option<()> {
+    // PdfCraft patch: every entry must be backed by stream bytes. With all widths zero an entry
+    // reads nothing, so a tiny stream could declare billions of entries; and a count past the
+    // decoded data is refused before any of it is inserted.
+    let width = f1_len as usize + f2_len as usize + f3_len as usize;
+    if width == 0 {
+        warn!("xref stream entries have no width");
+
+        return None;
+    }
+    let available = xref_reader.len().saturating_sub(xref_reader.offset());
+    if (num_elements as usize).checked_mul(width).is_none_or(|need| need > available) {
+        warn!("xref stream subsection declares more entries than its data holds");
+
+        return None;
+    }
+
     for i in 0..num_elements {
         let f_type = if f1_len == 0 {
             1
@@ -1064,11 +1084,23 @@ fn get_decryptor(trailer_dict: &Dict<'_>, password: &[u8]) -> Result<Decryptor,
 struct ObjectStream<'a> {
     data: &'a [u8],
     ctx: ReaderContext<'a>,
-    offsets: Vec<(u32, usize)>,
+    offsets: Arc<Vec<(u32, usize)>>,
 }
 
 impl<'a> ObjectStream<'a> {
     fn new(inner: Stream<'_>, data: &'a [u8], ctx: &ReaderContext<'a>) -> Option<Self> {
+        Some(Self::with_offsets(Arc::new(Self::offsets(inner, data)?), data, ctx))
+    }
+
+    fn with_offsets(offsets: Arc<Vec<(u32, usize)>>, data: &'a [u8], ctx: &ReaderContext<'a>) -> Self {
+        let mut ctx = ctx.clone();
+        ctx.set_in_object_stream(true);
+
+        Self { data, ctx, offsets }
+    }
+
+    /// The `/N` pairs of object number and absolute offset at the start of `data`.
+    fn offsets(inner: Stream<'_>, data: &[u8]) -> Option<Vec<(u32, usize)>> {
         let num_objects = inner.dict().get::<usize>(N)?;
         let first_offset = inner.dict().get::<usize>(FIRST)?;
 
@@ -1082,13 +1114,10 @@ impl<'a> ObjectStream<'a> {
             let obj_num = r.read_without_context::<u32>()?;
             r.skip_white_spaces_and_comments();
             let relative_offset = r.read_without_context::<usize>()?;
-            offsets.push((obj_num, first_offset + relative_offset));
+            offsets.push((obj_num, first_offset.checked_add(relative_offset)?));
         }
 
-        let mut ctx = ctx.clone();
-        ctx.set_in_object_stream(true);
-
-        Some(Self { data, ctx, offsets })
+        Some(offsets)
     }
 
     fn get<T>(&self, index: u32) -> Option<T>
@@ -1137,6 +1166,32 @@ fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
 mod tests {
     use super::*;
 
+    #[test]
+    fn xref_stream_entries_need_backing_bytes() {
+        let mut map = XrefMap::default();
+        // All widths zero: an entry reads nothing, so none may be declared.
+        let mut empty = Reader::new(&[]);
+        assert!(xref_stream_subsection(&mut empty, 0, u32::MAX, 0, 0, 0, &mut map).is_none());
+        // Three entries of width 3 need nine bytes; eight are refused before any insert.
+        let data = [1, 0, 9, 1, 0, 9, 1, 0];
+        let mut short = Reader::new(&data);
+        assert!(xref_stream_subsection(&mut short, 0, 3, 1, 1, 1, &mut map).is_none());
+        assert!(map.is_empty());
+        let mut whole = Reader::new(&data[..6]);
+        assert!(xref_stream_subsection(&mut whole, 0, 2, 1, 1, 1, &mut map).is_some());
+        assert_eq!(map.len(), 2);
+    }
+
+    #[test]
+    fn object_stream_offsets_are_parsed_once() {
+        let data = Data::new(PdfData::from(Vec::new()));
+        let id = ObjectIdentifier::new(7, 0);
+        let first = data.object_offsets(id, || Some(vec![(1, 10), (2, 20)])).unwrap();
+        let again = data.object_offsets(id, || panic!("reparsed a cached offset table")).unwrap();
+        assert!(Arc::ptr_eq(&first, &again));
+        assert!(data.object_offsets(ObjectIdentifier::new(8, 0), || None).is_none());
+    }
+
     // Contributor-original, MIT OR Apache-2.0. Matches the bounded, uncompressed
     // synthetic regression used to reproduce the cold-publication race. A second
     // stream optionally checks that racing registration never aliases two ids.
diff --git a/vendor/krilla/README.craft.md b/vendor/krilla/README.craft.md
index c2e6e7cc..d0aff457 100644
--- a/vendor/krilla/README.craft.md
+++ b/vendor/krilla/README.craft.md
@@ -26,3 +26,9 @@ The shared writer's native subprocess regression covers the previously aborting
 cleanup and a successful fresh export afterward. Native and WASM export tests
 cover the unchanged successful path. WASM aborts, aborting panic configurations
 and process-wide allocation failures remain outside unwind recovery.
+
+A PNG whose header implies more than 1 GiB of decoded output is refused by
+`Image::from_png` and by the deferred decoder, and the decoded buffer is reserved
+fallibly, so a small file (or a bitmap glyph in a font) cannot request an allocation that
+ends the process. The colour and alpha buffers that PNG, GIF and WebP decoding split an
+image into are reserved fallibly too, and a failure there is an image error.
diff --git a/vendor/krilla/SOURCE.json b/vendor/krilla/SOURCE.json
index 3b01eaf6..ca911455 100644
--- a/vendor/krilla/SOURCE.json
+++ b/vendor/krilla/SOURCE.json
@@ -172,7 +172,7 @@
     {
       "path": "src/graphics/image.rs",
       "upstream_sha256": "61324d6426ac79aa5322d0d33a95532934cd1e41797a9dad6302210a2b799d5d",
-      "sha256": "61324d6426ac79aa5322d0d33a95532934cd1e41797a9dad6302210a2b799d5d"
+      "sha256": "25fb30fc591e180f8ab4a6445cbda0d14f1cfc7860c4699b444c3fbaab97bd69"
     },
     {
       "path": "src/graphics/mask.rs",
diff --git a/vendor/krilla/src/graphics/image.rs b/vendor/krilla/src/graphics/image.rs
index 22a68ca9..d1d003d4 100644
--- a/vendor/krilla/src/graphics/image.rs
+++ b/vendor/krilla/src/graphics/image.rs
@@ -330,7 +330,7 @@ impl Image {
         Self(Arc::new(ImageRepr {
             inner: Deferred::new(move || {
                 let (color_channel, alpha_channel, bits_per_component) =
-                    handle_u8_image(&data, ColorSpace::RGBA);
+                    handle_u8_image(&data, ColorSpace::RGBA)?;
 
                 Ok(Repr::Sampled(SampledRepr {
                     color_channel,
@@ -522,6 +522,13 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
     let reader = decoder
         .read_info()
         .map_err(|e| e.to_string().to_ascii_lowercase())?;
+    // Craft patch: refused here too, so `Image::from_png` fails instead of the deferred decode.
+    if reader
+        .output_buffer_size()
+        .is_none_or(|n| n > MAX_DECODED_PNG_BYTES)
+    {
+        return Err("image is too large".to_string());
+    }
     let info = reader.info();
 
     let size = (info.width, info.height);
@@ -555,6 +562,11 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
     })
 }
 
+/// Craft patch: most bytes a PNG may decode to (16384 x 16384 RGBA8). The header alone sets the
+/// output size, so it is checked before any pixel data, and reserved fallibly, so that a bad
+/// image is an error instead of an allocation failure that ends the process.
+const MAX_DECODED_PNG_BYTES: usize = 1 << 30;
+
 fn decode_png(data: &[u8]) -> Result<Repr, String> {
     let cursor = Cursor::new(data);
     let mut decoder = png::Decoder::new(cursor);
@@ -562,7 +574,15 @@ fn decode_png(data: &[u8]) -> Result<Repr, String> {
     let mut reader = decoder
         .read_info()
         .map_err(|e| e.to_string().to_ascii_lowercase())?;
-    let mut img_data = vec![0; reader.output_buffer_size().ok_or("image is too large")?];
+    let size = reader
+        .output_buffer_size()
+        .filter(|&n| n <= MAX_DECODED_PNG_BYTES)
+        .ok_or("image is too large")?;
+    let mut img_data = Vec::new();
+    img_data
+        .try_reserve_exact(size)
+        .map_err(|_| "image is too large".to_string())?;
+    img_data.resize(size, 0);
     let _ = reader
         .next_frame(&mut img_data)
         .map_err(|e| e.to_string())?;
@@ -577,8 +597,8 @@ fn decode_png(data: &[u8]) -> Result<Repr, String> {
     };
 
     let (color_channel, alpha_channel, bits_per_component) = match bit_depth {
-        BitDepth::Eight => handle_u8_image(&img_data, color_space),
-        BitDepth::Sixteen => handle_u16_image(&img_data, color_space),
+        BitDepth::Eight => handle_u8_image(&img_data, color_space)?,
+        BitDepth::Sixteen => handle_u16_image(&img_data, color_space)?,
         _ => return Err("image has an unsupported bit-depth".to_string()),
     };
 
@@ -663,7 +683,7 @@ fn decode_gif(data: Data) -> Result<Repr, String> {
         .ok_or("GIF image seems to be empty".to_string())?;
 
     let (color_channel, alpha_channel, bits_per_component) =
-        handle_u8_image(first_frame.buffer.as_ref(), ColorSpace::RGBA);
+        handle_u8_image(first_frame.buffer.as_ref(), ColorSpace::RGBA)?;
 
     Ok(Repr::Sampled(SampledRepr {
         color_channel,
@@ -719,7 +739,7 @@ fn decode_webp(data: Data) -> Result<Repr, String> {
     };
 
     let (color_channel, alpha_channel, bits_per_component) =
-        handle_u8_image(&first_frame, color_space);
+        handle_u8_image(&first_frame, color_space)?;
 
     Ok(Repr::Sampled(SampledRepr {
         color_channel,
@@ -728,9 +748,21 @@ fn decode_webp(data: Data) -> Result<Repr, String> {
     }))
 }
 
-fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, BitsPerComponent) {
+/// Craft patch: an empty vector with room for `capacity` bytes, or an error instead of the
+/// allocation failure that would end the process. Splitting a decoded image into colour and alpha
+/// briefly needs about twice its size beside the decoded pixels.
+fn try_buffer(capacity: usize) -> Result<Vec<u8>, String> {
+    let mut v = Vec::new();
+    v.try_reserve_exact(capacity)
+        .map_err(|_| "image is too large".to_string())?;
+    Ok(v)
+}
+
+type SplitImage = (Vec<u8>, Option<Vec<u8>>, BitsPerComponent);
+
+fn handle_u8_image(data: &[u8], cs: ColorSpace) -> Result<SplitImage, String> {
     let mut alphas = if cs.has_alpha() {
-        Vec::with_capacity(data.len() / cs.num_components())
+        try_buffer(data.len() / cs.num_components())?
     } else {
         Vec::new()
     };
@@ -738,7 +770,7 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
     let color_channel = match cs {
         ColorSpace::RGB => deflate_encode(data),
         ColorSpace::RGBA => {
-            let mut buf = Vec::with_capacity(data.len() * 3 / 4);
+            let mut buf = try_buffer(data.len() * 3 / 4)?;
             data.chunks_exact(4).for_each(|data| {
                 buf.extend_from_slice(&data[0..3]);
                 alphas.push(data[3]);
@@ -747,7 +779,7 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
         }
         ColorSpace::Luma => deflate_encode(data),
         ColorSpace::LumaA => {
-            let mut buf = Vec::with_capacity(data.len() / 2);
+            let mut buf = try_buffer(data.len() / 2)?;
             data.chunks_exact(2).for_each(|data| {
                 buf.push(data[0]);
                 alphas.push(data[1]);
@@ -764,12 +796,12 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
         None
     };
 
-    (color_channel, alpha_channel, BitsPerComponent::Eight)
+    Ok((color_channel, alpha_channel, BitsPerComponent::Eight))
 }
 
-fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, BitsPerComponent) {
+fn handle_u16_image(data: &[u8], cs: ColorSpace) -> Result<SplitImage, String> {
     let mut alphas = if cs.has_alpha() {
-        Vec::with_capacity(data.len() / cs.num_components())
+        try_buffer(data.len() / cs.num_components())?
     } else {
         Vec::new()
     };
@@ -777,7 +809,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
     let encoded_image = match cs {
         ColorSpace::RGB => deflate_encode(data),
         ColorSpace::RGBA => {
-            let mut buf = Vec::with_capacity(data.len() * 3 / 4);
+            let mut buf = try_buffer(data.len() * 3 / 4)?;
             data.chunks_exact(8).for_each(|data| {
                 buf.extend_from_slice(&data[0..6]);
                 alphas.extend_from_slice(&data[6..]);
@@ -786,7 +818,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
         }
         ColorSpace::Luma => deflate_encode(data),
         ColorSpace::LumaA => {
-            let mut buf = Vec::with_capacity(data.len() / 2);
+            let mut buf = try_buffer(data.len() / 2)?;
             data.chunks_exact(4).for_each(|data| {
                 buf.extend_from_slice(&data[0..2]);
                 alphas.extend_from_slice(&data[2..]);
@@ -803,7 +835,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
         None
     };
 
-    (encoded_image, encoded_mask, BitsPerComponent::Sixteen)
+    Ok((encoded_image, encoded_mask, BitsPerComponent::Sixteen))
 }
 
 fn get_icc_profile_type(data: &[u8], color_space: ImageColorspace) -> Option<GenericICCProfile> {
@@ -827,6 +859,54 @@ mod tests {
         assert!(e.is_err());
     }
 
+    /// A PNG whose header alone claims `width` x `height` RGBA16, with an empty IDAT.
+    fn png_header(width: u32, height: u32) -> Vec<u8> {
+        fn crc(bytes: &[u8]) -> u32 {
+            let mut c = !0u32;
+            for &b in bytes {
+                c ^= u32::from(b);
+                for _ in 0..8 {
+                    c = if c & 1 != 0 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
+                }
+            }
+            !c
+        }
+        fn chunk(out: &mut Vec<u8>, kind: &[u8; 4], data: &[u8]) {
+            out.extend_from_slice(&(data.len() as u32).to_be_bytes());
+            let start = out.len();
+            out.extend_from_slice(kind);
+            out.extend_from_slice(data);
+            let sum = crc(&out[start..]);
+            out.extend_from_slice(&sum.to_be_bytes());
+        }
+        let mut out = b"\x89PNG\r\n\x1a\n".to_vec();
+        let mut ihdr = Vec::new();
+        ihdr.extend_from_slice(&width.to_be_bytes());
+        ihdr.extend_from_slice(&height.to_be_bytes());
+        ihdr.extend_from_slice(&[16, 6, 0, 0, 0]);
+        chunk(&mut out, b"IHDR", &ihdr);
+        chunk(&mut out, b"IDAT", &[0x78, 0x9C, 0x03, 0x00, 0x00, 0x00, 0x00, 0x01]);
+        chunk(&mut out, b"IEND", &[]);
+        out
+    }
+
+    #[test]
+    fn a_png_header_claiming_a_huge_image_is_refused_before_allocating() {
+        // 65535 x 65535 RGBA16 would be 34 GB of output.
+        let huge = png_header(65_535, 65_535);
+        assert!(Image::from_png(Arc::new(huge.clone()).into(), false).is_err());
+        assert!(super::decode_png(&huge).is_err());
+    }
+
+    #[test]
+    fn rgba_split_buffers_are_reserved_fallibly() {
+        assert!(super::try_buffer(usize::MAX).is_err());
+        let (color, alpha, _) = super::handle_u8_image(&[1, 2, 3, 128, 4, 5, 6, 255], super::ColorSpace::RGBA).unwrap();
+        assert!(!color.is_empty() && alpha.is_some());
+        let (_, alpha, _) = super::handle_u16_image(&[0; 16], super::ColorSpace::RGBA).unwrap();
+        assert!(alpha.is_some());
+    }
+
     #[test]
     fn invalid_jpeg_image() {
         let e = Image::from_jpeg(Arc::new(b"dfngiudfg".to_vec()).into(), false);

From 35d18945a9a483d247b158505535686a135ff6f8 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 23 Oct 2026 11:14:16 -0400
Subject: [PATCH 21/29] fix(hayro-syntax): read full /W[0] xref entry type
 width (#241)

* fix(hayro-syntax): read full /W[0] width for xref stream entry type (follow-up to #239)

* hayro-syntax: loader-path test for oversized /W[0]; document patch; drop committed build output (CodeRabbit)
---
 .gitignore                      |  1 +
 vendor/README.craft-reader.md   |  2 ++
 vendor/hayro-syntax/Cargo.lock  | 39 ++++++++++++++++++++++++
 vendor/hayro-syntax/SOURCE.json |  2 +-
 vendor/hayro-syntax/src/xref.rs | 53 +++++++++++++++++++++++++++------
 5 files changed, 87 insertions(+), 10 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9108c660..c725b3c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ plans/
 .DS_Store
 /.claude/
 .idea/
+/vendor/*/target
diff --git a/vendor/README.craft-reader.md b/vendor/README.craft-reader.md
index a056e9e6..24f9c47d 100644
--- a/vendor/README.craft-reader.md
+++ b/vendor/README.craft-reader.md
@@ -54,6 +54,8 @@ Hostile-input bounds (CodeRabbit findings):
   ignored, so globals cannot recurse through further globals.
 - At most 4096 graphics states, holding at most 64 MiB together, are saved; a `q` past
   either limit is counted but not copied, and its `Q` still removes the clips added since.
+- An xref-stream `/W` type field wider than one byte is read at its full width (big-endian)
+  instead of only its first byte, and `/W[0]` over 8 bytes is refused like `/W[1]`.
   A dash array over 256 entries strokes solid.
 
 This remains the patched 0.7 backend. It retains the existing Bradford Lab conversion,
diff --git a/vendor/hayro-syntax/Cargo.lock b/vendor/hayro-syntax/Cargo.lock
index ebc07dff..cced0bd8 100644
--- a/vendor/hayro-syntax/Cargo.lock
+++ b/vendor/hayro-syntax/Cargo.lock
@@ -168,6 +168,7 @@ dependencies = [
  "rustc-hash",
  "sha2",
  "smallvec",
+ "stringprep",
  "zune-jpeg",
 ]
 
@@ -244,12 +245,50 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75cd3fb03d5288b3ba9a1ee103ac7e9cbb59f0b03d64f8ddfcc04dd42758a85d"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
diff --git a/vendor/hayro-syntax/SOURCE.json b/vendor/hayro-syntax/SOURCE.json
index 462194b2..800895ae 100644
--- a/vendor/hayro-syntax/SOURCE.json
+++ b/vendor/hayro-syntax/SOURCE.json
@@ -338,7 +338,7 @@
       "path": "src/xref.rs",
       "source_sha256": "51ffeeb7d4ac035bae2cd5ba9288c180088ae06cdcefe2b29dfeda560a793aa0",
       "source_git_blob": "20e33a410489d42e438a3f2b87d70c7bb8d66eae",
-      "sha256": "d5463a6d629e31a33c1d5b9a735a6e87353752dc0b4156dd84247dcf9b485804"
+      "sha256": "411ce7e3c0d385b1735f945b92dba164825456ef3b70ef464279ba0bac0879d4"
     },
     {
       "path": "src/decode_limits_tests.rs",
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index ed504128..a86a1f4a 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -887,17 +887,13 @@ fn populate_from_xref_stream<'a>(
 
     let [f1_len, f2_len, f3_len] = stream.dict().get::<[u8; 3]>(W)?;
 
-    if f2_len > size_of::<u64>() as u8 {
-        error!("xref offset length is larger than the allowed limit");
+    // PdfCraft patch: the type field may be wider than one byte (upstream behaviour); bound it.
+    if f1_len > size_of::<u64>() as u8 || f2_len > size_of::<u64>() as u8 {
+        error!("xref field length is larger than the allowed limit");
 
         return None;
     }
 
-    // Do such files exist?
-    if f1_len != 1 {
-        warn!("first field in xref stream was longer than 1");
-    }
-
     let xref_data = stream.decoded().ok()?;
     let mut xref_reader = Reader::new(xref_data.as_ref());
 
@@ -980,11 +976,12 @@ fn xref_stream_subsection<'a>(
     }
 
     for i in 0..num_elements {
+        // A zero-width type field defaults to 1 (PDF 32000-1, 7.5.8.2).
         let f_type = if f1_len == 0 {
             1
         } else {
-            // We assume a length of 1.
-            xref_reader.read_bytes(1)?[0]
+            let bytes = xref_reader.read_bytes(f1_len as usize)?;
+            bytes.iter().fold(0u64, |acc, b| (acc << 8) | *b as u64)
         };
 
         let obj_number = start + i;
@@ -1276,6 +1273,44 @@ mod tests {
         out
     }
 
+    #[test]
+    fn xref_stream_type_field_uses_the_full_w0_width() {
+        // /W [2 1 1]: two-byte type 0x0001 (normal), offset 7, gen 0.
+        let mut map = XrefMap::default();
+        let mut reader = Reader::new(&[0u8, 1, 7, 0]);
+        assert!(xref_stream_subsection(&mut reader, 5, 1, 2, 1, 1, &mut map).is_some());
+        assert!(matches!(
+            map.get(&ObjectIdentifier::new(5, 0)),
+            Some(EntryType::Normal(7))
+        ));
+    }
+
+    #[test]
+    fn xref_stream_loader_rejects_oversized_w0() {
+        // Same one-entry stream; only /W[0] differs, so the 9 must be what is refused.
+        let load = |w: &str| {
+            let data = format!(
+                "1 0 obj\n<< /Type /XRef /Size 6 /Index [5 1] /W [{w}] /Length 4 >>\nstream\n"
+            )
+            .into_bytes()
+            .into_iter()
+            .chain([0u8, 1, 7, 0])
+            .chain(*b"\nendstream\nendobj\n")
+            .collect::<Vec<u8>>();
+            let mut map = XrefMap::default();
+            let got = populate_from_xref_stream(
+                &data,
+                &mut Reader::new(&data),
+                &mut map,
+                &mut BTreeSet::new(),
+                DecodeLimits::default(),
+            );
+            got.is_some()
+        };
+        assert!(load("2 1 1"));
+        assert!(!load("9 1 1"));
+    }
+
     #[cfg(feature = "std")]
     #[test]
     fn concurrent_cold_object_stream_reads_all_succeed() {

From 9def84d7a577f0a8b6dcff115016a3bc5acbf3fe Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 23 Oct 2026 11:16:19 -0400
Subject: [PATCH 22/29] security: fallible bitmap allocation in vendored
 hayro-jbig2 (#242)

* security: fallible bitmap allocation in vendored hayro-jbig2 (follow-up to #239)

* security: reinitialize allocates before mutating the jbig2 bitmap (CodeRabbit)
---
 vendor/README.craft-reader.md    |  3 ++-
 vendor/hayro-jbig2/SOURCE.json   |  2 +-
 vendor/hayro-jbig2/src/bitmap.rs | 31 ++++++++++++++++++++++++++-----
 3 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/vendor/README.craft-reader.md b/vendor/README.craft-reader.md
index 24f9c47d..d7444ba0 100644
--- a/vendor/README.craft-reader.md
+++ b/vendor/README.craft-reader.md
@@ -50,7 +50,8 @@ Hostile-input bounds (CodeRabbit findings):
 - Each object stream's `/N` header pairs are parsed once per document and cached beside its
   decoded data, instead of on every compressed-object lookup.
 - An embedded JBIG2 page over 2^28 pixels is refused before the output buffer is allocated,
-  and that buffer is reserved fallibly. A `JBIG2Globals` stream with an image filter is
+  and that buffer is reserved fallibly (`Bitmap::reinitialize` allocates before touching the
+  existing bitmap, so a failed reservation leaves it intact). A `JBIG2Globals` stream with an image filter is
   ignored, so globals cannot recurse through further globals.
 - At most 4096 graphics states, holding at most 64 MiB together, are saved; a `q` past
   either limit is counted but not copied, and its `Q` still removes the clips added since.
diff --git a/vendor/hayro-jbig2/SOURCE.json b/vendor/hayro-jbig2/SOURCE.json
index bb9d6a70..6ff0455d 100644
--- a/vendor/hayro-jbig2/SOURCE.json
+++ b/vendor/hayro-jbig2/SOURCE.json
@@ -62,7 +62,7 @@
       "path": "src/bitmap.rs",
       "source_sha256": "59ed83d8bac6c39e40270a9856ca3faee628de7d9efae1b01f714e140e2b6b7e",
       "source_git_blob": "35ed97561597d30a70fe819cf8cfbd3780538f75",
-      "sha256": "59ed83d8bac6c39e40270a9856ca3faee628de7d9efae1b01f714e140e2b6b7e"
+      "sha256": "99dddbef5f7b36c55d0e914d07664326598919eb6d54cdfa93f300076a8ae69d"
     },
     {
       "path": "src/decode/generic.rs",
diff --git a/vendor/hayro-jbig2/src/bitmap.rs b/vendor/hayro-jbig2/src/bitmap.rs
index 35ed9756..6d1e3c55 100644
--- a/vendor/hayro-jbig2/src/bitmap.rs
+++ b/vendor/hayro-jbig2/src/bitmap.rs
@@ -7,7 +7,6 @@
 
 use crate::decode::CombinationOperator;
 use crate::error::{OverflowError, Result, bail};
-use alloc::vec;
 use alloc::vec::Vec;
 
 // To guard better against malicious files, we limit bitmap dimensions
@@ -50,6 +49,14 @@ pub(crate) struct Bitmap {
     pub(crate) y_location: u32,
 }
 
+/// PdfCraft patch: fallible replacement for `vec![word; len]` / `resize`.
+fn fill_words(data: &mut Vec<Word>, len: usize, word: Word) -> Result<()> {
+    data.try_reserve_exact(len)
+        .map_err(|_| OverflowError::BitmapDimension)?;
+    data.resize(len, word);
+    Ok(())
+}
+
 impl Bitmap {
     /// Create a new bitmap filled with white pixels (false).
     ///
@@ -76,7 +83,9 @@ impl Bitmap {
 
         let stride = width.div_ceil(WORD_BITS);
         let default_word: Word = if default_pixel { !0 } else { 0 };
-        let data = vec![default_word; stride as usize * height as usize];
+        // PdfCraft patch: reserve fallibly so hostile dimensions error instead of aborting.
+        let mut data = Vec::new();
+        fill_words(&mut data, stride as usize * height as usize, default_word)?;
         Ok(Self {
             width,
             height,
@@ -103,14 +112,15 @@ impl Bitmap {
 
         let stride = width.div_ceil(WORD_BITS);
         let default_word: Word = if default_pixel { !0 } else { 0 };
+        // Allocate first so a failed reservation leaves the bitmap untouched.
+        let mut data = Vec::new();
+        fill_words(&mut data, stride as usize * height as usize, default_word)?;
         self.width = width;
         self.height = height;
         self.stride = stride;
         self.x_location = 0;
         self.y_location = 0;
-        self.data.clear();
-        self.data
-            .resize(stride as usize * height as usize, default_word);
+        self.data = data;
 
         Ok(())
     }
@@ -225,3 +235,14 @@ impl Bitmap {
         self.data[(row * self.stride + word_idx) as usize]
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn failed_reservation_is_an_error() {
+        let mut data = Vec::new();
+        assert!(fill_words(&mut data, usize::MAX / 2, 0).is_err());
+    }
+}

From f180fc0d35d521c5d18e118c881d3efde1ec1eee Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 23 Oct 2026 11:17:51 -0400
Subject: [PATCH 23/29] Use chrono instead of hand-rolled UTC conversion (#219)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Use chrono for UTC/calendar conversion instead of hand-rolled copies

Replaces the hand-rolled civil_from_days and Day::to_days in
crates/ai-core/src/history/report.rs with chrono, added as a workspace
dependency (std-only, so ai-core still compiles for wasm). The day/month
grouping, ISO and CSV timestamps and the Day/Month display are byte-identical
and pinned by the existing tests. AGENTS.md now says time goes through chrono.

Follow-up to storytold/cadcraft#1785

* history: preserve out-of-range conversion failure in civil_from_days

civil_from_days used `i32::try_from(..).unwrap_or(0)` before calling
NaiveDate::from_num_days_from_ce_opt, so a CE day count past i32 (e.g.
from Day::from_days(i64::MAX)) passed a valid day 0 to chrono and read
as 0000-12-31 instead of the 0000-01-01 fallback the None arm gives for
every other out-of-range date. Convert with `.ok().and_then(..)` so both
the integer-conversion and NaiveDate-construction failures share the one
fallback. Regression test covers i64::MAX and i64::MIN.

Doc comments on the chrono-touched to_days/from_days/civil_from_days now
state the out-of-range behaviour (0 / 0000-01-01) for the docstring gate.

* Convert every i32 year, not only chrono's range

Day holds any i32 year, but NaiveDate stops near ±262143, so years like
262144 read as 0 / 0000-01-01. The Gregorian calendar repeats every 400
years: chrono now converts the day within its cycle and whole cycles are
added back, in both directions. Values match the pre-chrono formula
(tested for 262144, -262145, i32::MAX and i32::MIN). Nonexistent days
still read as 0, and day counts whose year doesn't fit i32 still read as 0000-01-01.

* Name the 400-year range extension as the one exception to the time rule

The rule said never to hand-roll calendar math, but the range fix
(shifting by whole 400-year Gregorian cycles so dates past chrono's year
range keep their old output) is cycle arithmetic, so the rule and the code
disagreed. The rule now names that exception: the library still computes
month, day and time, and only whole cycles are carried in the year.

* Say the library computes month and day; time-of-day is plain arithmetic

Narrows the range-extension wording: the date library computes the
calendar fields, and splitting seconds into hours, minutes and seconds
is ordinary arithmetic, which is what the code does.
---
 AGENTS.md                                  |  1 +
 Cargo.lock                                 |  1 +
 Cargo.toml                                 |  2 +
 crates/ai-core/Cargo.toml                  |  3 ++
 crates/ai-core/src/history/report.rs       | 45 +++++++++++++---------
 crates/ai-core/src/history/report/tests.rs | 16 ++++++++
 6 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 03e7ff50..e5adca3b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,5 +10,6 @@ Shared Rust libraries for the Craft Apps. The shared standards live in
 - **New crates** go in `crates/<name>`, named `craft-<name>`, inherit the workspace package fields
   and lints, and are listed in `[workspace.dependencies]`.
 - **No app code.** A crate here must be useful to more than one app and must not depend on any app.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Before merging:** `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`,
   `cargo test --workspace`.
diff --git a/Cargo.lock b/Cargo.lock
index ea00f1fb..e0e313d9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -762,6 +762,7 @@ dependencies = [
 name = "craft-ai-core"
 version = "0.1.0"
 dependencies = [
+ "chrono",
  "serde",
  "serde_json",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index da23b867..5ed66e2c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,6 +36,8 @@ rayon = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 proptest = "1"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/crates/ai-core/Cargo.toml b/crates/ai-core/Cargo.toml
index c113bd42..780f9f0e 100644
--- a/crates/ai-core/Cargo.toml
+++ b/crates/ai-core/Cargo.toml
@@ -10,6 +10,9 @@ repository.workspace = true
 [dependencies]
 serde.workspace = true
 serde_json.workspace = true
+# History day/month grouping and ISO/CSV timestamps go through chrono (no hand-rolled calendar
+# code); std-only, so ai-core still compiles for wasm.
+chrono = { workspace = true }
 
 [lints]
 workspace = true
diff --git a/crates/ai-core/src/history/report.rs b/crates/ai-core/src/history/report.rs
index d13f391b..28c69317 100644
--- a/crates/ai-core/src/history/report.rs
+++ b/crates/ai-core/src/history/report.rs
@@ -22,17 +22,18 @@ pub struct Day {
 }
 
 impl Day {
-    /// Days since 1970-01-01 (negative before it).
+    /// Days since 1970-01-01 (negative before it); a day that doesn't exist (2025-02-30) reads as 0.
     pub fn to_days(self) -> i64 {
-        let (y, m, d) = (i64::from(self.year), i64::from(self.month), i64::from(self.day));
-        let y = if m <= 2 { y - 1 } else { y };
-        let era = y.div_euclid(400);
-        let yoe = y.rem_euclid(400);
-        let doy = (153 * (if m > 2 { m - 3 } else { m + 9 }) + 2) / 5 + d - 1;
-        let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
-        era * 146_097 + doe - 719_468
+        use chrono::Datelike;
+        // chrono covers years up to about ±262143, but `Day` holds any `i32` year. The Gregorian
+        // calendar repeats every 400 years, so chrono handles the year within its cycle and
+        // whole cycles are added back.
+        let cycles = i64::from(self.year.div_euclid(400));
+        chrono::NaiveDate::from_ymd_opt(self.year.rem_euclid(400), u32::from(self.month), u32::from(self.day))
+            .map_or(0, |d| i64::from(d.num_days_from_ce()) - UNIX_EPOCH_DAYS_FROM_CE + cycles * DAYS_PER_400_YEARS)
     }
 
+    /// The calendar day at `days` since 1970-01-01; a day whose year doesn't fit `i32` reads as 0000-01-01.
     pub fn from_days(days: i64) -> Day {
         civil_from_days(days)
     }
@@ -61,18 +62,24 @@ impl fmt::Display for Month {
     }
 }
 
-/// Days since 1970-01-01 to a calendar day (proleptic Gregorian).
+/// `NaiveDate::num_days_from_ce` of 1970-01-01, so the count can be rebased onto the Unix epoch.
+const UNIX_EPOCH_DAYS_FROM_CE: i64 = 719_163;
+
+/// Days in one 400-year Gregorian cycle (the calendar repeats after it).
+const DAYS_PER_400_YEARS: i64 = 146_097;
+
+/// Days since 1970-01-01 to a calendar day (proleptic Gregorian). chrono converts the day
+/// within its 400-year cycle and whole cycles are added back as years, so every `i64` count
+/// works; a year that doesn't fit `i32` reads as 0000-01-01.
 fn civil_from_days(days: i64) -> Day {
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(m <= 2);
-    Day { year: i32::try_from(y).unwrap_or(0), month: u8::try_from(m).unwrap_or(1), day: u8::try_from(d).unwrap_or(1) }
+    use chrono::Datelike;
+    let (cycles, rest) = (days.div_euclid(DAYS_PER_400_YEARS), days.rem_euclid(DAYS_PER_400_YEARS));
+    let date = i32::try_from(rest + UNIX_EPOCH_DAYS_FROM_CE).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let year = date.and_then(|d| i32::try_from(i64::from(d.year()) + cycles * 400).ok());
+    match (date, year) {
+        (Some(d), Some(year)) => Day { year, month: u8::try_from(d.month()).unwrap_or(1), day: u8::try_from(d.day()).unwrap_or(1) },
+        _ => Day { year: 0, month: 1, day: 1 },
+    }
 }
 
 /// The calendar day of a Unix-millisecond time, at a fixed offset from UTC in minutes (east is
diff --git a/crates/ai-core/src/history/report/tests.rs b/crates/ai-core/src/history/report/tests.rs
index 919bad51..42652376 100644
--- a/crates/ai-core/src/history/report/tests.rs
+++ b/crates/ai-core/src/history/report/tests.rs
@@ -213,6 +213,22 @@ fn days_convert_to_and_from_the_epoch_count_both_ways() {
     assert_eq!(day_of(0, 0).to_days(), 0);
     assert_eq!(day_of(DAY_MS_FOR_TESTS, 0).to_days(), 1);
     assert_eq!(day_of(0, -60).to_days(), -1);
+    // A day count past what chrono can represent reads as the 0000-01-01 fallback, not a stray
+    // valid date: `i64::MAX` days would overflow the CE `i32` (which once became 0000-12-31).
+    let fallback = Day { year: 0, month: 1, day: 1 };
+    assert_eq!(Day::from_days(i64::MAX), fallback);
+    assert_eq!(Day::from_days(i64::MIN), fallback);
+    // Valid `i32` years past chrono's ±262143 still convert, both ways, as before chrono.
+    for (day, days) in [
+        (Day { year: 262_144, month: 1, day: 1 }, 95_026_602),
+        (Day { year: -262_145, month: 3, day: 1 }, -96465964),
+        (Day { year: i32::MAX, month: 12, day: 31 }, 784351576776),
+        (Day { year: i32::MIN, month: 1, day: 1 }, -784353015833),
+    ] {
+        assert_eq!(day.to_days(), days, "{day}");
+        assert_eq!(Day::from_days(days), day, "{days}");
+    }
+    assert_eq!(Day { year: 2025, month: 2, day: 30 }.to_days(), 0, "a day that doesn't exist");
 }
 
 const DAY_MS_FOR_TESTS: u64 = 86_400_000;

From 7474826f6f4637b9f9ea924a13106d398065143c Mon Sep 17 00:00:00 2001
From: aiongg <67543387+aiongg@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:42:51 -0400
Subject: [PATCH 24/29] media: craft-media review fixes (frame budget, PCM
 chunks, spec names) (#196)

* media: look up the track of each traf in a hash map

* media: bound Matroska indexing by a file-wide frame budget

Every indexed frame claims its stored bytes and at least one, so fixed-size
laces of empty frames cannot describe more frames than the file has bytes.
The frame count across tracks is capped at 2^26, the TrackEntry count at
2^16, and blocks find their track through a hash map.

* media: keep the spec spellings of Colour, ColourSpace and colourPrimaries

* media: PCM chunks stay bounded in MOV and MP4

The writer ends a PCM chunk at 1 MiB or half a second, and returns an
error past 2^32 - 1 samples in a track instead of clamping the stsz count.
The reader splits a PCM chunk above 16 MiB into several samples, so files
from writers without chunk limits read whole past 4 GiB. A sparse output
lets the tests write past 4 GiB, which also exercises the writer's co64
path.

* media: clamp max_lace_frames to 256 and round BlockDuration

* media: level-1 Matroska elements read at most the file's length in all

SeekHead entries pointing at nested elements made each one read the rest
of the file.

* media: set_sample_entry rejects a codec change

* media: the mux oracle compares stream counts before streams

* ci: media checkout does not persist credentials

* media: README lists the renames from FilmCraft and the output that differs on valid input

* media: rustfmt

* media: the stream count comparison leaves out timecode streams

* media: PCM chunks end at 1 MiB only, as ffmpeg's do

ffmpeg's PCM chunks run past half a second, so a duration limit split
remuxed chunks the source kept whole.

* media: frames and samples indexed scale with the file's length

Matroska indexes at most one frame per 8 bytes of file and ISO BMFF at most
one sample per 4 bytes, beyond the first 2^20 of each, so the sample tables
stay within about ten times the file's size. Empty fixed-size laces and
one-byte constant-size samples could make them 40 to 76 times its size.

* media: clamp the frame and sample allowances
---
 .github/workflows/media.yml                  |   4 +
 crates/media/README.md                       |  66 +++++++--
 crates/media/src/isobmff/codec.rs            |  10 +-
 crates/media/src/isobmff/demux.rs            | 146 ++++++++++++++++---
 crates/media/src/isobmff/mux.rs              |  91 +++++++++---
 crates/media/src/matroska/demux.rs           | 137 +++++++++++++----
 crates/media/src/matroska/error.rs           |   3 +
 crates/media/src/matroska/ids.rs             |   8 +-
 crates/media/src/matroska/meta.rs            |  16 +-
 crates/media/src/matroska/mux.rs             |  39 ++++-
 crates/media/src/matroska/synthetic_tests.rs |  98 ++++++++++++-
 crates/media/tests/oracle_mux.rs             |   8 +-
 crates/media/tests/roundtrip.rs              | 101 ++++++++++++-
 13 files changed, 619 insertions(+), 108 deletions(-)

diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml
index 272abab8..a9fa3213 100644
--- a/.github/workflows/media.yml
+++ b/.github/workflows/media.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
@@ -42,6 +44,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
diff --git a/crates/media/README.md b/crates/media/README.md
index f80b920d..99838ced 100644
--- a/crates/media/README.md
+++ b/crates/media/README.md
@@ -39,8 +39,42 @@ craft-media = { git = "https://github.com/storytold/craft-libs", rev = "<commit>
 The code comes from FilmCraft's `filmcraft-bitstream`, `filmcraft-isobmff` and
 `filmcraft-matroska` crates at
 [storytold/filmcraft@6c3948a](https://github.com/storytold/filmcraft/commit/6c3948a36c80e4996d924766ba7157eec4fca85e).
-Every public item keeps its name, signature and behavior for valid input, so FilmCraft can turn
-all three crates into re-exports (`pub use craft_media::isobmff::*;`). The differences:
+Public items keep their names and signatures, so FilmCraft can turn all three crates into
+re-exports (`pub use craft_media::isobmff::*;`), except for the renames below. Our own names use
+US spelling; names taken from a specification keep its spelling.
+
+Renamed:
+
+| FilmCraft | craft-media |
+|---|---|
+| `matroska::Colour` | `matroska::Color` |
+| `matroska::VideoInfo::colour` | `matroska::VideoInfo::color` |
+| `matroska::VideoInfo::colour_space` | `matroska::VideoInfo::color_space` |
+
+The element IDs `element_ids::COLOUR` and `COLOUR_SPACE` and the field
+`isobmff::VpcConfig::colour_primaries` keep the spellings of the Matroska and VP9 specifications.
+
+Output that differs on valid input:
+
+- Matroska lacing applies only to tracks with a `DefaultDuration`, and a lace ends at a timestamp
+  gap. Readers space the frames of a lace by `DefaultDuration`, so FilmCraft's laces moved frames
+  that followed a gap.
+- The sample budget covers the whole file, so a multi-track file with more than 2²⁶ samples in
+  total fails with `TooLarge` (ISO BMFF: all tracks and fragments; Matroska: all tracks, and at
+  most 2¹⁶ TrackEntries). FilmCraft capped ISO BMFF per track and Matroska not at all.
+- MOV and MP4 PCM chunks end at 1 MiB, as ffmpeg writes them; FilmCraft wrote
+  each contiguous run of one track as one chunk. The reader splits a PCM chunk above 16 MiB into
+  samples of at most 16 MiB; FilmCraft made it one sample, cut at 4 GiB.
+- MOV PCM at 65,536 Hz and above, and unsigned 16-bit PCM, is written as `lpcm` (sound
+  description v2), and signed 8-bit PCM as `twos`. FilmCraft wrote 0 Hz for the former and
+  labeled the signedness wrongly for the latter two. `raw ` under a sound handler reads as PCM.
+- Matroska `BlockDuration` is rounded to the nearest tick; FilmCraft truncated it.
+- A Matroska `TimestampScale` above 2³² is ignored, like a zero scale.
+- `matroska::MkvWriter` writes `MuxingApp` = `craft-media`, and `MuxOptions::default()` has
+  `writing_app` = `craft-media` (FilmCraft: `filmcraft-matroska` and `filmcraft`). Apps set
+  `writing_app` to their own name.
+
+Other differences:
 
 - `bitstream::BitReader::read_ue_plus` (from DeckCraft's copy) is new.
 - `isobmff::boxes` is new: FilmCraft's private box iterator and byte reader, made public (see
@@ -55,9 +89,14 @@ all three crates into re-exports (`pub use craft_media::isobmff::*;`). The diffe
 - `matroska`: a cluster timestamp above `i64::MAX` saturates at `i64::MAX` (FilmCraft wraps it to
   a negative value), and adding a block's relative timestamp saturates instead of overflowing (a
   debug-build panic in FilmCraft).
-- `matroska::MkvWriter` writes `MuxingApp` = `craft-media`, and `MuxOptions::default()` has
-  `writing_app` = `craft-media` (FilmCraft: `filmcraft-matroska` and `filmcraft`). Apps set
-  `writing_app` to their own name.
+- `matroska::Error::TooLarge` is new: indexing a file past the limits above returns it.
+- `matroska::MuxOptions::max_lace_frames` is clamped to 1 to 256; FilmCraft wrote a corrupt
+  frame count above 256.
+- `isobmff::Mp4Writer::set_sample_entry` returns an error when the new entry changes the codec,
+  the media type or the PCM frame size, and `Error::NoSuchTrack` for a bad index. FilmCraft
+  accepted any entry.
+- `isobmff::Mp4Writer::write_sample` returns an error when a track would pass 2³² − 1 samples
+  (PCM: frames), the most `stsz` can count; FilmCraft clamped the count.
 - `matroska::ByteSource` stays a separate trait from `isobmff::ByteSource`, with the same shape.
   FilmCraft implements both for one type, which a single shared trait would reject as conflicting
   impls.
@@ -109,7 +148,7 @@ let bytes = mp4.read_sample(&file, v, key)?;    // raw sample (AVCC/HVCC length-
   raw for the caller to interpret.
 - **Uncompressed PCM** (`lpcm`, `sowt`, `twos`, `in24`, `in32`, `fl32`, `fl64`, `raw `, `ipcm`, `fpcm`) is
   merged to one `Sample` per chunk (`pcm_chunked = true`), with `duration` in frames. This avoids one
-  table entry per audio frame.
+  table entry per audio frame. A chunk above 16 MiB becomes several samples of at most 16 MiB.
 
 #### Parsed boxes
 `ftyp`, `moov/mvhd`, `trak/tkhd`, `edts/elst` (v0/v1), `tref`, `mdia/mdhd` (v0/v1, ISO and Mac language
@@ -145,7 +184,8 @@ Video entries also parse `colr` (`nclx`/`nclc`/ICC), `pasp`, `clap`, `fiel`, `ga
 #### Robustness
 The parser does not panic on malformed input; every error comes back as an `Error`. Table counts are
 checked against the bytes in their box before anything is allocated. A constant-size `stsz` count is
-clamped to what fits in the file. `trun` counts are checked, and each track is capped at 2²⁶ samples.
+clamped to what fits in the file. `trun` counts are checked, and the whole file (all tracks and
+fragments) is capped at 2²⁶ samples.
 `moov`/`moof` are capped at 1 GiB. Compressed movie headers (`cmov`) are rejected with
 `Error::Unsupported`.
 
@@ -170,7 +210,8 @@ let bytes = w.finish_faststart()?.into_inner(); // or finish() for moov-at-end
 - Brands: `Brand::Mp4` writes `isom` with `isom iso2 avc1 mp41 mp42`. `Brand::Mov` writes `qt  `, uses
   QuickTime `hdlr`/Pascal names, and sets `wide` as the placeholder box.
 - Tables written: `stts`, `ctts` (v1 when an offset is negative), `stss` (omitted when every sample is
-  sync), `stsc`, `stsz` (constant or table), `stco`/`co64`. Consecutive samples of one track share a chunk.
+  sync), `stsc`, `stsz` (constant or table), `stco`/`co64`. Consecutive samples of one track share a chunk;
+  a PCM chunk ends at 1 MiB.
 - Sample entries come from `SampleEntry` (`avc`, `hevc`, `prores`, `jpeg`, `aac`, `pcm`, or any demuxed
   entry). Remuxing copies codec config, `colr`, `pasp`, `clap`, `fiel`, `gama` and `btrt`.
   PCM is written as `sowt`/`twos` (16-bit) or `raw ` (8-bit) or sound description v2 `lpcm` in MOV, and as
@@ -224,7 +265,7 @@ for b in BoxIter::new(&bytes) {
 - `sidx`/`mfra` are ignored, because the demuxer scans every top-level box. `stsd` entries with a
   QuickTime color table are not decoded.
 - Subtitle and text tracks (`tx3g`, `c608`, `wvtt`) and `mp4v` show up as `Unknown`.
-- Muxer: one `mdat`, no chunk-size or duration limits (the caller controls interleaving), no `sdtp`,
+- Muxer: one `mdat`, no chunk-size or duration limits outside PCM (the caller controls interleaving), no `sdtp`,
   `sgpd`/`sbgp` or `cslg` output, ISO-style `meta/ilst` metadata is not written, and the fragmented
   writer has no PCM, `sidx` or `mfra`.
 
@@ -274,6 +315,10 @@ while let Some(p) = d.next_packet()? {        // file order, all tracks
 - **Damage:** an undecodable or oversized element starts a byte scan for the next plausible level-1
   element (a Cluster whose first child is Timestamp, or a sized metadata element); a truncated final
   block is dropped. Problems are listed in `MkvFile::warnings`.
+- **Limits:** indexing stops with `Error::TooLarge` past 2²⁶ frames in the file, past one frame
+  per file byte (each frame counts its stored size, and at least one byte), or past 2¹⁶
+  TrackEntries. Level-1 elements read at most the file's length in all, so SeekHead entries that
+  point into one another are skipped with a warning.
 - **Seeking** (`Demuxer::seek(track, time_ns)`): uses the sample index when present, otherwise Cues
   (refined by scanning the cued cluster for the exact keyframe), otherwise builds the index by
   scanning all clusters. `Demuxer::keyframe_index(track)` returns the keyframe list.
@@ -321,7 +366,8 @@ while let Some(p) = d.next_packet()? {        // file order, all tracks
 keyframe, data, duration_ns)` per frame, then `finish()`. It writes the EBML header, Segment,
 SeekHead, Info (with Duration), Tracks, Clusters of SimpleBlocks (a new cluster at a video keyframe
 after `cluster_duration_ns`), BlockGroups for frames whose duration differs from the track's
-`default_duration_ns`, optional audio lacing (Xiph, EBML, fixed-size), and Cues (video keyframes,
+`default_duration_ns`, optional audio lacing (Xiph, EBML, fixed-size; for tracks with a
+`default_duration_ns`, at most 256 frames, ending at a timestamp gap), and Cues (video keyframes,
 or the first frame of each track per cluster). `MuxOptions::doc_type` = `"webm"` writes WebM.
 CodecPrivate is fixed when the writer is created, so a codec whose configuration arrives with the
 first frame (AV1 from `rav1e`) creates the writer after that frame.
diff --git a/crates/media/src/isobmff/codec.rs b/crates/media/src/isobmff/codec.rs
index b4935c9f..643584c0 100644
--- a/crates/media/src/isobmff/codec.rs
+++ b/crates/media/src/isobmff/codec.rs
@@ -491,7 +491,7 @@ pub struct VpcConfig {
     pub bit_depth: u8,
     pub chroma_subsampling: u8,
     pub full_range: bool,
-    pub color_primaries: u8,
+    pub colour_primaries: u8,
     pub transfer_characteristics: u8,
     pub matrix_coefficients: u8,
     pub codec_init: Vec<u8>,
@@ -512,7 +512,7 @@ impl VpcConfig {
         let profile = c.u8()?;
         let level = c.u8()?;
         let a = c.u8()?;
-        let color_primaries = c.u8()?;
+        let colour_primaries = c.u8()?;
         let transfer_characteristics = c.u8()?;
         let matrix_coefficients = c.u8()?;
         let n = c.u16()? as usize;
@@ -523,7 +523,7 @@ impl VpcConfig {
             bit_depth: a >> 4,
             chroma_subsampling: (a >> 1) & 7,
             full_range: a & 1 != 0,
-            color_primaries,
+            colour_primaries,
             transfer_characteristics,
             matrix_coefficients,
             codec_init,
@@ -535,7 +535,7 @@ impl VpcConfig {
         b.u8(self.profile);
         b.u8(self.level);
         b.u8((self.bit_depth << 4) | ((self.chroma_subsampling & 7) << 1) | self.full_range as u8);
-        b.u8(self.color_primaries);
+        b.u8(self.colour_primaries);
         b.u8(self.transfer_characteristics);
         b.u8(self.matrix_coefficients);
         b.u16(self.codec_init.len() as u16);
@@ -1651,7 +1651,7 @@ mod tests {
             bit_depth: 10,
             chroma_subsampling: 1,
             full_range: true,
-            color_primaries: 9,
+            colour_primaries: 9,
             transfer_characteristics: 16,
             matrix_coefficients: 9,
             codec_init: vec![],
diff --git a/crates/media/src/isobmff/demux.rs b/crates/media/src/isobmff/demux.rs
index 8926ddbd..f3c0d78f 100644
--- a/crates/media/src/isobmff/demux.rs
+++ b/crates/media/src/isobmff/demux.rs
@@ -8,6 +8,13 @@ use std::collections::HashMap;
 
 /// Hard cap on the sample count of the whole file, all tracks and fragments (after PCM chunk merging).
 const MAX_SAMPLES: usize = 1 << 26;
+/// Bytes of file each sample needs beyond the first `MIN_SAMPLE_ALLOWANCE` samples. A [`Sample`]
+/// takes 40 bytes of memory and a constant-size `stsz` or a `trun` without per-sample fields
+/// describes one in a byte or none, so without this a file could make the sample tables about
+/// 40 times its own size. A table-backed sample has a 4-byte `stsz` or `trun` entry.
+const FILE_BYTES_PER_SAMPLE: u64 = 4;
+/// Samples any file may hold, however short: 40 MiB of sample tables.
+const MIN_SAMPLE_ALLOWANCE: usize = 1 << 20;
 /// Hard cap on the size of an in-memory `moov`/`moof` box.
 const MAX_HEADER_BOX: u64 = 1 << 30;
 /// Most text all metadata entries may hold together; entries past it are dropped. One `keys`
@@ -16,9 +23,18 @@ const MAX_METADATA_BYTES: usize = 4 << 20;
 /// What an entry costs beyond its text, so that empty entries are bounded too.
 const METADATA_ENTRY_COST: usize = 64;
 
+/// Largest sample built from a PCM chunk; larger chunks are split. Writers that put a whole
+/// recording in one chunk would otherwise give samples past `u32::MAX` bytes.
+const PCM_MAX_SAMPLE_BYTES: u64 = 1 << 24;
+
+/// Frames in one piece of a split PCM chunk: whole units, at most `PCM_MAX_SAMPLE_BYTES`.
+fn pcm_piece_frames(unit: u64, unit_bytes: u64) -> u64 {
+    (PCM_MAX_SAMPLE_BYTES / unit_bytes.max(1)).max(1) * unit
+}
+
 /// What is left of the file-wide limits while tracks and fragments are parsed.
 struct SampleBudget {
-    /// Samples (`MAX_SAMPLES` minus those already built).
+    /// Samples (what the file's length allows, at most `MAX_SAMPLES`, minus those already built).
     samples: usize,
     /// Bytes of file for samples whose count no table entry backs (constant-size `stsz`, `trun`
     /// without per-sample fields). Each such sample claims at least one byte, so a file can't
@@ -27,6 +43,11 @@ struct SampleBudget {
 }
 
 impl SampleBudget {
+    fn new(file_len: u64) -> Self {
+        let by_len = usize::try_from(file_len / FILE_BYTES_PER_SAMPLE).unwrap_or(usize::MAX);
+        Self { samples: by_len.clamp(MIN_SAMPLE_ALLOWANCE, MAX_SAMPLES), implied_bytes: file_len }
+    }
+
     fn take(&mut self, n: usize) -> Result<()> {
         self.samples = self.samples.checked_sub(n).ok_or(Error::TooLarge("sample count"))?;
         Ok(())
@@ -345,7 +366,7 @@ pub fn open<S: ByteSource>(src: S) -> Result<Mp4File> {
             _ => {}
         }
     }
-    let mut budget = SampleBudget { samples: MAX_SAMPLES, implied_bytes: len };
+    let mut budget = SampleBudget::new(len);
     for p in trak_payloads {
         let t = parse_trak(p, &file, len, &mut budget)?;
         file.tracks.push(t);
@@ -353,8 +374,13 @@ pub fn open<S: ByteSource>(src: S) -> Result<Mp4File> {
     // Movie fragments.
     let mut next_dts: Vec<i64> =
         file.tracks.iter().map(|t| t.samples.last().map(|s| s.dts.saturating_add(i64::from(s.duration))).unwrap_or(0)).collect();
+    // A duplicate track ID resolves to its first track.
+    let mut track_index = HashMap::new();
+    for (i, t) in file.tracks.iter().enumerate() {
+        track_index.entry(t.id).or_insert(i);
+    }
     for (moof_off, moof) in &moofs {
-        parse_moof(*moof_off, moof, &mut file.tracks, &trex, &mut next_dts, &mut budget)?;
+        parse_moof(*moof_off, moof, &mut file.tracks, &track_index, &trex, &mut next_dts, &mut budget)?;
     }
     for t in &mut file.tracks {
         if file.fragmented && !moofs.is_empty() {
@@ -725,15 +751,16 @@ fn parse_stbl(stbl: &[u8], t: &mut Track, is_qt: bool, file_len: u64, budget: &m
     if let Some(p) = pcm {
         t.pcm_chunked = true;
         let a = t.audio().cloned().unwrap_or_default();
-        let frame_bytes = |frames: u64| -> u64 {
-            if a.qt_version == 1 && a.bytes_per_frame > 0 && a.samples_per_packet > 0 {
-                frames / a.samples_per_packet as u64 * a.bytes_per_frame as u64
-            } else if const_size > 1 {
-                frames * const_size as u64
-            } else {
-                frames * p.bytes_per_frame() as u64
-            }
+        // Frames come in units of `unit` frames and `unit_bytes` bytes (QuickTime v1 packets).
+        let (unit, unit_bytes) = if a.qt_version == 1 && a.bytes_per_frame > 0 && a.samples_per_packet > 0 {
+            (u64::from(a.samples_per_packet), u64::from(a.bytes_per_frame))
+        } else if const_size > 1 {
+            (1, u64::from(const_size))
+        } else {
+            (1, u64::from(p.bytes_per_frame()))
         };
+        let frame_bytes = |frames: u64| -> u64 { (frames / unit).saturating_mul(unit_bytes) };
+        let piece_frames = pcm_piece_frames(unit, unit_bytes);
         if chunks.len() > budget.samples {
             return Err(Error::TooLarge("chunk count"));
         }
@@ -746,18 +773,35 @@ fn parse_stbl(stbl: &[u8], t: &mut Track, is_qt: bool, file_len: u64, budget: &m
             if spc == 0 {
                 continue;
             }
-            let dur = stts_c.take(spc as u64);
-            let size = frame_bytes(spc as u64).min(u32::MAX as u64) as u32;
-            samples.push(Sample {
-                offset: off,
-                size,
-                dts,
-                pts: dts,
-                duration: dur.min(u32::MAX as u64) as u32,
-                is_sync: true,
-                description_index: stsc[stsc_i].2,
-            });
-            dts = dts.saturating_add(dur.min(i64::MAX as u64) as i64);
+            // A chunk past PCM_MAX_SAMPLE_BYTES becomes several samples.
+            let mut left = spc as u64;
+            let mut pos = off;
+            while left > 0 {
+                if samples.len() >= budget.samples {
+                    return Err(Error::TooLarge("sample count"));
+                }
+                let split = frame_bytes(left) > PCM_MAX_SAMPLE_BYTES;
+                let frames = if split { piece_frames } else { left };
+                let dur = stts_c.take(frames);
+                let size = frame_bytes(frames);
+                if split {
+                    // Each piece is at least half of PCM_MAX_SAMPLE_BYTES, so the file's size
+                    // bounds how many a hostile chunk size can make.
+                    budget.implied_bytes = budget.implied_bytes.checked_sub(size).ok_or(Error::TooLarge("PCM chunk size"))?;
+                }
+                samples.push(Sample {
+                    offset: pos,
+                    size: size.min(u32::MAX as u64) as u32,
+                    dts,
+                    pts: dts,
+                    duration: dur.min(u32::MAX as u64) as u32,
+                    is_sync: true,
+                    description_index: stsc[stsc_i].2,
+                });
+                dts = dts.saturating_add(dur.min(i64::MAX as u64) as i64);
+                pos = pos.saturating_add(size);
+                left -= frames;
+            }
             sidx += spc;
             if sidx >= sample_count {
                 break;
@@ -826,6 +870,7 @@ fn parse_moof(
     moof_off: u64,
     moof: &[u8],
     tracks: &mut [Track],
+    track_index: &HashMap<u32, usize>,
     trex: &HashMap<u32, Trex>,
     next_dts: &mut [i64],
     budget: &mut SampleBudget,
@@ -853,7 +898,7 @@ fn parse_moof(
         let mut c = Cur::labeled(tfhd, "tfhd");
         let (_, fl) = c.full_header()?;
         let id = c.u32()?;
-        let Some(ti) = tracks.iter().position(|t| t.id == id) else { continue };
+        let Some(&ti) = track_index.get(&id) else { continue };
         let d = trex.get(&id).copied().unwrap_or_default();
         let base = if fl & 1 != 0 {
             c.u64()?
@@ -1344,4 +1389,57 @@ mod tests {
         d[p - 4..p].copy_from_slice(&0x7FFF_FFFFu32.to_be_bytes());
         assert!(open(d.as_slice()).is_err());
     }
+    /// `data` followed by zeros up to `len` bytes.
+    struct Padded(Vec<u8>, u64);
+
+    impl ByteSource for Padded {
+        fn len(&self) -> u64 {
+            self.1
+        }
+        fn read_at(&self, offset: u64, buf: &mut [u8]) -> std::io::Result<()> {
+            buf.fill(0);
+            let start = (offset as usize).min(self.0.len());
+            let end = (start + buf.len()).min(self.0.len());
+            buf[..end - start].copy_from_slice(&self.0[start..end]);
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn samples_scale_with_the_file_length() {
+        assert_eq!(SampleBudget::new(1000).samples, MIN_SAMPLE_ALLOWANCE);
+        assert_eq!(SampleBudget::new(64 << 20).samples, 16 << 20);
+        assert_eq!(SampleBudget::new(u64::MAX).samples, MAX_SAMPLES);
+        // A constant-size stsz of one-byte samples claims as many as a 64 MiB file has bytes.
+        let d = handmade(Some((1, u32::MAX)));
+        assert!(matches!(open(Padded(d, 64 << 20)), Err(Error::TooLarge(_))));
+    }
+
+    #[test]
+    fn a_pcm_chunk_past_4_gib_reads_as_bounded_samples() {
+        use crate::isobmff::{Brand, Mp4Writer, PcmConfig, TrackConfig, WriteSample, WriterOptions};
+        let pcm = PcmConfig { bits: 8, float: false, big_endian: false, signed: false, channels: 1, sample_rate: 48000.0 };
+        let mut w = Mp4Writer::new(std::io::Cursor::new(Vec::new()), WriterOptions::new(Brand::Mov)).unwrap();
+        let t = w.add_track(TrackConfig::new(SampleEntry::pcm(pcm), 48000)).unwrap();
+        w.write_sample(t, WriteSample { data: &[0; 4], duration: 0, composition_offset: 0, is_sync: true }).unwrap();
+        let mut d = w.finish_faststart().unwrap().into_inner();
+        // One chunk of u32::MAX one-byte frames, as a writer without chunk limits makes for a
+        // 4 GiB recording.
+        let frames = u32::MAX.to_be_bytes();
+        for (kind, at) in [(b"stts", 12), (b"stsz", 12), (b"stsc", 16)] {
+            let p = d.windows(4).position(|w| w == kind).unwrap();
+            d[p + at..p + at + 4].copy_from_slice(&frames);
+        }
+        // In a file too small for it, the claim is clamped to the file.
+        let f = open(d.as_slice()).unwrap();
+        assert!(f.tracks[0].samples.iter().map(|s| u64::from(s.size)).sum::<u64>() <= d.len() as u64);
+        let len = d.len() as u64 + u64::from(u32::MAX);
+        let f = open(Padded(d, len)).unwrap();
+        let s = &f.tracks[0].samples;
+        assert_eq!(s.len(), 256);
+        assert!(s.iter().all(|s| u64::from(s.size) <= PCM_MAX_SAMPLE_BYTES));
+        assert_eq!(s.iter().map(|s| u64::from(s.size)).sum::<u64>(), u64::from(u32::MAX));
+        assert_eq!(s.iter().map(|s| u64::from(s.duration)).sum::<u64>(), u64::from(u32::MAX));
+        assert!(s.windows(2).all(|w| w[1].offset == w[0].offset + u64::from(w[0].size) && w[1].dts == w[0].dts + i64::from(w[0].duration)));
+    }
 }
diff --git a/crates/media/src/isobmff/mux.rs b/crates/media/src/isobmff/mux.rs
index 73774791..8f50d1f1 100644
--- a/crates/media/src/isobmff/mux.rs
+++ b/crates/media/src/isobmff/mux.rs
@@ -85,6 +85,18 @@ fn handler_of(e: &SampleEntry) -> Handler {
     }
 }
 
+/// The `CodecConfig` variant, and the fourcc of variants that cover several codecs.
+fn same_codec(a: &CodecConfig, b: &CodecConfig) -> bool {
+    use CodecConfig::*;
+    match (a, b) {
+        (ProRes { fourcc: x }, ProRes { fourcc: y })
+        | (Jpeg { fourcc: x }, Jpeg { fourcc: y })
+        | (Dnx { fourcc: x }, Dnx { fourcc: y })
+        | (Unknown { fourcc: x, .. }, Unknown { fourcc: y, .. }) => x == y,
+        _ => std::mem::discriminant(a) == std::mem::discriminant(b),
+    }
+}
+
 /// Accumulated sample tables for one track.
 #[derive(Clone, Debug, Default)]
 struct Tables {
@@ -109,16 +121,51 @@ impl Tables {
     fn new() -> Self {
         Tables { all_sync: true, ..Default::default() }
     }
-    fn push_run<T: PartialEq + Copy>(runs: &mut Vec<(u32, T)>, count: u32, v: T) {
+    fn push_run<T: PartialEq + Copy>(runs: &mut Vec<(u32, T)>, mut count: u64, v: T) {
         if let Some(last) = runs.last_mut()
             && last.1 == v
-            && last.0.checked_add(count).is_some()
         {
-            last.0 += count;
-            return;
+            let n = count.min(u64::from(u32::MAX - last.0));
+            last.0 += n as u32;
+            count -= n;
+        }
+        while count > 0 {
+            let n = count.min(u64::from(u32::MAX));
+            runs.push((n as u32, v));
+            count -= n;
         }
-        runs.push((count, v));
     }
+
+    /// Records `count` samples written at `offset`, `sample_bytes` each, extending the last
+    /// chunk when the write follows it. A chunk holds at most `max` samples.
+    fn push_chunks(&mut self, mut offset: u64, mut count: u64, sample_bytes: u64, contiguous: bool, max: u32) {
+        if contiguous && let Some(c) = self.chunks.last_mut() {
+            let n = count.min(u64::from(max.saturating_sub(c.1)));
+            c.1 += n as u32;
+            count -= n;
+            offset += n * sample_bytes;
+        }
+        while count > 0 {
+            let n = count.min(u64::from(max));
+            self.chunks.push((offset, n as u32));
+            count -= n;
+            offset += n * sample_bytes;
+        }
+    }
+}
+
+/// `stsz` counts samples (PCM: frames) in 32 bits.
+fn too_many_samples() -> Error {
+    Error::Mux("more than 2^32 - 1 samples in one track".into())
+}
+
+/// PCM chunk size limit, ffmpeg's: readers that take each PCM chunk as one sample (this crate's
+/// demuxer among them) get samples of bounded size.
+const PCM_CHUNK_BYTES: u64 = 1 << 20;
+
+/// Frames per PCM chunk: at most [`PCM_CHUNK_BYTES`], at least one frame.
+fn pcm_chunk_frames(frame_bytes: u32) -> u32 {
+    (PCM_CHUNK_BYTES / u64::from(frame_bytes.max(1))).max(1) as u32
 }
 
 struct WTrack {
@@ -420,11 +467,12 @@ fn write_trak(b: &mut BoxBuf, t: &WTrack, movie_ts: u32, qt: bool, shift: u64, f
         b.u32(1);
     }
     b.end(m);
+    let sample_count = u32::try_from(tb.sample_count).map_err(|_| too_many_samples())?;
     let m = b.start_full(b"stsz", 0, 0);
     match tb.const_size {
         Some(s) => {
             b.u32(s);
-            b.u32(tb.sample_count.min(u32::MAX as u64) as u32);
+            b.u32(sample_count);
         }
         None => {
             let first = tb.sizes.first().copied().unwrap_or(0);
@@ -432,10 +480,10 @@ fn write_trak(b: &mut BoxBuf, t: &WTrack, movie_ts: u32, qt: bool, shift: u64, f
             // all-empty samples must still be written as a table.
             if first != 0 && !tb.sizes.is_empty() && tb.sizes.iter().all(|&s| s == first) {
                 b.u32(first);
-                b.u32(tb.sizes.len() as u32);
+                b.u32(sample_count);
             } else {
                 b.u32(0);
-                b.u32(tb.sizes.len() as u32);
+                b.u32(sample_count);
                 for &s in &tb.sizes {
                     b.u32(s);
                 }
@@ -543,11 +591,14 @@ impl<W: Write + Seek> Mp4Writer<W> {
 
     /// Replace a track's sample entry before the file is finished (the `moov` is written last), for
     /// codecs whose configuration is only complete at the end, like the FLAC STREAMINFO in `dfLa`.
-    /// The new entry must keep the media type and, for PCM, the frame size.
+    /// The new entry must keep the codec and, for PCM, the frame size.
     pub fn set_sample_entry(&mut self, track: usize, entry: SampleEntry) -> Result<()> {
         let t = self.tracks.get_mut(track).ok_or(Error::NoSuchTrack(track))?;
-        if handler_of(&entry) != t.handler || validate_track(&entry, t.cfg.timescale)? != t.pcm_frame_bytes {
-            return Err(Error::Mux("replacement sample entry changes the track's media type or PCM layout".into()));
+        if handler_of(&entry) != t.handler
+            || !same_codec(&entry.codec, &t.cfg.entry.codec)
+            || validate_track(&entry, t.cfg.timescale)? != t.pcm_frame_bytes
+        {
+            return Err(Error::Mux("replacement sample entry changes the track's codec or PCM layout".into()));
         }
         t.cfg.entry = entry;
         Ok(())
@@ -589,7 +640,7 @@ impl<W: Write + Seek> Mp4Writer<W> {
                 if !s.data.len().is_multiple_of(fb as usize) {
                     return Err(Error::Mux("PCM data is not a whole number of frames".into()));
                 }
-                ((s.data.len() / fb as usize) as u32, 1u32)
+                (s.data.len() as u64 / u64::from(fb), 1u32)
             }
             None => {
                 if s.data.len() > u32::MAX as usize {
@@ -601,6 +652,9 @@ impl<W: Write + Seek> Mp4Writer<W> {
         if count == 0 {
             return Ok(());
         }
+        if tr.t.sample_count + count > u64::from(u32::MAX) {
+            return Err(too_many_samples());
+        }
         self.w.write_all(s.data)?;
         let offset = self.pos;
         self.pos += s.data.len() as u64;
@@ -618,13 +672,13 @@ impl<W: Write + Seek> Mp4Writer<W> {
                 t.all_sync = false;
             }
         }
-        t.sample_count += count as u64;
+        t.sample_count += count;
         let ct = if tr.pcm_frame_bytes.is_some() { 0 } else { s.composition_offset as i64 };
         t.comp_end = t.comp_end.max((t.media_duration as i64 + ct + count as i64 * dur as i64).max(0) as u64);
-        t.media_duration += count as u64 * dur as u64;
-        match t.chunks.last_mut() {
-            Some(c) if contiguous => c.1 += count,
-            _ => t.chunks.push((offset, count)),
+        t.media_duration += count * dur as u64;
+        match tr.pcm_frame_bytes {
+            Some(fb) => t.push_chunks(offset, count, u64::from(fb), contiguous, pcm_chunk_frames(fb)),
+            None => t.push_chunks(offset, count, s.data.len() as u64, contiguous, u32::MAX),
         }
         Ok(())
     }
@@ -960,6 +1014,9 @@ mod tests {
         assert!(w.set_sample_entry(a, SampleEntry::pcm(PcmConfig { big_endian: true, ..pcm })).is_ok());
         assert!(w.set_sample_entry(a, SampleEntry::pcm(PcmConfig { bits: 24, ..pcm })).is_err());
         assert!(w.set_sample_entry(a, avc_entry()).is_err());
+        let v = w.add_track(TrackConfig::new(avc_entry(), 90_000)).unwrap();
+        assert!(w.set_sample_entry(v, avc_entry()).is_ok());
+        assert!(w.set_sample_entry(v, SampleEntry::jpeg(64, 64)).is_err());
         assert!(w.set_sample_entry(f, SampleEntry::flac(&[1; 34])).is_ok());
         assert!(w.set_sample_entry(f, SampleEntry::pcm(pcm)).is_err());
         assert!(matches!(w.set_sample_entry(5, avc_entry()), Err(Error::NoSuchTrack(5))));
diff --git a/crates/media/src/matroska/demux.rs b/crates/media/src/matroska/demux.rs
index 2c95288f..15ca9dbd 100644
--- a/crates/media/src/matroska/demux.rs
+++ b/crates/media/src/matroska/demux.rs
@@ -1,6 +1,6 @@
 //! Matroska / WebM demuxer: EBML header, Segment walk, cluster scanning, packet reading, seeking.
 
-use std::collections::{HashSet, VecDeque};
+use std::collections::{HashMap, VecDeque};
 
 use crate::matroska::ebml::{self, Children, Lacing, Size, parse_lacing, read_id, read_size};
 use crate::matroska::error::{Error, Result};
@@ -12,6 +12,42 @@ use crate::matroska::track::{Sample, Track, TrackKind, gcd};
 const WIN: usize = 64 * 1024;
 /// Upper bound for level-1 metadata elements read into memory (Info, Tracks, Cues, Tags…).
 const MAX_META: u64 = 256 << 20;
+/// Cap on the frames indexed from one file, all tracks together.
+const MAX_FRAMES: usize = 1 << 26;
+/// Bytes of file each indexed frame needs beyond the first `MIN_FRAME_ALLOWANCE` frames. An
+/// indexed frame takes about 76 bytes of memory (its [`Sample`] and keyframe entry) and fixed
+/// lacing can describe one in no bytes at all, so without this a file could make the index
+/// about 76 times its own size. Real frames carry a block header or lace size and their data,
+/// well over 8 bytes each.
+const FILE_BYTES_PER_FRAME: u64 = 8;
+/// Frames any file may index, however short: about 80 MiB of index.
+const MIN_FRAME_ALLOWANCE: usize = 1 << 20;
+/// Cap on the TrackEntries of a file. Each kept entry needs only 5 bytes of file but becomes a
+/// [`Track`] of several hundred bytes.
+pub(super) const MAX_TRACKS: usize = 1 << 16;
+
+/// What is left of the file-wide limits while clusters are scanned.
+struct FrameBudget {
+    /// Frames (what the file's length allows, at most `MAX_FRAMES`, minus those already indexed).
+    frames: usize,
+    /// Bytes of file not yet claimed by a frame. Each frame claims its stored size and at least
+    /// one byte, because fixed-size lacing describes up to 256 empty frames in a 4-byte block.
+    bytes: u64,
+}
+
+impl FrameBudget {
+    fn new(file_len: u64) -> Self {
+        let by_len = usize::try_from(file_len / FILE_BYTES_PER_FRAME).unwrap_or(usize::MAX);
+        Self { frames: by_len.clamp(MIN_FRAME_ALLOWANCE, MAX_FRAMES), bytes: file_len }
+    }
+
+    fn take(&mut self, frames: &[(u64, u32)]) -> Result<()> {
+        self.frames = self.frames.checked_sub(frames.len()).ok_or(Error::TooLarge("frame count"))?;
+        let bytes = frames.iter().map(|&(_, n)| u64::from(n.max(1))).sum::<u64>();
+        self.bytes = self.bytes.checked_sub(bytes).ok_or(Error::TooLarge("frame count"))?;
+        Ok(())
+    }
+}
 
 /// Options for [`open_with`] / [`Demuxer::with_options`].
 #[derive(Clone, Debug)]
@@ -324,8 +360,15 @@ struct FrameRef {
     addition: Option<(u64, u32)>,
 }
 
-fn track_lookup(tracks: &[Track]) -> impl Fn(u64) -> Option<usize> + '_ {
-    move |n| tracks.iter().position(|t| t.number == n)
+/// Track number to track index. A duplicate number resolves to its first track.
+type TrackIndex = HashMap<u64, usize>;
+
+fn track_index(tracks: &[Track]) -> TrackIndex {
+    let mut m = HashMap::with_capacity(tracks.len());
+    for (i, t) in tracks.iter().enumerate() {
+        m.entry(t.number).or_insert(i);
+    }
+    m
 }
 
 /// A parsed block header: (track index, relative ts, flags, frames as (offset, size)).
@@ -333,12 +376,7 @@ type BlockHeader = (usize, i16, u8, Vec<(u64, u32)>);
 
 /// Parse the Block/SimpleBlock header at `data_start` (`len` bytes).
 /// Returns `None` for unknown tracks / damage.
-fn parse_block<S: ByteSource + ?Sized>(
-    io: &mut Io<'_, S>,
-    data_start: u64,
-    len: u64,
-    lookup: &dyn Fn(u64) -> Option<usize>,
-) -> Result<Option<BlockHeader>> {
+fn parse_block<S: ByteSource + ?Sized>(io: &mut Io<'_, S>, data_start: u64, len: u64, lookup: &TrackIndex) -> Result<Option<BlockHeader>> {
     let head = io.peek(data_start, 16.min(len as usize))?;
     let Some((tn, tl, _)) = ebml::read_vint(head) else { return Ok(None) };
     if head.len() < tl + 3 {
@@ -346,7 +384,7 @@ fn parse_block<S: ByteSource + ?Sized>(
     }
     let rel = i16::from_be_bytes([head[tl], head[tl + 1]]);
     let flags = head[tl + 2];
-    let Some(track) = lookup(tn) else { return Ok(None) };
+    let Some(&track) = lookup.get(&tn) else { return Ok(None) };
     let hdr = (tl + 3) as u64;
     let lacing = Lacing::from_flags(flags);
     let frames = if lacing == Lacing::None {
@@ -402,13 +440,7 @@ fn cluster_timestamp(raw: u64) -> i64 {
 }
 
 /// Parse one SimpleBlock or BlockGroup element.
-fn parse_block_elem<S: ByteSource + ?Sized>(
-    io: &mut Io<'_, S>,
-    h: &Hdr,
-    end: u64,
-    cluster_ts: i64,
-    lookup: &dyn Fn(u64) -> Option<usize>,
-) -> Result<Option<BlockRef>> {
+fn parse_block_elem<S: ByteSource + ?Sized>(io: &mut Io<'_, S>, h: &Hdr, end: u64, cluster_ts: i64, lookup: &TrackIndex) -> Result<Option<BlockRef>> {
     let ds = h.data_start();
     match h.id {
         SIMPLE_BLOCK => {
@@ -514,10 +546,10 @@ fn scan_cluster<S: ByteSource + ?Sized>(
     io: &mut Io<'_, S>,
     h: &Hdr,
     limit: u64,
-    tracks: &[Track],
+    lookup: &TrackIndex,
+    budget: &mut FrameBudget,
     warnings: &mut Vec<String>,
 ) -> Result<(ClusterInfo, Vec<BlockRef>)> {
-    let lookup = track_lookup(tracks);
     let ds = h.data_start();
     let known_end = match h.size {
         Size::Known(_) => Some(h.end(limit)),
@@ -549,7 +581,8 @@ fn scan_cluster<S: ByteSource + ?Sized>(
         match c.id {
             TIMESTAMP => ts = cluster_timestamp(ebml::uint(io.peek(c.data_start(), (ce - c.data_start()) as usize)?)),
             SIMPLE_BLOCK | BLOCK_GROUP => {
-                if let Some(b) = parse_block_elem(io, &c, ce, ts, &lookup)? {
+                if let Some(b) = parse_block_elem(io, &c, ce, ts, lookup)? {
+                    budget.take(&b.frames)?;
                     blocks.push(b);
                 }
             }
@@ -637,7 +670,7 @@ fn open_impl<S: ByteSource + ?Sized>(src: &S, opts: &OpenOptions, cache: &mut Ca
     if seg.overruns(len) {
         file.warnings.push("Segment extends past end of file (truncated)".into());
     }
-    let mut w = Walker { opts, parsed: HashSet::new(), blocks_seen: false };
+    let mut w = Walker { opts, parsed: HashMap::new(), meta_left: len, blocks_seen: false, lookup: None, budget: FrameBudget::new(len) };
     w.walk(&mut io, &mut file)?;
     finish_tracks(&mut file);
     Ok(file)
@@ -645,8 +678,15 @@ fn open_impl<S: ByteSource + ?Sized>(src: &S, opts: &OpenOptions, cache: &mut Ca
 
 struct Walker<'o> {
     opts: &'o OpenOptions,
-    parsed: HashSet<u64>,
+    /// Start and end of each level-1 element read.
+    parsed: HashMap<u64, u64>,
+    /// Bytes level-1 elements may still read or scan. Distinct elements do not overlap, so a
+    /// valid file stays within its length; SeekHead entries pointing into one another do not.
+    meta_left: u64,
     blocks_seen: bool,
+    /// Built at the first Cluster after Tracks is parsed.
+    lookup: Option<TrackIndex>,
+    budget: FrameBudget,
 }
 
 impl Walker<'_> {
@@ -674,7 +714,8 @@ impl Walker<'_> {
                             break;
                         }
                     }
-                    let (ci, blocks) = scan_cluster(io, &h, seg_end, &file.tracks, &mut file.warnings)?;
+                    let lookup = self.lookup.get_or_insert_with(|| track_index(&file.tracks));
+                    let (ci, blocks) = scan_cluster(io, &h, seg_end, lookup, &mut self.budget, &mut file.warnings)?;
                     if self.opts.verify_crc && h.size != Size::Unknown {
                         let data = io.read_vec(h.data_start(), ci.end - h.data_start())?;
                         self.check_crc(file, h.pos, &data);
@@ -720,7 +761,7 @@ impl Walker<'_> {
                 continue;
             }
             let Some(abs) = file.segment_data_start.checked_add(e.position) else { continue };
-            if self.parsed.contains(&abs) || abs >= file.segment_end {
+            if self.parsed.contains_key(&abs) || abs >= file.segment_end {
                 continue;
             }
             match io.header(abs, file.segment_end)? {
@@ -745,13 +786,24 @@ impl Walker<'_> {
 
     /// Parse a level-1 metadata element; returns its end.
     fn level1<S: ByteSource + ?Sized>(&mut self, io: &mut Io<'_, S>, file: &mut MkvFile, h: &Hdr, limit: u64) -> Result<u64> {
-        let end = if h.size == Size::Unknown { io.unknown_end(h.data_start(), limit)? } else { h.end(limit) };
+        if let Some(&end) = self.parsed.get(&h.pos) {
+            return Ok(end);
+        }
+        let end = match h.size {
+            Size::Unknown => io.unknown_end(h.data_start(), limit.min(h.data_start().saturating_add(self.meta_left)))?,
+            Size::Known(_) => h.end(limit),
+        };
+        self.parsed.insert(h.pos, end);
         if h.overruns(limit) {
             file.warnings.push(format!("element 0x{:X} at {} truncated", h.id, h.pos));
         }
-        if !self.parsed.insert(h.pos) {
+        let n = end - h.data_start();
+        if n > self.meta_left || (h.size == Size::Unknown && n == self.meta_left && end < limit) {
+            self.meta_left = 0;
+            file.warnings.push(format!("element 0x{:X} at {} overlaps elements already read; skipped", h.id, h.pos));
             return Ok(end);
         }
+        self.meta_left -= n;
         if h.id == ATTACHMENTS {
             self.attachments(io, file, h.data_start(), end)?;
             return Ok(end);
@@ -769,7 +821,11 @@ impl Walker<'_> {
             SEEK_HEAD => file.seek_head.extend(parse_seekhead(&data)),
             INFO => file.info = parse_info(&data),
             TRACKS if file.tracks.is_empty() => {
+                if Children::new(&data).filter(|e| e.id == TRACK_ENTRY).count() > MAX_TRACKS {
+                    return Err(Error::TooLarge("track count"));
+                }
                 file.tracks = parse_tracks(&data, file.info.timestamp_scale);
+                self.lookup = None;
             }
             CUES => parse_cues(&data, &mut file.cues),
             CHAPTERS => parse_chapters(&data, &mut file.chapters),
@@ -931,6 +987,7 @@ pub struct Demuxer<S> {
     file: MkvFile,
     opts: OpenOptions,
     cache: Cache,
+    lookup: TrackIndex,
     pos: u64,
     cluster: Option<InCluster>,
     pending: VecDeque<FrameRef>,
@@ -962,7 +1019,8 @@ impl<S: ByteSource> Demuxer<S> {
         let mut cache = Cache::default();
         let file = open_impl(&src, &opts, &mut cache)?;
         let pos = file.first_cluster.unwrap_or(file.segment_end);
-        Ok(Self { src, file, opts, cache, pos, cluster: None, pending: VecDeque::new(), skip_laces: None, done: false })
+        let lookup = track_index(&file.tracks);
+        Ok(Self { src, file, opts, cache, lookup, pos, cluster: None, pending: VecDeque::new(), skip_laces: None, done: false })
     }
 
     pub fn file(&self) -> &MkvFile {
@@ -989,6 +1047,7 @@ impl<S: ByteSource> Demuxer<S> {
         }
         let opts = OpenOptions { index: true, verify_crc: self.opts.verify_crc };
         self.file = open_impl(&self.src, &opts, &mut self.cache)?;
+        self.lookup = track_index(&self.file.tracks);
         Ok(())
     }
 
@@ -1076,7 +1135,8 @@ impl<S: ByteSource> Demuxer<S> {
             return Ok(None);
         }
         let mut warnings = Vec::new();
-        let (ci, blocks) = scan_cluster(&mut io, &h, self.file.segment_end, &self.file.tracks, &mut warnings)?;
+        let mut budget = FrameBudget::new(io.len);
+        let (ci, blocks) = scan_cluster(&mut io, &h, self.file.segment_end, &self.lookup, &mut budget, &mut warnings)?;
         let t = &self.file.tracks[track];
         let mut frames = Vec::new();
         for b in blocks.iter().filter(|b| b.track == track && b.keyframe) {
@@ -1139,7 +1199,7 @@ impl<S: ByteSource> Demuxer<S> {
         let seg_end = self.file.segment_end;
         let scale = self.file.info.timestamp_scale;
         let mut io = Io::new(&self.src, &mut self.cache);
-        let lookup = track_lookup(&self.file.tracks);
+        let lookup = &self.lookup;
         loop {
             if let Some(c) = self.cluster {
                 let lim = c.end.unwrap_or(seg_end);
@@ -1179,7 +1239,7 @@ impl<S: ByteSource> Demuxer<S> {
                         self.cluster = Some(InCluster { ts: v, end: c.end });
                     }
                     SIMPLE_BLOCK | BLOCK_GROUP => {
-                        if let Some(b) = parse_block_elem(&mut io, &h, he, c.ts, &lookup)? {
+                        if let Some(b) = parse_block_elem(&mut io, &h, he, c.ts, lookup)? {
                             let skip = match self.skip_laces.take() {
                                 Some((off, n)) if off == h.pos => n,
                                 _ => 0,
@@ -1236,3 +1296,20 @@ impl<S: ByteSource> Iterator for Demuxer<S> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn frames_indexed_scale_with_the_file_length() {
+        assert_eq!(FrameBudget::new(1000).frames, MIN_FRAME_ALLOWANCE);
+        // 64 MiB of file is enough bytes for 2^26 empty frames, but not enough index memory.
+        let mut b = FrameBudget::new(64 << 20);
+        assert_eq!(b.frames, 8 << 20);
+        let lace = [(0u64, 0u32); 256];
+        let taken = (0..1 << 18).take_while(|_| b.take(&lace).is_ok()).count();
+        assert_eq!(taken * lace.len(), 8 << 20);
+        assert_eq!(FrameBudget::new(u64::MAX).frames, MAX_FRAMES);
+    }
+}
diff --git a/crates/media/src/matroska/error.rs b/crates/media/src/matroska/error.rs
index 718c5c50..e3157a3d 100644
--- a/crates/media/src/matroska/error.rs
+++ b/crates/media/src/matroska/error.rs
@@ -16,6 +16,8 @@ pub enum Error {
     NoSuchTrack(usize),
     /// A sample index was out of range.
     NoSuchSample(usize),
+    /// The file describes more than the demuxer's limits allow (frames, tracks).
+    TooLarge(&'static str),
 }
 
 impl fmt::Display for Error {
@@ -27,6 +29,7 @@ impl fmt::Display for Error {
             Error::NotMatroska(s) => write!(f, "not a Matroska/WebM file: {s}"),
             Error::NoSuchTrack(i) => write!(f, "track index {i} out of range"),
             Error::NoSuchSample(i) => write!(f, "sample index {i} out of range"),
+            Error::TooLarge(s) => write!(f, "size limit exceeded: {s}"),
         }
     }
 }
diff --git a/crates/media/src/matroska/ids.rs b/crates/media/src/matroska/ids.rs
index 3c7eefd3..5998c1e2 100644
--- a/crates/media/src/matroska/ids.rs
+++ b/crates/media/src/matroska/ids.rs
@@ -107,10 +107,10 @@ pub const PIXEL_CROP_RIGHT: u32 = 0x54DD;
 pub const DISPLAY_WIDTH: u32 = 0x54B0;
 pub const DISPLAY_HEIGHT: u32 = 0x54BA;
 pub const DISPLAY_UNIT: u32 = 0x54B2;
-/// Matroska `ColourSpace`.
-pub const COLOR_SPACE: u32 = 0x2E_B524;
-/// Matroska `Colour`.
-pub const COLOR: u32 = 0x55B0;
+/// `ColourSpace`; read into [`VideoInfo::color_space`](crate::matroska::VideoInfo::color_space).
+pub const COLOUR_SPACE: u32 = 0x2E_B524;
+/// `Colour`; read into [`Color`](crate::matroska::Color).
+pub const COLOUR: u32 = 0x55B0;
 pub const PROJECTION: u32 = 0x7670;
 pub const PROJECTION_TYPE: u32 = 0x7671;
 pub const PROJECTION_POSE_YAW: u32 = 0x7673;
diff --git a/crates/media/src/matroska/meta.rs b/crates/media/src/matroska/meta.rs
index 1b559bca..4933c761 100644
--- a/crates/media/src/matroska/meta.rs
+++ b/crates/media/src/matroska/meta.rs
@@ -408,8 +408,8 @@ fn parse_video(d: &[u8]) -> VideoInfo {
             FIELD_ORDER => v.field_order = Some(u),
             STEREO_MODE => v.stereo_mode = Some(u),
             ALPHA_MODE => v.alpha_mode = u,
-            COLOR_SPACE => v.color_space = e.data.try_into().ok(),
-            COLOR => v.color = Some(parse_color(e.data)),
+            COLOUR_SPACE => v.color_space = e.data.try_into().ok(),
+            COLOUR => v.color = Some(parse_color(e.data)),
             PROJECTION => {
                 let mut p = Projection::default();
                 for x in Children::new(e.data) {
@@ -547,15 +547,19 @@ pub(crate) fn parse_tracks(d: &[u8], timestamp_scale: u64) -> Vec<Track> {
             t.audio = Some(AudioInfo::default());
         }
         // CodecPrivate may itself be header-stripped (scope bit 2 = private data)
-        for enc in &t.encodings {
+        // Prepends in list order, built in one pass: a hostile entry can list millions.
+        let mut prefix = Vec::new();
+        for enc in t.encodings.iter().rev() {
             if let ContentEncoding::HeaderStripping { bytes, scope } = enc
                 && scope & 2 != 0
             {
-                let mut p = bytes.clone();
-                p.extend_from_slice(&t.codec_private);
-                t.codec_private = p;
+                prefix.extend_from_slice(bytes);
             }
         }
+        if !prefix.is_empty() {
+            prefix.extend_from_slice(&t.codec_private);
+            t.codec_private = prefix;
+        }
         t.codec = map_codec(&t.codec_id, &t.codec_private, t.audio.as_ref());
         out.push(t);
     }
diff --git a/crates/media/src/matroska/mux.rs b/crates/media/src/matroska/mux.rs
index 8f90ed4e..f481ceac 100644
--- a/crates/media/src/matroska/mux.rs
+++ b/crates/media/src/matroska/mux.rs
@@ -64,7 +64,8 @@ pub struct MuxOptions {
     /// Start a new cluster at the next video keyframe (or any frame without video) after this long.
     pub cluster_duration_ns: u64,
     pub lacing: LacingMode,
-    /// Maximum frames per laced block.
+    /// Maximum frames per laced block. Matroska allows 1 to 256; [`MkvWriter::new`] clamps
+    /// other values into that range.
     pub max_lace_frames: usize,
     pub title: Option<String>,
     pub writing_app: String,
@@ -145,10 +146,12 @@ pub struct MkvWriter<W: Write + Seek> {
 }
 
 impl<W: Write + Seek> MkvWriter<W> {
-    pub fn new(mut w: W, tracks: Vec<TrackSpec>, opts: MuxOptions) -> Result<Self> {
+    pub fn new(mut w: W, tracks: Vec<TrackSpec>, mut opts: MuxOptions) -> Result<Self> {
         if tracks.is_empty() || opts.timestamp_scale == 0 {
             return Err(Error::Invalid("muxer needs at least one track and a non-zero timestamp scale".into()));
         }
+        // A block stores its frame count minus one in a byte.
+        opts.max_lace_frames = opts.max_lace_frames.clamp(1, 256);
         let mut out = Vec::new();
         let mut h = Vec::new();
         el_uint(&mut h, EBML_VERSION, 1);
@@ -333,7 +336,7 @@ impl<W: Write + Seek> MkvWriter<W> {
             block.extend_from_slice(data);
             let mut g = Vec::new();
             el(&mut g, BLOCK, &block);
-            el_uint(&mut g, BLOCK_DURATION, (d as i64 / scale) as u64);
+            el_uint(&mut g, BLOCK_DURATION, ((u128::from(d) + scale as u128 / 2) / scale as u128) as u64);
             if !keyframe {
                 el(&mut g, REFERENCE_BLOCK, &[0xFF]);
             }
@@ -573,6 +576,36 @@ mod tests {
         assert_eq!(got, [(0, 0, 0), (0, 100, 0), (0, 110, 1), (0, 120, 2), (0, 200, 0), (1, 300, 0), (1, 310, 0)]);
     }
 
+    #[test]
+    fn lace_size_is_clamped_to_256_frames() {
+        let mut a = TrackSpec::new(TrackKind::Audio, "A_PCM/INT/LIT");
+        a.audio = Some((48000.0, 1, Some(16)));
+        a.default_duration_ns = Some(1_000_000);
+        for lacing in [LacingMode::Xiph, LacingMode::Ebml, LacingMode::FixedOrEbml] {
+            let opts = MuxOptions { lacing, max_lace_frames: 300, ..Default::default() };
+            let mut m = MkvWriter::new(Cursor::new(Vec::new()), vec![a.clone()], opts).unwrap();
+            for i in 0..300i64 {
+                m.write_frame(0, i * 1_000_000, true, &[i as u8; 4], None).unwrap();
+            }
+            let bytes = m.finish().unwrap().into_inner();
+            let d = Demuxer::from_slice(&bytes).unwrap();
+            assert!(d.file().warnings.is_empty(), "{:?}", d.file().warnings);
+            let got: Vec<_> = d.map(|p| p.unwrap()).map(|p| (p.pts, p.lace, p.data)).collect();
+            let want: Vec<_> = (0..300i64).map(|i| (i, (i % 256) as u16, vec![i as u8; 4])).collect();
+            assert_eq!(got, want);
+        }
+    }
+
+    #[test]
+    fn block_duration_rounds_to_the_nearest_tick() {
+        let mut v = TrackSpec::new(TrackKind::Video, "V_MJPEG");
+        v.video_size = Some((16, 16));
+        let mut m = MkvWriter::new(Cursor::new(Vec::new()), vec![v], MuxOptions::default()).unwrap();
+        m.write_frame(0, 0, true, &[0; 4], Some(41_700_000)).unwrap();
+        let bytes = m.finish().unwrap().into_inner();
+        assert_eq!(Demuxer::from_slice(&bytes).unwrap().next_packet().unwrap().unwrap().duration, 42);
+    }
+
     #[test]
     fn audio_only_files_cue_each_track_once_per_cluster() {
         let mut a = TrackSpec::new(TrackKind::Audio, "A_PCM/INT/LIT");
diff --git a/crates/media/src/matroska/synthetic_tests.rs b/crates/media/src/matroska/synthetic_tests.rs
index 65fa4dde..3ec0674f 100644
--- a/crates/media/src/matroska/synthetic_tests.rs
+++ b/crates/media/src/matroska/synthetic_tests.rs
@@ -2,11 +2,13 @@
 //! header stripping, BlockGroups, Colour + mastering metadata, Chapters, Tags, Attachments, CRC-32.
 
 use crate::matroska::codec::Codec;
+use crate::matroska::demux::MAX_TRACKS;
 use crate::matroska::ebml::{self, write_id, write_unknown_size};
+use crate::matroska::error::Error;
 use crate::matroska::ids::*;
 use crate::matroska::mux::{el, el_float, el_str, el_uint};
 use crate::matroska::track::ContentEncoding;
-use crate::matroska::{Demuxer, OpenOptions, Packet, open_with};
+use crate::matroska::{ByteSource, Demuxer, OpenOptions, Packet, open_with};
 
 fn block(track: u8, rel: i16, flags: u8, data: &[u8]) -> Vec<u8> {
     let mut b = vec![0x80 | track];
@@ -64,7 +66,7 @@ fn synthetic() -> Vec<u8> {
     el_uint(&mut vid, PIXEL_HEIGHT, 1080);
     el_uint(&mut vid, DISPLAY_WIDTH, 1920);
     el_uint(&mut vid, DISPLAY_HEIGHT, 1080);
-    el(&mut vid, COLOR, &col);
+    el(&mut vid, COLOUR, &col);
     // rectangular, a quarter turn clockwise (portrait phone video)
     let mut proj = Vec::new();
     el_uint(&mut proj, PROJECTION_TYPE, 0);
@@ -349,3 +351,95 @@ fn duration_of_a_block_at_the_largest_timestamp_saturates() {
         assert_eq!(f.duration_ns(), Some(u64::MAX));
     }
 }
+
+#[test]
+fn empty_laced_frames_exhaust_the_frame_budget() {
+    // Each 7-byte SimpleBlock is a fixed-size lace of 256 empty frames.
+    let mut c = Vec::new();
+    for _ in 0..100 {
+        el(&mut c, SIMPLE_BLOCK, &block(1, 0, 0x04, &[0xFF]));
+    }
+    let r = open_with(&one_cluster(0, &c)[..], &OpenOptions::default());
+    assert!(matches!(r, Err(Error::TooLarge(_))), "{r:?}");
+    // Laces of one-byte frames are paid for by their bytes.
+    let mut c = Vec::new();
+    for _ in 0..4 {
+        let mut data = vec![0xFF];
+        data.extend_from_slice(&[0; 256]);
+        el(&mut c, SIMPLE_BLOCK, &block(1, 0, 0x04, &data));
+    }
+    let f = open_with(&one_cluster(0, &c)[..], &OpenOptions::default()).unwrap();
+    assert_eq!(f.tracks[0].samples.len(), 1024);
+}
+
+#[test]
+fn track_entries_past_the_cap_are_rejected() {
+    let file = |entries: usize| {
+        let mut f = Vec::new();
+        let mut h = Vec::new();
+        el_str(&mut h, DOC_TYPE, "matroska");
+        el(&mut f, EBML, &h);
+        write_id(&mut f, SEGMENT);
+        write_unknown_size(&mut f, 8);
+        let mut tr = Vec::new();
+        for _ in 0..entries {
+            el(&mut tr, TRACK_ENTRY, &[0xD7, 0x81, 0x02]);
+        }
+        el(&mut f, TRACKS, &tr);
+        f
+    };
+    assert_eq!(open_with(&file(3)[..], &OpenOptions::default()).unwrap().tracks.len(), 3);
+    let r = open_with(&file(MAX_TRACKS + 1)[..], &OpenOptions::default());
+    assert!(matches!(r, Err(Error::TooLarge(_))), "{r:?}");
+}
+
+/// Counts the bytes read from `data`.
+struct Counting<'a>(&'a [u8], std::cell::Cell<u64>);
+
+impl ByteSource for Counting<'_> {
+    fn len(&self) -> u64 {
+        self.0.len() as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> std::io::Result<()> {
+        self.1.set(self.1.get() + buf.len() as u64);
+        self.0.read_at(offset, buf)
+    }
+}
+
+#[test]
+fn overlapping_seek_head_targets_are_read_once() {
+    // SeekHead entries point at nested Tags headers, each running to the end of the file.
+    let (n, pad) = (64u64, 128usize << 10);
+    let entry = |pos: u64| {
+        let mut s = Vec::new();
+        el(&mut s, SEEK_ID, &TAGS.to_be_bytes());
+        el(&mut s, SEEK_POSITION, &pos.to_be_bytes());
+        let mut o = Vec::new();
+        el(&mut o, SEEK, &s);
+        o
+    };
+    let seek_head = |first: u64| {
+        let entries: Vec<u8> = (0..n).flat_map(|i| entry(first + i * 12)).collect();
+        let mut o = Vec::new();
+        el(&mut o, SEEK_HEAD, &entries);
+        o
+    };
+    let mut f = Vec::new();
+    let mut h = Vec::new();
+    el_str(&mut h, DOC_TYPE, "matroska");
+    el(&mut f, EBML, &h);
+    write_id(&mut f, SEGMENT);
+    write_unknown_size(&mut f, 8);
+    let first = seek_head(0).len() as u64;
+    f.extend_from_slice(&seek_head(first));
+    let total = n * 12 + pad as u64;
+    for i in 0..n {
+        write_id(&mut f, TAGS);
+        ebml::write_size(&mut f, total - (i + 1) * 12, 8);
+    }
+    f.resize(f.len() + pad, 0xEC);
+    let src = Counting(&f, std::cell::Cell::new(0));
+    let file = open_with(&src, &OpenOptions { index: false, verify_crc: false }).unwrap();
+    assert_eq!(file.seek_head.len(), n as usize);
+    assert!(src.1.get() <= 4 * f.len() as u64, "read {} bytes of a {}-byte file", src.1.get(), f.len());
+}
diff --git a/crates/media/tests/oracle_mux.rs b/crates/media/tests/oracle_mux.rs
index 9a235884..1294965a 100644
--- a/crates/media/tests/oracle_mux.rs
+++ b/crates/media/tests/oracle_mux.rs
@@ -93,6 +93,7 @@ fn stream_packets(path: &Path) -> Option<Vec<Vec<Value>>> {
 /// Compare ffprobe's view of two files (per-stream packets: pts, dts, size, key flag).
 fn assert_same_packets(a: &Path, b: &Path) {
     let (Some(pa), Some(pb)) = (stream_packets(a), stream_packets(b)) else { return };
+    assert_eq!(pa.len(), pb.len(), "stream count {} vs {}", a.display(), b.display());
     for (i, (x, y)) in pa.iter().zip(&pb).enumerate() {
         let key = |p: &Value| (int(&p["pts"]), int(&p["dts"]), int(&p["size"]), p["flags"].as_str().map(|f| f.starts_with('K')));
         let kx: Vec<_> = x.iter().map(key).collect();
@@ -106,10 +107,11 @@ fn assert_same_packets(a: &Path, b: &Path) {
 
 fn assert_same_streams(a: &Path, b: &Path) {
     let (Some(sa), Some(sb)) = (streams(a), streams(b)) else { return };
+    // Timecode (data) streams are compared by the tests that add them.
+    let media = |s: Vec<Value>| s.into_iter().filter(|x| x["codec_type"] != "data").collect::<Vec<_>>();
+    let (sa, sb) = (media(sa), media(sb));
+    assert_eq!(sa.len(), sb.len(), "stream count {} vs {}", a.display(), b.display());
     for (x, y) in sa.iter().zip(&sb) {
-        if x["codec_type"] == "data" {
-            continue;
-        }
         for k in ["codec_name", "width", "height", "sample_rate", "channels", "nb_frames", "duration_ts", "time_base", "profile", "pix_fmt"] {
             assert_eq!(x[k], y[k], "stream field {k}");
         }
diff --git a/crates/media/tests/roundtrip.rs b/crates/media/tests/roundtrip.rs
index 95fc88e3..1f21680b 100644
--- a/crates/media/tests/roundtrip.rs
+++ b/crates/media/tests/roundtrip.rs
@@ -2,7 +2,8 @@
 
 use craft_media::isobmff::*;
 use proptest::prelude::*;
-use std::io::Cursor;
+use std::collections::BTreeMap;
+use std::io::{Cursor, Seek, SeekFrom, Write};
 
 #[derive(Clone, Debug)]
 struct S {
@@ -164,9 +165,9 @@ fn sample_lookup() {
 }
 
 #[test]
-fn large_offsets_use_co64_and_largesize_mdat() {
-    // Files > 4 GiB are impractical in tests, so patch a small file into the same layout the
-    // writer produces for them: co64 chunk offsets and a 16-byte large-size mdat header.
+fn patched_co64_and_largesize_mdat_are_read() {
+    // A small file patched into the layout of a file past 4 GiB: co64 chunk offsets and a
+    // 16-byte large-size mdat header.
     let mut moov = Vec::new();
     let mut w = Mp4Writer::new(Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4)).unwrap();
     let t = w.add_track(TrackConfig::new(entry(3), 30)).unwrap();
@@ -221,3 +222,95 @@ fn all_empty_samples_roundtrip() {
         assert!(f.tracks[0].samples.iter().all(|s| s.size == 0));
     }
 }
+
+/// An output that keeps only writes under 1 MiB and reads everything else as zeros, so tests can
+/// write files past 4 GiB from a reused zero buffer.
+#[derive(Default)]
+struct Sparse {
+    pos: u64,
+    len: u64,
+    kept: BTreeMap<u64, Vec<u8>>,
+}
+
+impl Write for Sparse {
+    fn write(&mut self, b: &[u8]) -> std::io::Result<usize> {
+        let end = self.pos + b.len() as u64;
+        self.kept.retain(|&at, _| at < self.pos || at >= end);
+        if b.len() < 1 << 20 {
+            self.kept.insert(self.pos, b.to_vec());
+        }
+        self.pos += b.len() as u64;
+        self.len = self.len.max(self.pos);
+        Ok(b.len())
+    }
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+impl Seek for Sparse {
+    fn seek(&mut self, to: SeekFrom) -> std::io::Result<u64> {
+        self.pos = match to {
+            SeekFrom::Start(p) => p,
+            SeekFrom::End(d) => self.len.checked_add_signed(d).unwrap(),
+            SeekFrom::Current(d) => self.pos.checked_add_signed(d).unwrap(),
+        };
+        Ok(self.pos)
+    }
+}
+
+impl ByteSource for Sparse {
+    fn len(&self) -> u64 {
+        self.len
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> std::io::Result<()> {
+        buf.fill(0);
+        let end = offset + buf.len() as u64;
+        for (&at, data) in &self.kept {
+            let (lo, hi) = (at.max(offset), (at + data.len() as u64).min(end));
+            if lo < hi {
+                buf[(lo - offset) as usize..(hi - offset) as usize].copy_from_slice(&data[(lo - at) as usize..(hi - at) as usize]);
+            }
+        }
+        Ok(())
+    }
+}
+
+const MIB: usize = 1 << 20;
+
+#[test]
+fn writer_uses_co64_and_largesize_mdat_past_4_gib() {
+    let zeros = vec![0u8; MIB];
+    let mut w = Mp4Writer::new(Sparse::default(), WriterOptions::new(Brand::Mp4)).unwrap();
+    let t = w.add_track(TrackConfig::new(entry(3), 30)).unwrap();
+    let n = 4 * 1024 + 1;
+    for _ in 0..n {
+        w.write_sample(t, WriteSample { data: &zeros, duration: 1, composition_offset: 0, is_sync: true }).unwrap();
+    }
+    w.write_sample(t, WriteSample { data: b"abc", duration: 1, composition_offset: 0, is_sync: true }).unwrap();
+    let out = w.finish().unwrap();
+    let f = open(&out).unwrap();
+    let s = &f.tracks[0].samples;
+    assert_eq!(s.len(), n + 1);
+    assert!(s[n].offset > u64::from(u32::MAX));
+    assert_eq!(f.read_sample(&out, 0, n).unwrap(), b"abc");
+}
+
+#[test]
+fn pcm_past_4_gib_reads_back_whole() {
+    let pcm = PcmConfig { bits: 16, float: false, big_endian: true, signed: true, channels: 2, sample_rate: 48000.0 };
+    let zeros = vec![0u8; MIB];
+    let mut w = Mp4Writer::new(Sparse::default(), WriterOptions::new(Brand::Mov)).unwrap();
+    let t = w.add_track(TrackConfig::new(SampleEntry::pcm(pcm), 48000)).unwrap();
+    let writes = 4 * 1024 + 1;
+    for _ in 0..writes {
+        w.write_sample(t, WriteSample { data: &zeros, duration: 0, composition_offset: 0, is_sync: true }).unwrap();
+    }
+    let out = w.finish().unwrap();
+    let f = open(&out).unwrap();
+    let s = &f.tracks[0].samples;
+    let bytes = (writes * MIB) as u64;
+    assert_eq!(s.iter().map(|s| u64::from(s.size)).sum::<u64>(), bytes);
+    assert_eq!(s.iter().map(|s| u64::from(s.duration)).sum::<u64>(), bytes / 4);
+    assert!(s.iter().all(|s| s.size <= 1 << 20));
+}

From f97c84d2734c77f7dce7074a7bd789284c979b12 Mon Sep 17 00:00:00 2001
From: aiongg <67543387+aiongg@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:52:41 -0400
Subject: [PATCH 25/29] media: fixes from FilmCraft's copy (NAL widths, RBSP
 stop bits) (#245)

* media: reject NAL length prefix widths outside 1 to 4

length_prefixed_nals returns BitError::InvalidNalLengthSize for any other
width before scanning, empty data included. A width of 5 or more was
accepted and shifted bytes out of the length; a zero width returned Eof
only for non-empty data. Width 3 still splits, since
(lengthSizeMinusOne & 3) + 1 can be 3.

From filmcraft#2953.

* media: find the RBSP stop bit once per BitReader

BitReader::new records the position of the last set bit, and
more_rbsp_data compares against it instead of scanning back over the
data's zero suffix on every call (once per macroblock in a slice
parser). FilmCraft caches it in a Cell on first use; computing it in
new keeps BitReader Sync.

From filmcraft#2880.

* media: test the order CodecPrivate stripped headers are restored in

Header-stripping encodings with private-data scope prepend their bytes in
list order, so the last one listed ends up first. Empty prefixes and
frame-only scopes leave CodecPrivate as it is.

From filmcraft#2911.
---
 crates/media/README.md            |  5 +--
 crates/media/src/bitstream.rs     | 60 +++++++++++++++++--------------
 crates/media/src/matroska/meta.rs | 30 ++++++++++++++++
 3 files changed, 67 insertions(+), 28 deletions(-)

diff --git a/crates/media/README.md b/crates/media/README.md
index 99838ced..a408f04d 100644
--- a/crates/media/README.md
+++ b/crates/media/README.md
@@ -83,8 +83,9 @@ Other differences:
   without a debug assertion: `peek` and `read_bits` return the low 32 bits of the field (use
   `read_bits_u64` for wide fields), and `write_bits` writes leading zero bits, at most 64 bits in
   all.
-- `bitstream::length_prefixed_nals` returns `BitError::Eof` for a zero `length_size` on non-empty
-  data and cannot overflow on a hostile length prefix.
+- `bitstream::length_prefixed_nals` returns the new `BitError::InvalidNalLengthSize` for a
+  `length_size` outside 1 to 4 (as FilmCraft does since filmcraft#2953) and cannot overflow on a
+  hostile length prefix.
 - `isobmff::PcmConfig::bytes_per_frame` saturates at `u32::MAX` for a hostile channel count.
 - `matroska`: a cluster timestamp above `i64::MAX` saturates at `i64::MAX` (FilmCraft wraps it to
   a negative value), and adding a block's relative timestamp saturates instead of overflowing (a
diff --git a/crates/media/src/bitstream.rs b/crates/media/src/bitstream.rs
index f56f3619..adf166ca 100644
--- a/crates/media/src/bitstream.rs
+++ b/crates/media/src/bitstream.rs
@@ -13,6 +13,8 @@ pub enum BitError {
     Eof,
     /// An Exp-Golomb code longer than 32 leading zeros.
     InvalidExpGolomb,
+    /// An AVCC/HVCC NAL length prefix width outside 1 to 4 bytes.
+    InvalidNalLengthSize,
 }
 
 impl fmt::Display for BitError {
@@ -20,6 +22,7 @@ impl fmt::Display for BitError {
         match self {
             BitError::Eof => f.write_str("unexpected end of bitstream"),
             BitError::InvalidExpGolomb => f.write_str("invalid Exp-Golomb code"),
+            BitError::InvalidNalLengthSize => f.write_str("NAL length prefix must be 1 to 4 bytes"),
         }
     }
 }
@@ -33,11 +36,15 @@ pub struct BitReader<'a> {
     data: &'a [u8],
     /// Position in bits.
     pos: usize,
+    /// Bit position of the last set bit (the `rbsp_stop_one_bit`), found once so that
+    /// [`Self::more_rbsp_data`] does not rescan a long zero suffix on every call.
+    rbsp_stop: Option<usize>,
 }
 
 impl<'a> BitReader<'a> {
     pub fn new(data: &'a [u8]) -> Self {
-        Self { data, pos: 0 }
+        let rbsp_stop = data.iter().rposition(|&b| b != 0).map(|i| i.saturating_mul(8).saturating_add(7 - data[i].trailing_zeros() as usize));
+        Self { data, pos: 0, rbsp_stop }
     }
     pub fn data(&self) -> &'a [u8] {
         self.data
@@ -167,22 +174,7 @@ impl<'a> BitReader<'a> {
 
     /// H.264/HEVC `more_rbsp_data()`: true if there is data before the rbsp trailing bits.
     pub fn more_rbsp_data(&self) -> bool {
-        let total = self.data.len().saturating_mul(8);
-        if self.pos >= total {
-            return false;
-        }
-        // find last set bit (the rbsp_stop_one_bit)
-        let mut last = None;
-        for (i, &b) in self.data.iter().enumerate().rev() {
-            if b != 0 {
-                last = Some(i.saturating_mul(8).saturating_add(7 - b.trailing_zeros() as usize));
-                break;
-            }
-        }
-        match last {
-            Some(stop) => self.pos < stop,
-            None => false,
-        }
+        self.rbsp_stop.is_some_and(|stop| self.pos < stop)
     }
 }
 
@@ -335,15 +327,16 @@ pub fn annexb_nals(data: &[u8]) -> Vec<&[u8]> {
     out
 }
 
-/// Split a length-prefixed sample (AVCC/HVCC, `length_size` 1/2/4 bytes) into NAL units.
-/// A zero `length_size` cannot split non-empty data and returns [`BitError::Eof`].
+/// Split a length-prefixed sample (AVCC/HVCC, `length_size` 1 to 4 bytes) into NAL units.
+/// Any other `length_size` returns [`BitError::InvalidNalLengthSize`], even for empty data.
 pub fn length_prefixed_nals(data: &[u8], length_size: usize) -> Result<Vec<&[u8]>> {
+    if !(1..=4).contains(&length_size) {
+        return Err(BitError::InvalidNalLengthSize);
+    }
     let mut out = Vec::new();
     let mut i = 0;
     while i < data.len() {
-        // Compare against the remaining length so a hostile prefix cannot overflow `usize`
-        // (32-bit on wasm).
-        if length_size == 0 || length_size > data.len() - i {
+        if length_size > data.len() - i {
             return Err(BitError::Eof);
         }
         let mut len = 0usize;
@@ -472,6 +465,19 @@ mod tests {
         assert!(!r.more_rbsp_data());
     }
 
+    #[test]
+    fn more_rbsp_data_finds_the_stop_bit_before_a_zero_suffix() {
+        let mut d = vec![0b1010_0000];
+        d.resize(1 << 16, 0);
+        let mut r = BitReader::new(&d);
+        assert_eq!(r.rbsp_stop, Some(2));
+        assert!(r.more_rbsp_data());
+        r.skip(2).unwrap();
+        assert!(!r.more_rbsp_data());
+        assert_eq!(BitReader::new(&[0; 4]).rbsp_stop, None);
+        assert!(!BitReader::new(&[0; 4]).more_rbsp_data());
+    }
+
     #[test]
     fn crc() {
         assert_eq!(crc32(b"123456789"), 0xCBF4_3926);
@@ -490,13 +496,15 @@ mod tests {
     }
 
     #[test]
-    fn length_prefixed_rejects_zero_width_and_oversized_length() {
-        assert_eq!(length_prefixed_nals(&[], 0).unwrap(), Vec::<&[u8]>::new());
-        assert_eq!(length_prefixed_nals(&[1, 2, 3], 0), Err(BitError::Eof));
+    fn length_prefixed_rejects_invalid_width_and_oversized_length() {
+        for size in [0, 5, 8, usize::MAX] {
+            assert_eq!(length_prefixed_nals(&[], size), Err(BitError::InvalidNalLengthSize), "size {size}");
+            assert_eq!(length_prefixed_nals(&[0; 16], size), Err(BitError::InvalidNalLengthSize), "size {size}");
+        }
+        // `(lengthSizeMinusOne & 3) + 1` can be 3; such samples still split.
         assert_eq!(length_prefixed_nals(&[0, 0, 1, 7], 3).unwrap(), vec![&[7u8][..]]);
         assert_eq!(length_prefixed_nals(&[0xFF, 0xFF, 0xFF, 0xFF, 1], 4), Err(BitError::Eof));
         assert_eq!(length_prefixed_nals(&[0, 0, 0, 1, 9], 4).unwrap(), vec![&[9u8][..]]);
-        assert_eq!(length_prefixed_nals(&[0, 1], usize::MAX), Err(BitError::Eof));
     }
 
     #[test]
diff --git a/crates/media/src/matroska/meta.rs b/crates/media/src/matroska/meta.rs
index 4933c761..8cf80248 100644
--- a/crates/media/src/matroska/meta.rs
+++ b/crates/media/src/matroska/meta.rs
@@ -590,6 +590,36 @@ mod metadata_depth_tests {
         assert!(matches!(&refused[..], [ContentEncoding::Compression { algo: 3, .. }]), "{refused:?}");
     }
 
+    fn track_with_private(private: &[u8], strips: &[(&[u8], u64)]) -> Track {
+        let mut encs = Vec::new();
+        for &(bytes, scope) in strips {
+            let mut comp = Vec::new();
+            el_uint(&mut comp, CONTENT_COMP_ALGO, 3);
+            el(&mut comp, CONTENT_COMP_SETTINGS, bytes);
+            let mut enc = Vec::new();
+            el_uint(&mut enc, CONTENT_ENCODING_SCOPE, scope);
+            el(&mut enc, CONTENT_COMPRESSION, &comp);
+            el(&mut encs, CONTENT_ENCODING, &enc);
+        }
+        let mut te = Vec::new();
+        el_uint(&mut te, TRACK_NUMBER, 1);
+        el(&mut te, CODEC_ID, b"V_TEST");
+        el(&mut te, CODEC_PRIVATE, private);
+        el(&mut te, CONTENT_ENCODINGS, &encs);
+        let mut tracks = Vec::new();
+        el(&mut tracks, TRACK_ENTRY, &te);
+        let mut parsed = parse_tracks(&tracks, 1_000_000);
+        assert_eq!(parsed.len(), 1);
+        parsed.remove(0)
+    }
+
+    #[test]
+    fn codec_private_stripped_headers_are_restored_in_reverse_order() {
+        let strips: [(&[u8], u64); 4] = [(b"first", 2), (b"", 2), (b"second", 2), (b"frame", 1)];
+        assert_eq!(track_with_private(b"private", &strips).codec_private, b"secondfirstprivate");
+        assert_eq!(track_with_private(b"private", &[(b"frame", 1)]).codec_private, b"private");
+    }
+
     #[test]
     fn deeply_nested_chapters_stop_at_depth_limit() {
         // Unknown-size elements make every pair the sole child of the previous ChapterAtom.

From 4ecda6fa8c060293697d3f69a037abe00fd7785f Mon Sep 17 00:00:00 2001
From: Martin Ball <martin.ball@ucscaregroup.co.uk>
Date: Fri, 23 Oct 2026 21:11:48 +0100
Subject: [PATCH 26/29] i18n: parse each locale lazily on first lookup

I18n::new keeps the embedded text and parses nothing; a locale's rows
are parsed on the first lookup that reaches it (also as a fallback) and
its bad rows logged with log::warn!. new returns only the locale-level
problems. check_all parses every locale and returns all problems.
name() scans for the language.name row instead of parsing the locale.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                 |   1 +
 crates/i18n/Cargo.toml     |   1 +
 crates/i18n/README.md      |  10 +-
 crates/i18n/src/catalog.rs |   2 +-
 crates/i18n/src/lib.rs     | 181 +++++++++++++++++++++++++++++++------
 5 files changed, 163 insertions(+), 32 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e0e313d9..1b9bf783 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -791,6 +791,7 @@ name = "craft-i18n"
 version = "0.1.0"
 dependencies = [
  "intl_pluralrules",
+ "log",
  "sys-locale",
  "unic-langid",
 ]
diff --git a/crates/i18n/Cargo.toml b/crates/i18n/Cargo.toml
index 45e21775..9a9b97e9 100644
--- a/crates/i18n/Cargo.toml
+++ b/crates/i18n/Cargo.toml
@@ -10,6 +10,7 @@ repository.workspace = true
 [dependencies]
 intl_pluralrules = "=7.0.2"
 unic-langid = "0.9"
+log = "0.4"
 sys-locale = "0.3"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
diff --git a/crates/i18n/README.md b/crates/i18n/README.md
index df337971..63000a04 100644
--- a/crates/i18n/README.md
+++ b/crates/i18n/README.md
@@ -20,8 +20,8 @@ include!(concat!(env!("OUT_DIR"), "/craft_i18n.rs")); // pub static CRAFT_I18N:
 
 pub static I18N: LazyLock<craft_i18n::I18n> = LazyLock::new(|| {
     let offered: Vec<&str> = LANGUAGES.iter().map(|l| l.code).collect(); // the app's own list
-    let (i18n, problems) = craft_i18n::I18n::new(CRAFT_I18N, &offered);
-    problems.iter().for_each(|p| log::warn!("translation catalog: {p}; that string shows in English"));
+    let (i18n, problems) = craft_i18n::I18n::new(CRAFT_I18N, &offered); // parses nothing yet
+    problems.iter().for_each(|p| log::warn!("translation catalog: {p}"));
     i18n
 });
 
@@ -51,8 +51,10 @@ The app keeps its `tl!` macro, its language setting (`"auto"` → `I18N.system_l
   placeholders, filled in one pass.
 - **Bad rows** (malformed, an unknown `@` context, a wrong plural form count, a row defined twice,
   of which the first is kept) and bad locales (`en`, `pseudo`, a code embedded twice in any case)
-  are skipped and returned by `I18n::new` for the app to log; craft-i18n's CI rejects them before
-  they ship.
+  are skipped; craft-i18n's CI rejects them before they ship. `I18n::new` parses nothing: it
+  returns the bad locales, and each locale's rows are parsed (and its bad rows logged with
+  `log::warn!`) on the first lookup that reaches it, including as a fallback. `I18n::check_all()`
+  parses every locale and returns all problems (`<locale>/<common|app>: line N: …`), for a test.
 - **Plurals:** forms are listed in CLDR order (zero, one, two, few, many, other) for the categories
   whole numbers 0 to 1000 reach, from `intl_pluralrules`; a count in any other category takes the
   last form. CLDR's `pt` is Brazilian, so `pt` uses `pt-PT`'s rules (0 is plural) and `pt-br`
diff --git a/crates/i18n/src/catalog.rs b/crates/i18n/src/catalog.rs
index 50d731b2..0cb51e36 100644
--- a/crates/i18n/src/catalog.rs
+++ b/crates/i18n/src/catalog.rs
@@ -37,7 +37,7 @@ pub(crate) fn parse(text: &str, forms: usize) -> (Vec<Entry>, Vec<String>) {
     (rows, problems)
 }
 
-fn parse_row(text: &str, forms: usize) -> Result<Entry, String> {
+pub(crate) fn parse_row(text: &str, forms: usize) -> Result<Entry, String> {
     let columns: Vec<&str> = text.split('\t').collect();
     let [context, source, translation] = columns.as_slice() else {
         return Err(format!("{} columns; expected 3", columns.len()));
diff --git a/crates/i18n/src/lib.rs b/crates/i18n/src/lib.rs
index 7fa7a4ef..16a7c0e7 100644
--- a/crates/i18n/src/lib.rs
+++ b/crates/i18n/src/lib.rs
@@ -31,7 +31,14 @@ impl Lang {
 /// One locale's translations: context → source text → translation, app rows over shared ones.
 struct Locale {
     code: String,
-    rows: HashMap<String, HashMap<String, String>>,
+    /// The shared and the app's catalog text, parsed on first use.
+    shared: &'static str,
+    app: &'static str,
+    /// Plural forms `@plural` rows must list, for [`catalog::parse`].
+    forms: usize,
+    parsed: OnceLock<Parsed>,
+    /// [`I18n::name`], read from the text on first use.
+    name: OnceLock<Option<String>>,
     /// Itself, then its parent without the region if that is embedded too (`pt-br`, `pt`;
     /// `zh-hant-hk`, `zh-hant`). Empty for English and the pseudo locale.
     chain: Vec<usize>,
@@ -42,7 +49,49 @@ struct Locale {
     plural: Option<(PluralRules, Vec<PluralCategory>)>,
 }
 
-/// The embedded catalogs, ready for lookups. Build it once, at start-up.
+/// A locale's rows, app over shared, and what was wrong with the catalogs it came from.
+struct Parsed {
+    rows: HashMap<String, HashMap<String, String>>,
+    problems: Vec<String>,
+}
+
+impl Locale {
+    /// The rows; the catalogs are parsed on the first call and any problems logged then.
+    fn parsed(&self) -> &Parsed {
+        self.parsed.get_or_init(|| {
+            let mut problems = Vec::new();
+            let mut rows: HashMap<String, HashMap<String, String>> = HashMap::new();
+            for (name, text) in [("common", self.shared), ("app", self.app)] {
+                let (entries, errors) = catalog::parse(text, self.forms);
+                problems.extend(errors.into_iter().map(|e| format!("{}/{name}: {e}", self.code)));
+                for e in entries {
+                    rows.entry(e.context).or_default().insert(e.source, e.translation);
+                }
+            }
+            problems.iter().for_each(|p| log::warn!("translation catalog: {p}; that string shows in English"));
+            Parsed { rows, problems }
+        })
+    }
+
+    /// The `@id language.name` row of the app's catalog, else the shared one, found by scanning the
+    /// text so the locale needn't be parsed.
+    fn language_name(&self) -> Option<&str> {
+        self.name
+            .get_or_init(|| {
+                [self.app, self.shared].into_iter().find_map(|text| {
+                    let text = text.strip_prefix('\u{feff}').unwrap_or(text);
+                    text.split('\n')
+                        .filter(|line| line.starts_with("@id\tlanguage.name\t"))
+                        .find_map(|line| catalog::parse_row(line.strip_suffix('\r').unwrap_or(line), self.forms).ok())
+                        .map(|row| row.translation)
+                })
+            })
+            .as_deref()
+    }
+}
+
+/// The embedded catalogs, ready for lookups. Build it once, at start-up. Each locale is parsed on
+/// its first lookup, which is also when its bad rows are logged.
 pub struct I18n {
     locales: Vec<Locale>,
     /// Marked strings for the pseudo locale by source text, leaked so lookups can hand out `&str`.
@@ -55,10 +104,11 @@ pub struct I18n {
 }
 
 impl I18n {
-    /// Read `embedded`, offering the locales in `offered` (any case; the app's own language list),
-    /// so an app never offers a language its interface isn't ready for (right to left, say). Rows
-    /// and locales that can't be used are skipped and come back as problems
-    /// (`<locale>/<common|app>: line N: …`) for the app to log.
+    /// Index `embedded` without parsing it, offering the locales in `offered` (any case; the app's
+    /// own language list), so an app never offers a language its interface isn't ready for (right
+    /// to left, say). Locales that can't be used are skipped and come back as problems for the app
+    /// to log. A locale's bad rows are logged (`log::warn!`) when it is first looked up in, and
+    /// [`I18n::check_all`] lists them all.
     pub fn new(embedded: &'static Embedded, offered: &[&str]) -> (I18n, Vec<String>) {
         let mut problems = Vec::new();
         let mut locales = vec![bare("en"), bare("pseudo")];
@@ -73,16 +123,8 @@ impl I18n {
                 problems.push(format!("{code}: no plural rules; plurals show in English"));
             }
             let forms = plural.as_ref().map_or(1, |(_, c)| c.len());
-            let mut rows: HashMap<String, HashMap<String, String>> = HashMap::new();
-            for (name, text) in [("common", shared), ("app", app)] {
-                let (entries, errors) = catalog::parse(text, forms);
-                problems.extend(errors.into_iter().map(|e| format!("{code}/{name}: {e}")));
-                for e in entries {
-                    rows.entry(e.context).or_default().insert(e.source, e.translation);
-                }
-            }
             let offered = offered.iter().any(|o| o.eq_ignore_ascii_case(&code));
-            locales.push(Locale { code, rows, chain: Vec::new(), plural, offered });
+            locales.push(Locale { code, shared, app, forms, parsed: OnceLock::new(), name: OnceLock::new(), chain: Vec::new(), plural, offered });
         }
         for i in 2..locales.len() {
             let mut chain = vec![i];
@@ -105,6 +147,12 @@ impl I18n {
         (I18n { locales, pseudo: Mutex::default(), system: OnceLock::new() }, problems)
     }
 
+    /// Parse every locale and list every problem, `<locale>/<common|app>: line N: …`, for a test or
+    /// an audit; the same ones [`I18n::new`] leaves to lookups to log.
+    pub fn check_all(&self) -> Vec<String> {
+        self.locales.iter().flat_map(|l| l.parsed().problems.iter().cloned()).collect()
+    }
+
     /// The language with this code (any case): `en`, an offered locale, or in debug builds
     /// `pseudo`.
     pub fn from_code(&self, code: &str) -> Option<Lang> {
@@ -167,7 +215,7 @@ impl I18n {
             .iter()
             .find_map(|&i| {
                 let locale = self.locales.get(i)?;
-                let forms = locale.rows.get("@plural")?.get(&key)?;
+                let forms = locale.parsed().rows.get("@plural")?.get(&key)?;
                 let (rules, categories) = locale.plural.as_ref()?;
                 let category = rules.select(n).ok()?;
                 // A category whole numbers up to 1000 never reach (French `many`) takes the last form.
@@ -190,13 +238,14 @@ impl I18n {
         std::iter::once(Lang::EN).chain(embedded.into_iter().map(Lang)).collect()
     }
 
-    /// The language's name in itself, for a language picker: its shared catalog's
-    /// `@id language.name` row, or the code when there is none.
+    /// The language's name in itself, for a language picker: its `@id language.name` row (the
+    /// app's catalog over the shared one), or the code when there is none. Doesn't parse the
+    /// locale.
     pub fn name(&self, lang: Lang) -> &str {
         if lang == Lang::EN {
             return "English";
         }
-        self.locale(lang).and_then(|l| l.rows.get("@id")?.get("language.name")).map_or_else(|| self.code(lang), String::as_str)
+        self.locale(lang).and_then(Locale::language_name).unwrap_or_else(|| self.code(lang))
     }
 
     /// Whether the language is written right to left. Putting text into display order is the
@@ -255,7 +304,7 @@ impl I18n {
     fn find(&self, lang: Lang, keys: &[(&str, &str)]) -> Option<&str> {
         let chain = self.locale(lang).map(|l| l.chain.as_slice())?;
         chain.iter().find_map(|&i| {
-            let rows = &self.locales.get(i)?.rows;
+            let rows = &self.locales.get(i)?.parsed().rows;
             keys.iter().find_map(|(context, source)| rows.get(*context)?.get(*source).map(String::as_str))
         })
     }
@@ -360,7 +409,17 @@ fn is_region(subtag: &str) -> bool {
 
 /// A locale with no catalogs (English, the pseudo locale).
 fn bare(code: &str) -> Locale {
-    Locale { code: code.to_owned(), rows: HashMap::new(), chain: Vec::new(), plural: None, offered: false }
+    Locale {
+        code: code.to_owned(),
+        shared: "",
+        app: "",
+        forms: 1,
+        parsed: OnceLock::new(),
+        name: OnceLock::new(),
+        chain: Vec::new(),
+        plural: None,
+        offered: false,
+    }
 }
 
 /// `code`'s CLDR cardinal rules and the categories whole numbers 0..=1000 reach, in CLDR order
@@ -398,6 +457,15 @@ fn rank(c: &PluralCategory) -> u8 {
 mod tests {
     use super::*;
 
+    impl I18n {
+        /// The embedded locales parsed so far, by code.
+        fn parsed(&self) -> Vec<&str> {
+            let mut codes: Vec<&str> = self.locales.iter().skip(2).filter(|l| l.parsed.get().is_some()).map(|l| l.code.as_str()).collect();
+            codes.sort_unstable();
+            codes
+        }
+    }
+
     static E: &Embedded = &[
         ("fr", "\tSave\tEnregistrer\n\tOpen\tOuvrir\nmenu\tOpen\tOuvrir le menu\n@id\tfile.save\tEnregistrer le fichier\n", "\tSave\tSauvegarder\n"),
         ("pt", "\tSave\tGuardar\n\tUndo\tDesfazer\n", ""),
@@ -461,11 +529,9 @@ mod tests {
 
     #[test]
     fn bad_rows_skipped_and_reported() {
-        let (i, problems) = all(E);
-        assert_eq!(problems.len(), 2, "{problems:?}");
-        assert!(problems[0].starts_with("de/common: line 1:"), "{problems:?}");
-        assert!(problems[1].starts_with("de/common: line 2:"), "{problems:?}");
+        let i = i18n();
         assert_eq!(i.t(lang(&i, "de"), "Undo"), "Rückgängig");
+        assert_eq!(i.check_all().len(), 2);
     }
 
     #[test]
@@ -703,8 +769,8 @@ mod tests {
 
     #[test]
     fn duplicate_row_keeps_the_first() {
-        let (i, problems) = all(&[("fr", "\tSave\tEnregistrer\n\tSave\tSauver\n", "")]);
-        assert_eq!(problems, ["fr/common: line 2: defined twice (same context and source text); the first is kept"]);
+        let i = all(&[("fr", "\tSave\tEnregistrer\n\tSave\tSauver\n", "")]).0;
+        assert_eq!(i.check_all(), ["fr/common: line 2: defined twice (same context and source text); the first is kept"]);
         assert_eq!(i.t(lang(&i, "fr"), "Save"), "Enregistrer");
     }
 
@@ -740,6 +806,67 @@ mod tests {
         assert!(i.languages().into_iter().skip(1).all(|l| i.rtl(l)));
     }
 
+    #[test]
+    fn check_all_reports_every_bad_row() {
+        let (i, problems) = all(E);
+        assert!(i.parsed().is_empty(), "new parses nothing");
+        assert!(problems.iter().all(|p| !p.contains("line")), "{problems:?}");
+        let found = i.check_all();
+        assert_eq!(found.len(), 2, "{found:?}");
+        assert!(found[0].starts_with("de/common: line 1:"), "{found:?}");
+        assert!(found[1].starts_with("de/common: line 2:"), "{found:?}");
+        assert_eq!(i.check_all(), found);
+        assert_eq!(i.parsed(), ["de", "fr", "pt", "pt-br"]);
+    }
+
+    #[test]
+    fn lookup_parses_only_what_it_reaches() {
+        static LAZY: &Embedded = &[
+            ("pt", "\tUndo\tDesfazer\n", ""),
+            ("pt-br", "\tSave\tSalvar\n", ""),
+            ("de", "\tUndo\tRückgängig\n", ""),
+            ("fr", "\tUndo\tAnnuler\n", ""),
+        ];
+        let i = all(LAZY).0;
+        assert!(i.parsed().is_empty());
+        assert_eq!(i.t(lang(&i, "pt-br"), "Save"), "Salvar");
+        assert_eq!(i.parsed(), ["pt-br"]);
+        assert_eq!(i.t(lang(&i, "pt-br"), "Undo"), "Desfazer");
+        assert_eq!(i.parsed(), ["pt", "pt-br"]);
+        assert_eq!(i.t(lang(&i, "pt-br"), "Undo"), "Desfazer");
+        assert_eq!(i.parsed(), ["pt", "pt-br"]);
+        assert_eq!(i.t(Lang::EN, "Undo"), "Undo");
+        assert_eq!(i.t(Lang::PSEUDO, "Undo"), "⟦Undo⟧");
+        assert_eq!(i.parsed(), ["pt", "pt-br"]);
+    }
+
+    #[test]
+    fn name_reads_escapes_without_parsing() {
+        let i = all(&[("fr", "@id\tlanguage.name\tFran\\\\ais\\tx\n", ""), ("de", "\tA\tB\n@id\tlanguage.name\tDeutsch\n", "")]).0;
+        assert_eq!(i.name(lang(&i, "fr")), "Fran\\ais\tx");
+        assert_eq!(i.name(lang(&i, "de")), "Deutsch");
+        assert!(i.parsed().is_empty());
+    }
+
+    #[test]
+    fn app_name_overrides_shared() {
+        let i = all(&[
+            ("fr", "@id\tlanguage.name\tFrançais\n", "@id\tlanguage.name\tFrançais (app)\n"),
+            ("de", "@id\tlanguage.name\tDeutsch\n", "\tA\tB\n"),
+            ("es", "", ""),
+        ])
+        .0;
+        assert_eq!(i.name(lang(&i, "fr")), "Français (app)");
+        assert_eq!(i.name(lang(&i, "de")), "Deutsch");
+        assert_eq!(i.name(lang(&i, "es")), "es");
+    }
+
+    #[test]
+    fn i18n_is_send_and_sync() {
+        fn check<T: Send + Sync>() {}
+        check::<I18n>();
+    }
+
     /// Prints what this machine reports, so CI logs show `system_lang` on each platform.
     #[test]
     fn system_lang_reads_the_system() {

From f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4 Mon Sep 17 00:00:00 2001
From: aiongg <67543387+aiongg@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:14:41 -0400
Subject: [PATCH 27/29] media: QuickTime v2 sound entries refuse channel counts
 and lpcm bit depths past 16 bits (#246)

From DeckCraft 6873a25.
---
 crates/media/src/isobmff/codec.rs | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/crates/media/src/isobmff/codec.rs b/crates/media/src/isobmff/codec.rs
index 643584c0..a0f63962 100644
--- a/crates/media/src/isobmff/codec.rs
+++ b/crates/media/src/isobmff/codec.rs
@@ -1009,6 +1009,9 @@ pub(crate) fn parse_sample_entry(format: FourCc, payload: &[u8], handler: FourCc
             let _size_of_struct = c.u32()?;
             a.sample_rate = c.f64()?;
             a.channels = c.u32()?;
+            if a.channels > u32::from(u16::MAX) {
+                return Err(Error::Invalid(format!("QuickTime v2 sound entry with {} channels", a.channels)));
+            }
             let _always = c.u32()?;
             a.const_bits_per_channel = c.u32()?;
             a.lpcm_flags = c.u32()?;
@@ -1052,7 +1055,7 @@ pub(crate) fn parse_sample_entry(format: FourCc, payload: &[u8], handler: FourCc
             },
             b"ac-3" => CodecConfig::Ac3 { dac3: get(b"dac3").unwrap_or(&[]).to_vec() },
             b"ec-3" => CodecConfig::Eac3 { dec3: get(b"dec3").unwrap_or(&[]).to_vec() },
-            b"lpcm" | b"sowt" | b"twos" | b"in24" | b"in32" | b"fl32" | b"fl64" | b"raw " | b"NONE" => CodecConfig::Pcm(qt_pcm(f, &a)),
+            b"lpcm" | b"sowt" | b"twos" | b"in24" | b"in32" | b"fl32" | b"fl64" | b"raw " | b"NONE" => CodecConfig::Pcm(qt_pcm(f, &a)?),
             b"ipcm" | b"fpcm" => {
                 let mut pcm = PcmConfig {
                     bits: a.sample_size,
@@ -1078,11 +1081,12 @@ pub(crate) fn parse_sample_entry(format: FourCc, payload: &[u8], handler: FourCc
     Ok(SampleEntry { format, data_reference_index, codec: unknown(), video: None, audio: None, bitrate: None })
 }
 
-fn qt_pcm(f: &[u8; 4], a: &AudioParams) -> PcmConfig {
+fn qt_pcm(f: &[u8; 4], a: &AudioParams) -> Result<PcmConfig> {
     let mut p = PcmConfig { channels: a.channels, sample_rate: a.sample_rate, signed: true, ..Default::default() };
     match f {
         b"lpcm" => {
-            p.bits = a.const_bits_per_channel as u16;
+            p.bits = u16::try_from(a.const_bits_per_channel)
+                .map_err(|_| Error::Invalid(format!("lpcm with {} bits per channel", a.const_bits_per_channel)))?;
             p.float = a.lpcm_flags & 1 != 0;
             p.big_endian = a.lpcm_flags & 2 != 0;
             p.signed = a.lpcm_flags & 4 != 0 || p.float;
@@ -1113,7 +1117,7 @@ fn qt_pcm(f: &[u8; 4], a: &AudioParams) -> PcmConfig {
         }
         _ => {}
     }
-    p
+    Ok(p)
 }
 
 fn parse_btrt(p: &[u8]) -> Result<BitRate> {
@@ -1733,8 +1737,19 @@ mod tests {
         assert_eq!(PcmConfig { bits: 16, channels: u32::MAX, ..Default::default() }.bytes_per_frame(), u32::MAX);
         let ok = parse_sample_entry(FourCc(*b"lpcm"), &qt_v2_lpcm(2, 16), FourCc(*b"soun"), true).unwrap();
         assert!(matches!(ok.codec, CodecConfig::Pcm(p) if p.bytes_per_frame() == 4));
-        let hostile = parse_sample_entry(FourCc(*b"lpcm"), &qt_v2_lpcm(u32::MAX, 16), FourCc(*b"soun"), true).unwrap();
-        assert!(matches!(hostile.codec, CodecConfig::Pcm(p) if p.bytes_per_frame() == u32::MAX));
+    }
+
+    #[test]
+    fn qt_v2_pcm_rejects_channels_and_bits_past_16_bits() {
+        let entry = |channels, bits| parse_sample_entry(FourCc(*b"lpcm"), &qt_v2_lpcm(channels, bits), FourCc(*b"soun"), true);
+        assert!(matches!(entry(u32::MAX, 16), Err(Error::Invalid(_))));
+        assert!(matches!(entry(65_536, 16), Err(Error::Invalid(_))));
+        assert!(entry(65_535, 16).is_ok());
+        // 0x0001_0010 would read as 16-bit PCM, and 0x0001_0000 would fall back to the sample size.
+        assert!(matches!(entry(2, 0x0001_0010), Err(Error::Invalid(_))));
+        assert!(matches!(entry(2, 0x0001_0000), Err(Error::Invalid(_))));
+        let ok = entry(2, 24).unwrap();
+        assert!(matches!(ok.codec, CodecConfig::Pcm(p) if p.bits == 24));
     }
 
     #[test]

From 562aa90af513935173eacc29cdb3152648cf9749 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 23 Oct 2026 16:51:10 -0400
Subject: [PATCH 28/29] ci(sonar): don't cancel superseded runs on main, so
 coverage is published

---
 .github/workflows/sonarcloud.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index ecee45a6..e78fe1ea 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -11,7 +11,8 @@ permissions:
 
 concurrency:
   group: sonarcloud-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   sonarcloud:

From f7cc8a7df15e824b02cf73859567a6242d3a7de4 Mon Sep 17 00:00:00 2001
From: Martin Ball <martin.ball@ucscaregroup.co.uk>
Date: Fri, 23 Oct 2026 22:11:30 +0100
Subject: [PATCH 29/29] i18n: row-problem log and README name precedence
 (review)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/i18n/README.md  | 4 ++--
 crates/i18n/src/lib.rs | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/i18n/README.md b/crates/i18n/README.md
index 63000a04..c2ce066b 100644
--- a/crates/i18n/README.md
+++ b/crates/i18n/README.md
@@ -60,8 +60,8 @@ The app keeps its `tl!` macro, its language setting (`"auto"` → `I18N.system_l
   last form. CLDR's `pt` is Brazilian, so `pt` uses `pt-PT`'s rules (0 is plural) and `pt-br`
   `pt`'s. `intl_pluralrules` is pinned to the version craft-i18n's checker uses, and
   `plural_form_counts` holds the same counts.
-- **Names:** a language's name comes from its shared catalog's `@id language.name` row, else its
-  code; English is "English".
+- **Names:** a language's name comes from the app catalog's `@id language.name` row, else the
+  shared catalog's, else its code; English is "English".
 - **Right to left:** `rtl` is true for `ar`, `ckb`, `dv`, `fa`, `he`, `ps`, `sd`, `ug`, `ur` and
   `yi`; putting text into display order is the app's job.
 - **System locale:** `system_lang` matches the system's list once and caches it: on desktop Unix
diff --git a/crates/i18n/src/lib.rs b/crates/i18n/src/lib.rs
index 16a7c0e7..c040d074 100644
--- a/crates/i18n/src/lib.rs
+++ b/crates/i18n/src/lib.rs
@@ -68,7 +68,7 @@ impl Locale {
                     rows.entry(e.context).or_default().insert(e.source, e.translation);
                 }
             }
-            problems.iter().for_each(|p| log::warn!("translation catalog: {p}; that string shows in English"));
+            problems.iter().for_each(|p| log::warn!("translation catalog: {p}; row skipped"));
             Parsed { rows, problems }
         })
     }