diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..2408084cf
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"
diff --git a/.config/nextest.toml b/.config/nextest.toml
new file mode 100644
index 000000000..63e594472
--- /dev/null
+++ b/.config/nextest.toml
@@ -0,0 +1,14 @@
+# `cargo nextest run` (used by `cargo xtask ci`) runs every test in a process of its own, in parallel.
+
+[test-groups]
+# NVENC sessions are a limited resource on consumer GPUs.
+nvenc = { max-threads = 1 }
+
+[[profile.default.overrides]]
+filter = "package(filmcraft-platform) and (binary(/nvenc/) or test(/nvenc/))"
+test-group = "nvenc"
+
+# A throughput gate: it measures one core's speed, so nothing else runs beside it.
+[[profile.default.overrides]]
+filter = "package(filmcraft-render) and binary(mixer_perf)"
+threads-required = "num-test-threads"
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 000000000..9f817afcc
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,71 @@
+name: Bug report
+description: Report a reproducible problem in FilmCraft.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please report one problem per issue and search existing issues first.
+        For security vulnerabilities, follow [SECURITY.md](https://github.com/storytold/filmcraft/blob/main/SECURITY.md) instead of posting sensitive details here.
+  - type: input
+    id: version
+    attributes:
+      label: FilmCraft version or commit
+      description: Copy the version from Help > About FilmCraft, or give the commit if built from source.
+      placeholder: "0.8.0"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and architecture
+      placeholder: "Windows 11 x64, macOS 15 Apple silicon, Ubuntu 24.04 x86_64, or browser and version"
+    validations:
+      required: true
+  - type: dropdown
+    id: build
+    attributes:
+      label: Installation type
+      options:
+        - Official installer
+        - Portable archive or AppImage
+        - Flatpak
+        - Web app
+        - Built from source
+        - Other or unknown
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Start from opening a project. Include the panel, tool, menu item, or command used.
+      placeholder: |
+        1. Open or create...
+        2. Select...
+        3. Observe...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include any error message and whether it happens every time.
+    validations:
+      required: true
+  - type: textarea
+    id: document
+    attributes:
+      label: Media, sequence, export, and hardware details
+      description: If relevant, include container/codec, resolution, frame rate, bit depth/HDR, sequence settings, export preset, GPU/driver, and hardware decoding or encoding settings.
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Screenshots, logs, or a minimal sample
+      description: Optional. Remove secrets, personal paths, and private project or media content. Attach only files you have permission to share; do not attach malicious files.
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 000000000..b50e72031
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/storytold/filmcraft/blob/main/SECURITY.md
+    about: Read the reporting guidance before sharing sensitive details or malicious files.
+  - name: Community help
+    url: https://discord.gg/artcraft
+    about: Ask usage questions and discuss FilmCraft workflows with the community.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 000000000..b5e0055f1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,33 @@
+name: Feature request
+description: Suggest an improvement to a FilmCraft workflow.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please search existing issues and describe one feature per request.
+        For usage questions, visit the [community chat](https://discord.gg/artcraft).
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem or workflow
+      description: What are you trying to accomplish, and what gets in the way?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Requested behavior
+      description: Describe how the feature would work from the user's point of view.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives or workarounds
+      description: What have you tried, and where does it fall short?
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Optional examples, related issues, or your platform/version if relevant. Share only material you have permission to publish.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..69f8850e3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+      timeout-minutes: 120
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libasound2-dev
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 0139df440..dc78b3ae0 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -5,17 +5,19 @@
 # golden-image tests need tools and a GPU the VM doesn't have.)
 name: FreeBSD
 
-# The VM build takes an hour or more, so it runs nightly on main rather than on every push or
-# dependency change: a drifted dependency still shows up within a day. PRs that change the
-# FreeBSD packaging itself still run it.
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
-  schedule:
-    - cron: "37 2 * * *"
+  push:
+    branches: [release]
   pull_request:
     paths:
       - .github/workflows/freebsd.yml
       - packaging/freebsd/**
       - packaging/env.sh
+  schedule:
+    - cron: "37 2 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -30,6 +32,6 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       skip-tests: true
       run-package-check: true
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 18392587a..2fe7cd3ac 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -18,16 +18,44 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  eval:
+  git-sources:
+    name: Git dependencies come from storytold
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
-      - name: nix flake check --no-build
+      - name: Git dependencies come from storytold
         run: |
-          if [ -f flake.nix ]; then
-            nix flake check --no-build --all-systems
-          else
-            echo "No flake.nix present in this repository; skipping check."
-          fi
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
+
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 436210aef..0724495e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     with:
       app-name: filmcraft
       app-title: FilmCraft
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 000000000..e78fe1ea3
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,21 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 7666423a1..7934c954d 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -4,19 +4,18 @@
 # out for now: PdfCraft saw an intermittent access violation in egui UI tests there.)
 name: Windows ARM64
 
+# The package build takes about 15 minutes, so it runs nightly on main and on pushes to `release`
+# rather than on every push to main: a dependency or runner-image change still shows up within a
+# day. PRs that change the Windows packaging itself still run it.
 on:
+  schedule:
+    - cron: "41 4 * * *"
   push:
-    branches: [main]
+    branches: [release]
   pull_request:
     paths:
-      - Cargo.toml
-      - Cargo.lock
-      - "**/Cargo.toml"
-      - "**/build.rs"
       - .github/workflows/windows-arm64.yml
       - packaging/windows/**
-  schedule:
-    - cron: "41 4 * * 1" # weekly, so drift in the runner images shows up
   workflow_dispatch:
 
 concurrency:
diff --git a/AGENTS.md b/AGENTS.md
index 0683cb87a..aa6160f08 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -124,9 +124,19 @@ See [§0](#0-never-crash). It outranks every other engineering rule.
 
 ### 3.2 The rest
 
+**Invariant — move identity uniqueness:** A move plan lists each clip identity at most once.
+The core move operation rejects repeated ids before mutation or id allocation; placing one identity
+on multiple tracks makes selection and later identity-based editing ambiguous. Copies receive new ids
+and retain each entry's requested destination. Destination track creation and the edit commit together.
+In an idle session, a rejected duplicate move retains the project and its undo and redo history.
+Selection-derived edit plans keep each identity once in first-occurrence order before expanding
+linked partners; explicit move requests with repeated identities are still rejected.
+
 See `CLAUDE.md`: pure Rust, dependency layering (`cargo xtask layers`), exact `Tick` time, everything is
 a command, everything is agent-drivable, and the quality gates (`cargo xtask ci`) before every commit.
 
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
+
 
 Shared real-file test corpora (Photoshop-authored PSDs, etc.) live in
 [`storytold/photocraft-corpus`](https://github.com/storytold/photocraft-corpus), explained in
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index ecf54ad37..20428896a 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -29,7 +29,7 @@ iconography, images or other Adobe assets; open licences only; every asset attri
 | `docs/images/filmcraft-keyframes.png` | FilmCraft contributors | Original work: FilmCraft screenshot; frames from Night of the Living Dead (1968, public domain) | MIT OR Apache-2.0; film frames public domain |
 | `docs/images/filmcraft-export.png` | FilmCraft contributors | Original work: FilmCraft screenshot; frame from Night of the Living Dead (1968, public domain) | MIT OR Apache-2.0; film frames public domain |
 | `docs/images/filmcraft-assembly.png` | FilmCraft contributors | Original work: FilmCraft screenshot; frames from Carnival of Souls (1962), Night of the Living Dead (1968), thumbnails of all demo media | MIT OR Apache-2.0; film frames public domain |
-| `docs/images/filmcraft-lumetri.png` | FilmCraft contributors | Original work: FilmCraft UI crop (Lumetri Color panel) | MIT OR Apache-2.0 |
+| `docs/images/filmcraft-color-panel.png` | FilmCraft contributors | Original work: FilmCraft UI crop (color grading panel) | MIT OR Apache-2.0 |
 | `docs/images/filmcraft-scopes.png` | FilmCraft contributors | Original work: FilmCraft UI crop (scopes of a Charade (1963) frame, public domain) | MIT OR Apache-2.0 |
 | `docs/images/filmcraft-effects.png` | FilmCraft contributors | Original work: FilmCraft screenshot crop; NASA Earth Views (US Government work, public domain) | MIT OR Apache-2.0; footage public domain |
 | `docs/images/filmcraft-timeline.png` | FilmCraft contributors | Original work: FilmCraft UI crop; thumbnails from Night of the Living Dead (1968) and Carnival of Souls (1962), CC0 Chopin waveform | MIT OR Apache-2.0; film frames public domain |
@@ -131,6 +131,10 @@ carry each font's licence as `OFL-<family>.txt`.
 | BIZ UDPGothic Regular, Bold (Morisawa) | Japanese UI text; Japanese fallback for sans titles (the web build embeds only Regular) | OFL-1.1 |
 | Shippori Mincho Regular (FONTDASU) | Japanese fallback for serif titles (native builds) | OFL-1.1 |
 | BIZ UDMincho Regular (Morisawa) | Japanese fallback for serif titles (native builds) | OFL-1.1 |
+| Noto Sans CJK SC Regular (Google, Adobe) | Chinese UI text and media names; Chinese fallback for titles (native builds) | OFL-1.1 |
+| Noto Sans Arabic Regular (Google) | Arabic UI text; Arabic fallback for titles (native builds) | OFL-1.1 |
+| Noto Sans Thai Regular (Google) | Thai fallback for titles (native builds) | OFL-1.1 |
+| Noto Sans Georgian Regular (Google) | Georgian fallback for titles (native builds) | OFL-1.1 |
 
 ## First-party brand marks
 
@@ -169,3 +173,12 @@ SHA-256 (`crates/speech/src/models.rs`, `docs/transcripts.md`).
 | Asset | Author | Source | Licence |
 |---|---|---|---|
 | Whisper tiny / base / small speech-recognition weights (`model.safetensors`, `config.json`, `generation_config.json`, `tokenizer.json`) | OpenAI | `https://huggingface.co/openai/whisper-{tiny,base,small}` (revisions `169d4a43…`, `e37978b9…`, `973afd24…`); weights released with `https://github.com/openai/whisper` | MIT (weights and code, github.com/openai/whisper); the Hugging Face conversion is labelled Apache-2.0 |
+
+## egui dependency fonts
+
+| Asset | Author | Source | Licence | Use |
+|---|---|---|---|---|
+| `epaint_default_fonts::EGUI_ICONS`, `epaint_default_fonts::EMOJI_ICON` (dependency font inputs) | John Slegers | [egui 6d518fc7](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [emoji-icon-font](https://github.com/jslegers/emoji-icon-font) | MIT (Copyright (c) 2014 John Slegers; full upstream text in `NOTICE`) | egui-icons.ttf is the five-glyph subset, included by default_fonts independently of monochrome_emoji_fonts; emoji-icon-font.ttf is the full monochrome fallback. Dependency assets unmodified here; no font file copied into this repository. |
+| `epaint_default_fonts::UBUNTU_LIGHT` (dependency font input) | Canonical Ltd. | [egui 6d518fc7](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts) | Ubuntu Font Licence 1.0 (Copyright 2011 Canonical Ltd.; full upstream text in `NOTICE`) | Ubuntu-Light.ttf is egui's default proportional fallback, included by `default_fonts`; `system_fonts` is not enabled. Dependency asset unmodified here; no font file copied into this repository. |
+| `epaint_default_fonts::NOTO_EMOJI_REGULAR` (dependency font input) | The Noto Project Authors (Google) | [egui 6d518fc7](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [Noto Emoji](https://fonts.google.com/noto/specimen/Noto+Emoji) | OFL-1.1 (Copyright 2013 Google Inc.; full upstream text in `NOTICE`) | NotoEmoji-Regular.ttf is the monochrome emoji fallback, included because the workspace enables `monochrome_emoji_fonts`. Dependency asset unmodified here; no font file copied into this repository. |
+| `epaint_default_fonts::HACK_REGULAR` (dependency font input) | Source Foundry Authors; Bitstream Inc.; DejaVu contributors | [egui 6d518fc7](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [Hack](https://github.com/source-foundry/Hack) | MIT (Copyright (c) 2018 Source Foundry Authors) and the Bitstream Vera License (Copyright (c) 2003 Bitstream, Inc.); the DejaVu work is public domain; full upstream notices in `NOTICE` | Hack-Regular.ttf is egui's default monospace fallback, included by `default_fonts`. Dependency asset unmodified here; no font file copied into this repository. |
diff --git a/CLAUDE.md b/CLAUDE.md
index 2ecdacc20..d28a9b06b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,6 +16,7 @@ FilmCraft is a clean-room, open-source, pure-Rust non-linear video editor target
 - **Pure Rust** in the product. OS media APIs only via Rust bindings in `crates/platform` (hardware decoding; the one crate allowed `unsafe`, see `AGENTS.md` §0.3 and `docs/adr/0001-platform-ffi.md`), optional, behind traits, with our decoders as the fallback.
 - **Layering** ([`docs/architecture.md`](docs/architecture.md) §1, enforced by `cargo xtask layers`): nothing below L5 depends on egui/eframe/winit/rfd/cpal. L0 codec/container crates depend only on `filmcraft-bitstream`.
 - **Exact time:** all time is `filmcraft_time::Tick` (254 016 000 000/s). Never use f64 seconds for edit math.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Everything is a command** (`crates/engine`): id, label, menu path, shortcut, params, enabled(), run(). UI, CLI, control channel and MCP all dispatch by id.
 - **Everything is agent-drivable:** every interactive widget registers an automation id; UI state is serde so the control channel can read/set it.
 - **Quality gates** before every commit: `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`, `cargo xtask layers`, `cargo xtask assets`, `cargo xtask wasm` (checks L0–L4 crates). `cargo xtask ci` runs them all.
diff --git a/Cargo.lock b/Cargo.lock
index 43b781b41..7efda0c44 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,21 +4,21 @@ version = 4
 
 [[package]]
 name = "accesskit"
-version = "0.24.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
  "uuid",
 ]
 
 [[package]]
 name = "accesskit_atspi_common"
-version = "0.18.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+checksum = "52c182f9c282ac9c5638d876d551d15e5f7d397ec263349a0c6a2b61595dd5e4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.36.0",
+ "accesskit_consumer",
  "atspi-common",
  "phf",
  "serde",
@@ -27,43 +27,37 @@ dependencies = [
 
 [[package]]
 name = "accesskit_consumer"
-version = "0.35.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+checksum = "8a45e2bb300bea6d5f33a82c3e051c3ddc6f41c209750f68a0acbe991a284344"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
+name = "accesskit_ios"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+checksum = "28e539d64b27fd4c14de8f78ada8f7c944c092f52f7e49fb63316507a57f6937"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
 ]
 
 [[package]]
 name = "accesskit_macos"
-version = "0.26.3"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+checksum = "5701624bf6a11efb6d4c8e922bf44126ed96250e5faa9a7a0468c979635839a4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "objc2 0.5.2",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",
@@ -71,9 +65,9 @@ dependencies = [
 
 [[package]]
 name = "accesskit_unix"
-version = "0.21.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+checksum = "202f24df034a7476d07b7f74284de84f6d62aabd858dbe7ee9cad3b7ad6f8f9d"
 dependencies = [
  "accesskit",
  "accesskit_atspi_common",
@@ -89,13 +83,13 @@ dependencies = [
 
 [[package]]
 name = "accesskit_windows"
-version = "0.32.1"
+version = "0.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+checksum = "ce63f35d6bdcf59f26b76b3379063f738e6412cef46999cc772d46aa3de35adb"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "static_assertions",
  "windows 0.62.2",
  "windows-core 0.62.2",
@@ -103,11 +97,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_winit"
-version = "0.32.2"
+version = "0.34.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+checksum = "ee96dd150375c05912d8a473f98c2fb155fb3234fac88292d396548a2460fa77"
 dependencies = [
  "accesskit",
+ "accesskit_ios",
  "accesskit_macos",
  "accesskit_unix",
  "accesskit_windows",
@@ -139,7 +134,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -233,21 +228,22 @@ dependencies = [
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -481,12 +477,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -499,15 +489,6 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.10.0"
@@ -518,10 +499,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "bit-set"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c"
+dependencies = [
+ "bit-vec 0.10.1",
+]
 
 [[package]]
 name = "bit-vec"
@@ -529,6 +513,16 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
+[[package]]
+name = "bit-vec"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269"
+dependencies = [
+ "borsh",
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -565,7 +559,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -581,6 +575,30 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -721,7 +739,7 @@ dependencies = [
  "safetensors",
  "thiserror 2.0.21",
  "yoke",
- "zip",
+ "zip 7.2.0",
 ]
 
 [[package]]
@@ -797,7 +815,18 @@ checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -807,7 +836,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
  "aead",
- "chacha20",
+ "chacha20 0.9.1",
  "cipher",
  "poly1305",
  "zeroize",
@@ -845,6 +874,15 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -1011,18 +1049,100 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+
+[[package]]
+name = "craft-i18n"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+dependencies = [
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
+ "log",
+ "objc2-foundation 0.3.2",
+ "sys-locale",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
+
+[[package]]
+name = "craft-media"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+dependencies = [
+ "thiserror 2.0.21",
+]
 
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=5c874d51eeb3de70e735c8ce87a59a7dedd47675#5c874d51eeb3de70e735c8ce87a59a7dedd47675"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "serde",
+ "skrifa",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip 9.1.0",
 ]
 
 [[package]]
@@ -1118,7 +1238,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest",
  "fiat-crypto",
@@ -1189,6 +1309,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1216,7 +1342,18 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1249,6 +1386,12 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -1287,9 +1430,8 @@ dependencies = [
 
 [[package]]
 name = "ecolor"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
@@ -1321,9 +1463,8 @@ dependencies = [
 
 [[package]]
 name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1337,7 +1478,7 @@ dependencies = [
  "image",
  "js-sys",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "parking_lot",
@@ -1345,6 +1486,7 @@ dependencies = [
  "pollster 1.0.1",
  "profiling",
  "raw-window-handle",
+ "send_wrapper",
  "static_assertions",
  "wasm-bindgen",
  "web-sys",
@@ -1356,9 +1498,8 @@ dependencies = [
 
 [[package]]
 name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1376,9 +1517,8 @@ dependencies = [
 
 [[package]]
 name = "egui-wgpu"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1396,30 +1536,33 @@ dependencies = [
 
 [[package]]
 name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit_winit",
  "arboard",
+ "block2 0.6.2",
  "bytemuck",
  "egui",
+ "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "objc2-ui-kit 0.3.2",
+ "parking_lot",
  "profiling",
  "raw-window-handle",
  "smithay-clipboard",
  "web-time",
+ "windows-sys 0.61.2",
  "winit",
 ]
 
 [[package]]
 name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "egui",
@@ -1431,9 +1574,8 @@ dependencies = [
 
 [[package]]
 name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "eframe",
  "egui",
@@ -1476,9 +1618,8 @@ dependencies = [
 
 [[package]]
 name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
 ]
@@ -1538,9 +1679,8 @@ dependencies = [
 
 [[package]]
 name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1556,16 +1696,17 @@ dependencies = [
  "self_cell",
  "skrifa",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
+ "unicode-properties",
  "unicode-segmentation",
  "vello_cpu",
 ]
 
 [[package]]
 name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equivalent"
@@ -1677,13 +1818,24 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "filmcraft"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "arboard",
  "chrono",
  "cpal",
+ "craft-update",
  "eframe",
  "egui",
  "filmcraft-engine",
@@ -1697,13 +1849,14 @@ dependencies = [
  "glob",
  "log",
  "muda",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "open",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rfd",
  "serde_json",
+ "subtle",
  "sys-locale",
  "winit",
  "winresource",
@@ -1712,7 +1865,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-aac"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -1722,7 +1875,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-ac3"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
  "thiserror 2.0.21",
@@ -1730,7 +1883,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-apv"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -1740,16 +1893,16 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-audio-dsp"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
 ]
 
 [[package]]
 name = "filmcraft-automation"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "filmcraft-engine",
  "filmcraft-time",
  "image",
@@ -1757,13 +1910,14 @@ dependencies = [
  "schemars",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.21",
  "tokio",
 ]
 
 [[package]]
 name = "filmcraft-av1"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -1774,21 +1928,21 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-avi"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
 ]
 
 [[package]]
 name = "filmcraft-bitstream"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
- "proptest",
+ "craft-media",
 ]
 
 [[package]]
 name = "filmcraft-captions"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-project",
@@ -1801,11 +1955,11 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-cfb"
-version = "0.9.0"
+version = "0.13.0"
 
 [[package]]
 name = "filmcraft-cli"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-automation",
  "filmcraft-codecs",
@@ -1827,7 +1981,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-codecs"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-aac",
  "filmcraft-ac3",
@@ -1865,7 +2019,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-color"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1873,7 +2027,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-dng"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-dng",
  "rayon",
@@ -1882,7 +2036,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-dnx"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -1892,7 +2046,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-edit"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-geom",
  "filmcraft-media",
@@ -1905,8 +2059,9 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-engine"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "chrono",
  "craft-docpath",
  "filmcraft-audio-dsp",
  "filmcraft-captions",
@@ -1940,7 +2095,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-export"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-aac",
  "filmcraft-apv",
@@ -1971,7 +2126,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-flac"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -1980,20 +2135,22 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-format"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "chrono",
  "filmcraft-media",
  "filmcraft-project",
  "filmcraft-time",
  "log",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "filmcraft-frame"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-time",
@@ -2003,7 +2160,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-geom"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "proptest",
  "serde",
@@ -2011,7 +2168,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-golden"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-frame",
@@ -2022,13 +2179,13 @@ dependencies = [
  "filmcraft-render",
  "filmcraft-testkit",
  "filmcraft-time",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "wgpu",
 ]
 
 [[package]]
 name = "filmcraft-gpu"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-export",
@@ -2040,14 +2197,14 @@ dependencies = [
  "filmcraft-time",
  "image",
  "log",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rayon",
  "wgpu",
 ]
 
 [[package]]
 name = "filmcraft-h264"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -2057,7 +2214,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-h264enc"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -2067,7 +2224,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-hevc"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -2077,7 +2234,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-interchange"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-cfb",
  "filmcraft-color",
@@ -2094,26 +2251,26 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-isobmff"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
- "filmcraft-bitstream",
+ "craft-media",
  "filmcraft-testkit",
  "proptest",
  "serde_json",
- "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "filmcraft-matroska"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "craft-media",
  "filmcraft-testkit",
  "serde_json",
 ]
 
 [[package]]
 name = "filmcraft-media"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-dng",
@@ -2129,7 +2286,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-mpa"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -2138,7 +2295,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-mpeg2v"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
  "rayon",
@@ -2147,7 +2304,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-mpegts"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
  "thiserror 2.0.21",
@@ -2155,28 +2312,29 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-mxf"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "chrono",
  "filmcraft-testkit",
 ]
 
 [[package]]
 name = "filmcraft-ogg"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
 ]
 
 [[package]]
 name = "filmcraft-opus"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
 ]
 
 [[package]]
 name = "filmcraft-platform"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-codecs",
@@ -2202,7 +2360,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-project"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "filmcraft-geom",
@@ -2216,7 +2374,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-prores"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
  "filmcraft-testkit",
@@ -2226,7 +2384,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-render"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-audio-dsp",
  "filmcraft-captions",
@@ -2246,7 +2404,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-scopes"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "serde",
@@ -2255,7 +2413,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-speech"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "candle-core",
  "candle-nn",
@@ -2267,24 +2425,28 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
+ "tempfile",
  "thiserror 2.0.21",
  "ureq",
 ]
 
 [[package]]
 name = "filmcraft-testkit"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "chrono",
  "png",
+ "tempfile",
 ]
 
 [[package]]
 name = "filmcraft-text"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-color",
  "harfrust",
  "skrifa",
+ "tempfile",
  "unicode-bidi",
  "unicode-linebreak",
  "unicode-segmentation",
@@ -2292,7 +2454,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-time"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "proptest",
  "serde",
@@ -2300,7 +2462,7 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-tts"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "candle-core",
  "candle-nn",
@@ -2308,13 +2470,14 @@ dependencies = [
  "filmcraft-tts-text",
  "serde",
  "serde_json",
+ "sha2",
  "thiserror 2.0.21",
- "zip",
+ "zip 7.2.0",
 ]
 
 [[package]]
 name = "filmcraft-tts-text"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "serde",
  "thiserror 2.0.21",
@@ -2322,10 +2485,11 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-ui-egui"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "cpu-time",
  "craft-ui",
+ "craft-update",
  "eframe",
  "egui",
  "egui_kittest",
@@ -2349,11 +2513,12 @@ dependencies = [
  "filmcraft-tts",
  "image",
  "log",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rayon",
  "rustix 1.1.5",
  "serde",
  "serde_json",
+ "tempfile",
  "toml 1.1.6+spec-1.1.0",
  "unicode-bidi",
  "web-time",
@@ -2361,23 +2526,25 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-vp8"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
+ "filmcraft-testkit",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "filmcraft-vp9"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-bitstream",
+ "filmcraft-testkit",
  "rayon",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "filmcraft-web"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "eframe",
  "egui",
@@ -2405,6 +2572,23 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -2434,6 +2618,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -2805,8 +2995,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2921,12 +3114,12 @@ dependencies = [
 
 [[package]]
 name = "glifo"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+checksum = "282a26c1e23de04bdab3e34a21b6f877a479b96737792516b9b8b8f69b6661be"
 dependencies = [
  "bytemuck",
- "foldhash",
+ "foldhash 0.2.0",
  "hashbrown 0.17.1",
  "log",
  "peniko",
@@ -2967,7 +3160,7 @@ dependencies = [
  "glutin_glx_sys",
  "glutin_wgl_sys",
  "libloading",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -3143,6 +3336,15 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -3151,7 +3353,7 @@ checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.2.0",
  "serde",
  "serde_core",
 ]
@@ -3162,7 +3364,7 @@ version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
- "foldhash",
+ "foldhash 0.2.0",
 ]
 
 [[package]]
@@ -3247,6 +3449,183 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -3461,12 +3840,12 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kittest"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
+checksum = "0bb81a721ba76aa095b7f45deb180504f786904e56ca4b8e141f66eb89a78b75"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
+ "accesskit_consumer",
 ]
 
 [[package]]
@@ -3542,6 +3921,15 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "litrs"
 version = "1.0.0"
@@ -3640,20 +4028,19 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
  "crossbeam-channel",
  "dpi",
  "gtk",
  "keyboard-types",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
  "png",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
@@ -3733,12 +4120,33 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
@@ -3765,6 +4173,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -3855,9 +4269,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
 dependencies = [
  "objc2-encode",
 ]
@@ -3886,7 +4300,7 @@ checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -3900,7 +4314,7 @@ checksum = "6948501a91121d6399b79abaa33a8aa4ea7857fe019f341b8c23ad6e81b79b08"
 dependencies = [
  "bitflags 2.13.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio",
  "objc2-core-audio-types",
  "objc2-core-foundation",
@@ -3938,7 +4352,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1eebcea8b0dbff5f7c8504f3107c68fc061a3eb44932051c8cf8a68d969c3b2"
 dependencies = [
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio-types",
  "objc2-core-foundation",
 ]
@@ -3950,7 +4364,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -3975,7 +4389,7 @@ dependencies = [
  "block2 0.6.2",
  "dispatch2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -3986,7 +4400,7 @@ checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
  "bitflags 2.13.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-io-surface",
 ]
@@ -4024,7 +4438,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio",
  "objc2-core-audio-types",
  "objc2-core-foundation",
@@ -4039,7 +4453,7 @@ checksum = "d425caf1df73233f29fd8a5c3e5edbc30d2d4307870f802d18f00d83dc5141a6"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-io-surface",
@@ -4073,7 +4487,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -4084,7 +4498,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -4120,7 +4534,7 @@ checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4144,7 +4558,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -4189,7 +4603,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
 ]
@@ -4226,7 +4640,7 @@ checksum = "05bf9a3c14831a7d9641b0d81d87dd913ee238a012b2fde27db5a84b56f5df3e"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-core-media",
@@ -4249,9 +4663,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "open"
-version = "5.4.4"
+version = "5.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa576c76302b7b808eecc68061e67336c47833ef9d22caa74dda10fa9675eebc"
+checksum = "8d8c8b8e725ad26404d6896eb2f064294a0a7b4f1d9120210d85544684c4ca95"
 dependencies = [
  "is-wsl",
  "libc",
@@ -4292,6 +4706,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.45.0",
+]
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -4411,10 +4835,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
-name = "phf"
-version = "0.13.1"
+name = "petgraph"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
+[[package]]
+name = "phf"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
  "phf_macros",
  "phf_shared",
@@ -4423,9 +4858,9 @@ dependencies = [
 
 [[package]]
 name = "phf_generator"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
 dependencies = [
  "fastrand",
  "phf_shared",
@@ -4433,9 +4868,9 @@ dependencies = [
 
 [[package]]
 name = "phf_macros"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
 dependencies = [
  "phf_generator",
  "phf_shared",
@@ -4446,9 +4881,9 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
 dependencies = [
  "siphasher",
 ]
@@ -4534,6 +4969,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plist"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
+dependencies = [
+ "base64",
+ "indexmap",
+ "quick-xml 0.42.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -4579,7 +5027,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -4600,7 +5048,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -4620,6 +5068,33 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "serde_core",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -4714,16 +5189,17 @@ checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bit-set 0.8.0",
- "bit-vec 0.8.0",
+ "bit-set 0.11.1",
+ "bit-vec 0.10.1",
  "bitflags 2.13.2",
+ "chacha20 0.10.2",
+ "core_detect",
  "num-traits",
- "rand 0.9.5",
- "rand_chacha 0.9.0",
+ "rand 0.10.3",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -4781,6 +5257,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -4822,6 +5307,16 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -4860,6 +5355,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_distr"
 version = "0.5.1"
@@ -4872,11 +5373,11 @@ dependencies = [
 
 [[package]]
 name = "rand_xorshift"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
 dependencies = [
- "rand_core 0.9.5",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -4906,7 +5407,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "objc2-quartz-core 0.3.2",
@@ -5029,7 +5530,7 @@ dependencies = [
  "js-sys",
  "libc",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -5061,13 +5562,14 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "3.5.0"
+version = "3.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fae7019994ae0fe4ada40b732f798f3ff26f0f04facb1477f1bf37eb4f18a2d3"
+checksum = "ceb42e9e47443cd83a834dea57b5816d35481417bae72ade5dc5615c59122e26"
 dependencies = [
  "chrono",
  "futures",
  "indexmap",
+ "libc",
  "pastey",
  "pin-project-lite",
  "rmcp-macros",
@@ -5083,9 +5585,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "3.5.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e66877136e969d5a2d561ee5841b17717a0619aebd64abb47a2a2f46e34683"
+checksum = "967fa7f7935d7d6217d593df0e8e5c9307bcaf256974a5a9ee64476c97735389"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -5173,12 +5675,13 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "log",
  "once_cell",
+ "ring",
  "rustls-pki-types",
  "rustls-webpki 0.103.15",
  "subtle",
@@ -5334,9 +5837,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
 dependencies = [
  "chrono",
  "dyn-clone",
@@ -5348,9 +5851,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+checksum = "e1c3a92094fa7d61aa124645844facb6b554dfc797136d0f5fd1f890e2bffc69"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5418,6 +5921,16 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "seq-macro"
@@ -5468,9 +5981,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -5515,7 +6028,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -5942,7 +6455,10 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4"
 dependencies = [
+ "js-sys",
  "libc",
+ "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
@@ -5972,6 +6488,16 @@ dependencies = [
  "version-compare",
 ]
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.12.16"
@@ -5985,7 +6511,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.5",
  "windows-sys 0.61.2",
@@ -6055,10 +6581,51 @@ dependencies = [
 ]
 
 [[package]]
-name = "tokio"
-version = "1.53.1"
+name = "time"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "serde_core",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -6222,6 +6789,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -6237,6 +6815,12 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -6284,6 +6868,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
 
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "unicode-segmentation"
 version = "1.13.3"
@@ -6314,11 +6904,12 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "3.4.2"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
+checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
 dependencies = [
- "base64 0.23.1",
+ "base64",
+ "flate2",
  "log",
  "percent-encoding",
  "rustls",
@@ -6330,22 +6921,34 @@ dependencies = [
 
 [[package]]
 name = "ureq-proto"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
+checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
 dependencies = [
- "base64 0.23.1",
+ "base64",
  "http",
  "httparse",
  "log",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "uuid"
 version = "1.26.1"
@@ -6360,9 +6963,9 @@ dependencies = [
 
 [[package]]
 name = "vello_common"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+checksum = "bbb2141a2bca6e6d598e471fd4d1d7eed8e020aad6a28187edda07f091a325dd"
 dependencies = [
  "bytemuck",
  "fearless_simd",
@@ -6375,9 +6978,9 @@ dependencies = [
 
 [[package]]
 name = "vello_cpu"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+checksum = "ace506ca414548966fcf3c283be94eb1cad8254de488791ee698bf438b0890a9"
 dependencies = [
  "bytemuck",
  "glifo",
@@ -6385,6 +6988,16 @@ dependencies = [
  "vello_common",
 ]
 
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -6606,7 +7219,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -6785,7 +7398,7 @@ dependencies = [
  "naga",
  "naga-types",
  "ndk-sys",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -6974,6 +7587,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result 0.4.1",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.1.2"
@@ -7028,15 +7652,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -7070,30 +7685,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
@@ -7115,12 +7713,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -7133,12 +7725,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -7151,24 +7737,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -7181,12 +7755,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -7199,12 +7767,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -7217,12 +7779,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -7235,17 +7791,10 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "ahash",
  "android-activity",
@@ -7311,21 +7860,70 @@ dependencies = [
 ]
 
 [[package]]
-name = "winresource"
-version = "0.1.31"
+name = "winreg"
+version = "0.55.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml 1.1.6+spec-1.1.0",
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "x11-dl"
 version = "2.21.0"
@@ -7402,7 +8000,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.9.0"
+version = "0.13.0"
 dependencies = [
  "filmcraft-testkit",
  "serde_json",
@@ -7598,6 +8196,43 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde_core",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "serde",
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "zip"
 version = "7.2.0"
@@ -7607,7 +8242,24 @@ dependencies = [
  "crc32fast",
  "indexmap",
  "memchr",
- "typed-path",
+ "typed-path 0.12.3",
+]
+
+[[package]]
+name = "zip"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path 0.13.0",
+ "windows-sys 0.61.2",
+ "zopfli",
 ]
 
 [[package]]
@@ -7622,6 +8274,18 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -7677,3 +8341,23 @@ dependencies = [
  "syn 3.0.6",
  "winnow 1.0.4",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index 625558e91..e3efcac8c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/*", "xtask"]
 
 [workspace.package]
-version = "0.9.0"
+version = "0.13.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -67,17 +67,24 @@ thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = "1"
 log = "0.4"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"
 proptest = "1"
 roxmltree = "0.21"
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }
+craft-media = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7", default-features = false }
 
 # ui
 # Shared frontend components; keep this dependency above the engine boundary.
-craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
-egui = "0.36"
-eframe = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7", features = ["serde", "native-windows"] }
+# egui 0.37: bundled fonts are opt-in, and the monochrome symbol/emoji faces moved to their own
+# feature. FilmCraft paints ✔ ✓ ✖ ⚡ ⚠ ⚙ ♪ ☑ in panel chrome, so both features are part of the
+# production font policy (system_fonts stays off).
+egui = { version = "0.37", features = ["default_fonts", "monochrome_emoji_fonts"] }
+eframe = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7", features = ["egui"] }
 rfd = "0.17"
 
 [workspace.lints.rust]
@@ -90,11 +97,15 @@ too_many_arguments = "allow"
 needless_range_loop = "allow"
 type_complexity = "allow"
 
+# Line tables keep file and line in panics and backtraces at a fraction of full debug info's size;
+# dependencies need none.
 [profile.dev.package."*"]
 opt-level = 2
+debug = false
 
 [profile.dev]
 opt-level = 1
+debug = "line-tables-only"
 
 # Codec hot loops: debug-build tests (RFC/oracle vectors) are minutes slower below opt-level 3.
 [profile.dev.package.filmcraft-h264]
@@ -146,3 +157,21 @@ opt-level = 3
 [profile.release]
 lto = "thin"
 codegen-units = 1
+
+# Keep the complete egui family and native event bridge on reviewed fork commits.
+[patch.crates-io]
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index 221a0acc6..92f248744 100644
--- a/NOTICE
+++ b/NOTICE
@@ -17,5 +17,270 @@ Noto Serif font (assets/fonts/NotoSerif-Regular.ttf) — OFL-1.1. See assets/fon
 JetBrains Mono font (assets/fonts/JetBrainsMono-Regular.ttf) — OFL-1.1. See assets/fonts/OFL-JetBrainsMono.txt.
 Builds made with craft-fonts (CRAFT_FONTS_DIR; all official releases) also embed the fonts listed in
 https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic, Shippori Mincho,
-BIZ UDMincho) — OFL-1.1. Their licence texts ship with the packages as OFL-<family>.txt.
+BIZ UDMincho, Noto Sans CJK SC, Noto Sans Arabic, Noto Sans Thai, Noto Sans Georgian) — OFL-1.1. Their licence texts ship with the packages as OFL-<family>.txt.
 Public-domain film and NASA frames and CC0 music shown in README screenshots (docs/images/) — public domain / CC0-1.0. See ATTRIBUTION.md.
+
+
+egui icon font subset (dependency asset)
+----------------------------------------
+epaint_default_fonts 0.37 embeds egui-icons.ttf, a five-glyph subset of
+emoji-icon-font by John Slegers. The full monochrome emoji-icon-font fallback
+uses the same MIT license. Upstream license text follows unchanged.
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Noto Emoji font (dependency asset)
+----------------------------------
+epaint_default_fonts 0.37, pinned with egui 0.37 at
+https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts,
+embeds NotoEmoji-Regular.ttf, the monochrome emoji fallback used when egui's
+`monochrome_emoji_fonts` feature is enabled. The font's copyright notice and the
+upstream SIL Open Font License 1.1 text follow unchanged.
+
+Copyright 2013 Google Inc. All Rights Reserved.
+
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Ubuntu Light font (dependency asset)
+------------------------------------
+epaint_default_fonts 0.37, pinned with egui 0.37 at
+https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts,
+embeds Ubuntu-Light.ttf as a default fallback. The font's copyright notice and the
+upstream Ubuntu Font Licence 1.0 text follow unchanged.
+
+Copyright 2011 Canonical Ltd.  Licensed under the Ubuntu Font Licence 1.0
+
+-------------------------------
+UBUNTU FONT LICENCE Version 1.0
+-------------------------------
+
+PREAMBLE
+This licence allows the licensed fonts to be used, studied, modified and
+redistributed freely. The fonts, including any derivative works, can be
+bundled, embedded, and redistributed provided the terms of this licence
+are met. The fonts and derivatives, however, cannot be released under
+any other licence. The requirement for fonts to remain under this
+licence does not require any document created using the fonts or their
+derivatives to be published under this licence, as long as the primary
+purpose of the document is not to be a vehicle for the distribution of
+the fonts.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this licence and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components
+as received under this licence.
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to
+a new environment.
+
+"Copyright Holder(s)" refers to all individuals and companies who have a
+copyright ownership of the Font Software.
+
+"Substantially Changed" refers to Modified Versions which can be easily
+identified as dissimilar to the Font Software by users of the Font
+Software comparing the Original Version with the Modified Version.
+
+To "Propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification and with or without charging
+a redistribution fee), making available to the public, and in some
+countries other activities as well.
+
+PERMISSION & CONDITIONS
+This licence does not grant any rights under trademark law and all such
+rights are reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to propagate the Font Software, subject to
+the below conditions:
+
+1) Each copy of the Font Software must contain the above copyright
+notice and this licence. These can be included either as stand-alone
+text files, human-readable headers or in the appropriate machine-
+readable metadata fields within text or binary files as long as those
+fields can be easily viewed by the user.
+
+2) The font name complies with the following:
+(a) The Original Version must retain its name, unmodified.
+(b) Modified Versions which are Substantially Changed must be renamed to
+avoid use of the name of the Original Version or similar names entirely.
+(c) Modified Versions which are not Substantially Changed must be
+renamed to both (i) retain the name of the Original Version and (ii) add
+additional naming elements to distinguish the Modified Version from the
+Original Version. The name of such Modified Versions must be the name of
+the Original Version, with "derivative X" where X represents the name of
+the new work, appended to that name.
+
+3) The name(s) of the Copyright Holder(s) and any contributor to the
+Font Software shall not be used to promote, endorse or advertise any
+Modified Version, except (i) as required by this licence, (ii) to
+acknowledge the contribution(s) of the Copyright Holder(s) or (iii) with
+their explicit written permission.
+
+4) The Font Software, modified or unmodified, in part or in whole, must
+be distributed entirely under this licence, and must not be distributed
+under any other licence. The requirement for fonts to remain under this
+licence does not affect any document created using the Font Software,
+except any version of the Font Software extracted from a document
+created using the Font Software may only be distributed under this
+licence.
+
+TERMINATION
+This licence becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
+
+Hack font (dependency asset)
+----------------------------
+epaint_default_fonts 0.37, pinned with egui 0.37 at
+https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts,
+embeds Hack-Regular.ttf as the default monospace fallback. The upstream notice and
+licences follow unchanged.
+
+The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
+
+The work in the DejaVu project was committed to the public domain.
+
+Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
+MIT License
+
+Copyright (c) 2018 Source Foundry Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+BITSTREAM VERA LICENSE
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
+
+The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
+
+The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.
diff --git a/README.md b/README.md
index daff93b38..95fb0a8c2 100644
--- a/README.md
+++ b/README.md
@@ -8,22 +8,29 @@
 </p>
 
 
+<p align="center">
+  <img src="assets/app-icon/hicolor/256x256/apps/ai.storyteller.filmcraft.png" width="128" height="128" alt="FilmCraft icon: an engraved owl on a purple tile">
+</p>
+
 <h1 align="center">FilmCraft</h1>
 
 <p align="center">
-  <b>Video editing, color and sound; an open-source, clean-room reimplementation of Adobe Premiere Pro, rebuilt in pure Rust.</b>
+  <b>Video editing, color and sound; an open-source, professional non-linear video editor, built in pure Rust.</b>
 </p>
 
 <p align="center">
-  An open-source, clean-room take on the Adobe Premiere Pro workflow: native on macOS, Windows and Linux, and in the browser via WebAssembly.<br>
+  An open-source, modern non-linear video editing workflow: native on macOS, Windows and Linux, and in the browser via WebAssembly.<br>
   By the ArtCraft team.
 </p>
 
 <p align="center">
-  <a href="#license-and-credits"><img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20%7C%20Apache--2.0-8b5cf6"></a>
-  <img alt="Written in pure Rust" src="https://img.shields.io/badge/pure-Rust-6a3fd6?logo=rust&logoColor=white">
-  <img alt="Runs on macOS, Windows and Linux" src="https://img.shields.io/badge/runs%20on-macOS%20%7C%20Windows%20%7C%20Linux-8b5cf6">
-  <a href="#status"><img alt="Status: young and moving fast" src="https://img.shields.io/badge/status-young%20and%20moving%20fast-6a3fd6"></a>
+  <a href="#license-and-credits"><img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20%7C%20Apache--2.0-8b5cf6?style=flat-square"></a>
+  <img alt="Written in pure Rust" src="https://img.shields.io/badge/pure-Rust-6a3fd6?style=flat-square&logo=rust&logoColor=white">
+  <img alt="Runs on macOS, Windows and Linux" src="https://img.shields.io/badge/runs%20on-macOS%20%7C%20Windows%20%7C%20Linux-8b5cf6?style=flat-square">
+  <a href="#status"><img alt="Status: young and moving fast" src="https://img.shields.io/badge/status-young%20and%20moving%20fast-6a3fd6?style=flat-square"></a>
+  <br>
+  <a href="https://sonarcloud.io/project/overview?id=storytold_filmcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/filmcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>
 
 <p align="center">
@@ -39,7 +46,7 @@
 <br>
 
 <p align="center">
-  <img src="docs/images/filmcraft-hero.png" alt="FilmCraft in the Color workspace, mid-way through an Apollo 11 documentary cut from NASA footage: the Program monitor on the Saturn V clearing the launch tower with a Launch Complex 39A lower third and an air-to-ground subtitle, Effect Controls with Lumetri and Scale keyframes on the shot, the Lumetri Color panel, bins of NASA selects, and a timeline with 49 picture cuts, B-roll, titles, a caption track, mission audio, a ducked music bed, named markers, a rendered section and live loudness meters" width="100%">
+  <img src="docs/images/filmcraft-hero.png" alt="FilmCraft in the Color workspace, mid-way through an Apollo 11 documentary cut from NASA footage: the Program monitor on the Saturn V clearing the launch tower with a Launch Complex 39A lower third and an air-to-ground subtitle, Effect Controls with color grading and Scale keyframes on the shot, the color grading panel, bins of NASA selects, and a timeline with 49 picture cuts, B-roll, titles, a caption track, mission audio, a ducked music bed, named markers, a rendered section and live loudness meters" width="100%">
 </p>
 
 <p align="center"><sub><i>Apollo 11 - Tranquility</i>: a three-minute documentary edit of NASA's 1969 launch, landing and moonwalk film, with subtitles from the mission transcript. Every frame in these screenshots comes from public-domain footage, decoded, composited and graded by FilmCraft's own code.</sub></p>
@@ -66,7 +73,7 @@
 
 <br>
 
-FilmCraft is a non-linear editor for people who know Premiere: the same panels, workspaces, tools and shortcuts, so your hands already know where everything is. Underneath, it is new from the bitstream up. The H.264, HEVC, ProRes and AAC codecs are our own, written in Rust from the public specifications. A GPU compositor works in linear light. Frame math runs on exact integer time, so edits never drift. And every action in the app is a command that an AI agent can drive as precisely as you can.
+FilmCraft is a professional non-linear editor: familiar panels, workspaces, tools and shortcuts, so your hands already know where everything is. Underneath, it is new from the bitstream up. The H.264, HEVC, ProRes and AAC codecs are our own, written in Rust from the public specifications. A GPU compositor works in linear light. Frame math runs on exact integer time, so edits never drift. And every action in the app is a command that an AI agent can drive as precisely as you can.
 
 <br>
 
@@ -84,7 +91,7 @@ FilmCraft is a non-linear editor for people who know Premiere: the same panels,
 - **Every trim.** Ripple, roll, slip, slide, rate stretch and razor tools. Trim mode selects edit points as ripple, roll or trim, nudges them a frame at a time (`⌥←` `⌥→`, ×5 with `⇧`), toggles the trim type with `⌃T` and extends them to the playhead with `E`. `Q` and `W` ripple-trim to the playhead. The **Trim Monitor** shows both sides of the edit, and **dynamic trimming** trims live while it plays: `L` forward, `J` back, `K` to stop and commit as one undo step.
 - **Exact time.** Every edit is computed on integer ticks: 254,016,000,000 per second, which divides evenly by every common frame rate and sample rate. 23.976, 29.97 drop-frame and 59.94 are exact, not approximate.
 - **The details pros rely on.** Markers with colours, names and durations; export sequence review notes with **Markers ▸ Export Markers as CSV…**; add edit (`⌘K`) on one or all tracks; nesting; copy, paste and paste insert; ripple delete and close gap; snapping; unlimited undo with a History panel.
-- **Your keys.** A Keyboard Shortcuts editor (`⌥⌘K`) with a drawn keyboard, panel-specific shortcuts, conflict warnings and presets for FilmCraft, Premiere Pro, Final Cut Pro and Avid key layouts.
+- **Your keys.** A Keyboard Shortcuts editor (`⌥⌘K`) with a drawn keyboard, panel-specific shortcuts, conflict warnings and presets for FilmCraft and standard NLE key layouts.
 - **Never lose work.** Saves are atomic, auto-save keeps a rolling set of versions, and a crash-recovery journal written about a second after each edit brings back unsaved changes after a crash or power cut.
 
 <p align="center">
@@ -103,7 +110,7 @@ FilmCraft is a non-linear editor for people who know Premiere: the same panels,
 
 <p align="center"><sub>The Color workspace on <i>Charade</i> (1963), with live scopes beside the Program monitor.</sub></p>
 
-**A complete Lumetri-style grading panel**, in the order a colourist works:
+**A complete color grading panel**, in the order a colourist works:
 
 - **Basic Correction:** temperature and tint, exposure, contrast, highlights, shadows, whites, blacks, saturation.
 - **Creative:** eight built-in looks with an intensity control, plus faded film, sharpen and vibrance. The looks are colour transforms written in code, not LUT files.
@@ -115,11 +122,11 @@ FilmCraft is a non-linear editor for people who know Premiere: the same panels,
 <table>
   <tr>
     <td width="34%" valign="top" align="center">
-      <img src="docs/images/filmcraft-lumetri.png" alt="The Lumetri Color panel on Charade (1963): Basic Correction sliders with coloured temperature and tint tracks, collapsed Creative and Curves sections, shadow, midtone and highlight colour wheels, and HSL Secondary and Vignette toggles"><br>
-      <sub><b>The Lumetri Color panel.</b> Basic Correction, Color Wheels and every other section, each with its own on/off switch.</sub>
+      <img src="docs/images/filmcraft-color-panel.png" alt="The color grading panel on Charade (1963): Basic Correction sliders with coloured temperature and tint tracks, collapsed Creative and Curves sections, shadow, midtone and highlight colour wheels, and HSL Secondary and Vignette toggles"><br>
+      <sub><b>The color grading panel.</b> Basic Correction, Color Wheels and every other section, each with its own on/off switch.</sub>
     </td>
     <td width="66%" valign="top" align="center">
-      <img src="docs/images/filmcraft-scopes.png" alt="Lumetri Scopes: a green luma waveform and a vectorscope of a Charade (1963) frame"><br>
+      <img src="docs/images/filmcraft-scopes.png" alt="The video scopes: a green luma waveform and a vectorscope of a Charade (1963) frame"><br>
       <sub><b>Scopes that tell the truth.</b> The waveform and vectorscope are computed from the graded frame. All grading happens in linear light, in 32-bit float.</sub>
     </td>
   </tr>
@@ -130,14 +137,14 @@ FilmCraft is a non-linear editor for people who know Premiere: the same panels,
 ## Effects and motion
 
 <p align="center">
-  <img src="docs/images/filmcraft-effects.png" alt="Effects workspace: Effect Controls with Motion, Opacity, Time Remapping and Lumetri Color, NASA's Earth Views from the ISS in the Program monitor, and the Effects browser open on the Dissolve transitions" width="100%">
+  <img src="docs/images/filmcraft-effects.png" alt="Effects workspace: Effect Controls with Motion, Opacity, Time Remapping and a colour grade, NASA's Earth Views from the ISS in the Program monitor, and the Effects browser open on the Dissolve transitions" width="100%">
 </p>
 
 <p align="center"><sub>NASA's <i>Earth Views from the ISS</i> with a look applied, and the Effects browser open on the dissolves.</sub></p>
 
-- **Premiere 26's full Video Effects bin (93 effects in 16 folders), the Legacy bin and the obsolete effects old projects use, plus around 30 transitions.** Blurs (Bokeh, Focus, Compound), keys (Ultra Key, Track Matte), distortions (Corner Pin, Turbulent Displace, Warp Stabilizer), Lights & Glows, Immersive Video (VR) effects on equirectangular footage, Posterize Time, Echo and more. Cross dissolve, dip to black or white, film dissolve, wipes, irises, pushes, slides, zooms, page peel, cube spin and more.
+- **A comprehensive Video Effects bin (over 90 effects across 16 categories), legacy effects, plus around 30 transitions.** Blurs (Bokeh, Focus, Compound), keys (Ultra Key, Track Matte), distortions (Corner Pin, Turbulent Displace, Warp Stabilizer), Lights & Glows, Immersive Video (VR) effects on equirectangular footage, Posterize Time, Echo and more. Cross dissolve, dip to black or white, film dissolve, wipes, irises, pushes, slides, zooms, page peel, cube spin and more.
 - **Motion and opacity on every clip:** position, scale, rotation, anchor point and anti-flicker, plus 26 blend modes.
-- **Keyframes like Premiere's:** linear, Bezier, auto and continuous Bezier, hold, ease in and ease out. Effect Controls shows a keyframe lane for every parameter under a time ruler with the playhead's handle, and each animated parameter opens into **value and velocity graphs** with draggable influence handles. Effect Controls and the Properties panel share the keyframe navigator (◀ ◆ ▶): add or remove the keyframe at the playhead, step to the previous or next one.
+- **Advanced keyframing:** linear, Bezier, auto and continuous Bezier, hold, ease in and ease out. Effect Controls shows a keyframe lane for every parameter under a time ruler with the playhead's handle, and each animated parameter opens into **value and velocity graphs** with draggable influence handles. Effect Controls and the Properties panel share the keyframe navigator (◀ ◆ ▶): add or remove the keyframe at the playhead, step to the previous or next one.
 - **A GPU compositor** built on wgpu (Metal, Vulkan, DirectX 12, WebGPU). It samples YUV straight from the decoder with footprint supersampling and blends in linear light. A CPU path renders the same frames, and the two are tested against each other.
 
 <p align="center">
@@ -179,13 +186,13 @@ No FFmpeg inside. The video codecs, AAC, Opus and the containers are our own Rus
 | **VP9** | ✓ | | Profiles 0–3, 8/10/12-bit, 4:2:0 to 4:4:4, tiles and superframes; bit-exact on 50+ streams; in WebM/Matroska and MP4 |
 | **Opus** | ✓ | | SILK, CELT, hybrid and multistream surround; range-exact on every RFC 8251 conformance vector; in WebM/Matroska and MP4 |
 | **AV1** | ✓ | | Main profile, 8/10-bit 4:2:0 and monochrome, every coding tool incl. film grain, superres and spatial layers; bit-exact with libdav1d on the libaom vectors tested; in MP4 and WebM/Matroska |
-| **Avid DNxHD / DNxHR** | ✓ | ✓ | All SMPTE ST 2019-1 CIDs (LB to 444, 8/10/12-bit); export writes DNxHR in MOV |
+| **DNxHD / DNxHR** | ✓ | ✓ | All SMPTE ST 2019-1 CIDs (LB to 444, 8/10/12-bit); export writes DNxHR in MOV |
 | **MJPEG, PCM** | ✓ | ✓ | |
 | **MP3, FLAC, ALAC, Vorbis** | ✓ | | Via the [symphonia](https://github.com/pdeljanov/Symphonia) crate (MPL-2.0) for now, to be replaced by our own |
 | **MP4 / MOV** | ✓ | ✓ | Fragmented MP4, edit lists, timecode tracks |
 | **Matroska / WebM** | ✓ | | Lacing, Cues, header stripping, HDR colour metadata |
 | **AVI** | ✓ | | AVI 1.0 and OpenDML (files past 1 GB); Motion JPEG, H.264, HEVC and uncompressed RGB / YUV with PCM, MP3, MP2 or AC-3. DivX / Xvid and DV not yet |
-| **Stills** | ✓ | ✓ | Import PNG, JPEG, GIF, WebP, TIFF and BMP (animated GIF and APNG as clips, with transparency); export PNG sequences and animated GIF |
+| **Stills** | ✓ | ✓ | Import PNG, JPEG, GIF, WebP, TIFF and BMP (animated GIF, APNG and WebP as clips, with transparency); export PNG sequences and animated GIF |
 
 Also imported: MPEG-2 / MPEG-1 video, AC-3, MP2, MXF (OP1a / OP-Atom), MPEG transport and program streams (AVCHD, broadcast, DVD), Ogg and image sequences. Not yet: AV1 export, camera RAW, E-AC-3. Hardware decoding works on macOS (VideoToolbox), Windows (Media Foundation) and, for H.264 and HEVC, Linux (VA-API); H.264 export can use NVIDIA's encoder on Windows and Linux (opt-in), and H.265 (HEVC Main, 8-bit) export works through it (NVENC on Windows, VideoToolbox on macOS) ([#30](https://github.com/storytold/filmcraft/issues/30)).
 
@@ -200,7 +207,7 @@ Also imported: MPEG-2 / MPEG-1 video, AC-3, MP2, MXF (OP1a / OP-Atom), MPEG tran
 <p align="center"><sub>Export mode, set to write the trailer as H.264 MP4.</sub></p>
 
 - **H.264 MP4 with AAC, using our own encoders.** A 6-second 960×540 render takes 1.3 seconds and decodes in ffmpeg without a single warning, with strict error detection on.
-- **Also:** Apple ProRes 422 HQ and Motion JPEG in QuickTime, MXF OP1a and Avid-style OP-Atom (DNxHR, ProRes or H.264 with PCM and start timecode), PNG sequences, animated GIF and WAV.
+- **Also:** Apple ProRes 422 HQ and Motion JPEG in QuickTime, MXF OP1a and standard OP-Atom (DNxHR, ProRes or H.264 with PCM and start timecode), PNG sequences, animated GIF and WAV.
 - **Background jobs** with progress and cancel, so you keep editing while it renders.
 - **Render previews:** the render bar marks segments green, yellow or red; rendered previews are cached by content, so an edit only invalidates what it touches and undo brings the green back.
 
@@ -210,11 +217,11 @@ Also imported: MPEG-2 / MPEG-1 video, AC-3, MP2, MXF (OP1a / OP-Atom), MPEG tran
 
 Move timelines between FilmCraft and every other editor:
 
-- **Final Cut Pro 7 XML (xmeml):** the format Premiere and DaVinci Resolve exchange. It carries nested sequences, transitions, generators, Motion, Opacity, Time Remap and audio levels, with keyframes.
+- **FCP 7 XML (xmeml):** industry-standard timeline interchange format. It carries nested sequences, transitions, generators, Motion, Opacity, Time Remap and audio levels, with keyframes.
 - **FCPXML 1.9–1.11:** the spine, connected clips as lanes, transitions, retiming and compound clips.
 - **OpenTimelineIO:** the open interchange format of the film industry, round-tripping every FilmCraft detail through `metadata.filmcraft`.
 - **CMX 3600 EDL:** the oldest format still in use, with drop-frame timecode, dissolves, wipes, speed changes (`M2`) and one EDL per track.
-- **AAF (Edit Protocol):** for Avid Media Composer and Pro Tools. Video and audio tracks, dissolves and dips, clip volume with keyframes, markers and source timecode; audio embedded or as separate WAV / AIFF files, trimmed with handles, with clip effects rendered in and broken out to mono, plus an optional video mixdown. Import reads AAF back, extracting embedded audio.
+- **AAF (Edit Protocol):** standard timeline and audio interchange format. Video and audio tracks, dissolves and dips, clip volume with keyframes, markers and source timecode; audio embedded or as separate WAV / AIFF files, trimmed with handles, with clip effects rendered in and broken out to mono, plus an optional video mixdown. Import reads AAF back, extracting embedded audio.
 - **OMF 2.0:** the audio-post handoff: the audio tracks with crossfades and gain, sample-accurate, with the audio encapsulated or alongside.
 
 Import merges the document's bins, media and sequences into your project as one undoable step, and links each media file it finds on disk.
@@ -223,7 +230,7 @@ Import merges the document's bins, media and sequences into your project as one
 
 ## Built for agents
 
-Every menu item, button, slider and drag in FilmCraft is a **command** with an id, typed parameters and an enabled state. There are more than 650 engine commands (`filmcraft-cli commands` lists them), with the rest of Premiere's catalogue on the way. The UI, the CLI, a JSON control channel and an **MCP server** all dispatch the same commands, so Claude or any agent can cut, trim, grade, mix and export exactly the way a person does. The UI can also be driven at the level of mouse and keyboard: every widget has an automation id, and agents can click, drag, type and take screenshots.
+Every menu item, button, slider and drag in FilmCraft is a **command** with an id, typed parameters and an enabled state. There are more than 650 engine commands (`filmcraft-cli commands` lists them), with more commands continuously added. The UI, the CLI, a JSON control channel and an **MCP server** all dispatch the same commands, so Claude or any agent can cut, trim, grade, mix and export exactly the way a person does. The UI can also be driven at the level of mouse and keyboard: every widget has an automation id, and agents can click, drag, type and take screenshots.
 
 ```jsonc
 // over the control channel (JSON lines on TCP) or as MCP tool calls
@@ -277,22 +284,22 @@ The control protocol is documented in [docs/control-protocol.md](docs/control-pr
 | [docs/project-files.md](docs/project-files.md) | `.fcproj` format, schema migrations, auto-save and crash recovery |
 | [docs/graphics.md](docs/graphics.md) · [docs/captions.md](docs/captions.md) | Text engine, graphic clips and tools; caption tracks and formats |
 | [ROADMAP.md](ROADMAP.md) | Stage, parity numbers, languages, what's next and the progress log |
-| [docs/target-app-parity.md](docs/target-app-parity.md) · [docs/gaps.md](docs/gaps.md) · [docs/roadmap.md](docs/roadmap.md) | Parity assessment against Premiere Pro, the ranked list of shortfalls, milestones and current focus |
+| [docs/target-app-parity.md](docs/target-app-parity.md) · [docs/gaps.md](docs/gaps.md) · [docs/roadmap.md](docs/roadmap.md) | Parity assessment, the ranked list of shortfalls, milestones and current focus |
 | [docs/codec-parity.md](docs/codec-parity.md) · [docs/file-format-parity.md](docs/file-format-parity.md) · [docs/hardware-parity.md](docs/hardware-parity.md) · [docs/ui-parity.md](docs/ui-parity.md) · [docs/localization-parity.md](docs/localization-parity.md) | Parity checklists by dimension |
 
 ## Status
 
 FilmCraft is young and moving fast. Editing, trimming, multicam, colour, keyframes, effects, titles, captions, mixing, codecs and export work today.
 
-FilmCraft is in **alpha**. We track two numbers ([docs/target-app-parity.md](docs/target-app-parity.md), re-measured 2026-10-10 against Premiere Pro 26.5.2):
+FilmCraft is in **alpha**. We track two numbers ([docs/target-app-parity.md](docs/target-app-parity.md), re-measured 2026-10-10):
 
-- **Feature breadth: ~86%.** Premiere Pro's menu items, effects, transitions, panels and formats that exist in FilmCraft (menus 92% and effects 100% measured).
-- **Ready for real work: ~56%.** Our honest estimate of how close FilmCraft is to replacing Premiere on real projects.
+- **Feature breadth: ~86%.** Professional NLE menu items, effects, transitions, panels and formats that exist in FilmCraft (menus 92% and effects 100% measured).
+- **Ready for real work: ~56%.** Our honest estimate of how close FilmCraft is to handling full production work on real projects.
 
 The biggest gaps today:
 
-- **Speed on big footage.** Hardware decoding works on macOS and Windows, and for H.264 and HEVC on Linux (VA-API, or NVDEC with NVIDIA's driver; VP9 and AV1 decode in software there). Blend modes and the most common effects run on the GPU, but Lumetri, keys and export rendering still run on the CPU; H.264 encoding can use the hardware encoder on macOS and on Windows and Linux with an NVIDIA GPU (opt-in, Export ▸ Hardware encoding), and H.265 export is hardware-only on both (HDR sequences export Main 10 PQ / HLG with NVENC; VideoToolbox writes 8-bit SDR) ([#30](https://github.com/storytold/filmcraft/issues/30)).
-- **Premiere projects.** `.prproj` files can't be opened yet; bring sequences over as FCP7 XML, AAF or OTIO.
+- **Speed on big footage.** Hardware decoding works on macOS and Windows, and for H.264 and HEVC on Linux (VA-API, or NVDEC with NVIDIA's driver; VP9 and AV1 decode in software there). Blend modes and the most common effects run on the GPU, but color grading, keys and export rendering still run on the CPU; H.264 encoding can use the hardware encoder on macOS and on Windows and Linux with an NVIDIA GPU (opt-in, Export ▸ Hardware encoding), and H.265 export is hardware-only on both (HDR sequences export Main 10 PQ / HLG with NVENC; VideoToolbox writes 8-bit SDR) ([#30](https://github.com/storytold/filmcraft/issues/30)).
+- **Native `.prproj` project import.** `.prproj` files can't be opened yet; bring sequences over as FCP7 XML, AAF or OTIO.
 - **No plugins.** No VST3 / Audio Units or OpenFX hosting.
 - **Delivery codecs.** H.264 is our only software delivery-codec export; H.265 exports only through a hardware encoder (NVIDIA on Windows: Main 8-bit SDR and Main 10 HDR PQ / HLG; VideoToolbox on macOS: 8-bit Main, SDR); no AV1 export yet.
 - **Real-world media and platforms.** Our decoders are bit-exact on conformance streams, but camera and phone files in the wild are less tested. Windows and Linux get far less testing than macOS.
@@ -455,15 +462,13 @@ with its author, source and license in [ATTRIBUTION.md](ATTRIBUTION.md). Builds
 
 **Footage and music in the screenshots:** NASA's Apollo 11 film and television footage from [images.nasa.gov](https://images.nasa.gov) (launch, Launch Control Center, lunar surface and recovery) and the Apollo 11 air-to-ground voice transcript, all US Government works in the public domain (NASA does not endorse this project); *Night of the Living Dead* (1968), *Carnival of Souls* (1962) and *Charade* (1963), all in the US public domain; *Earth Views from the ISS* by NASA; Chopin's Nocturne Op. 48 No. 1 and Ballade No. 1, performed for Musopen and released under CC0. The media itself is not in this repository. Sources and details for every asset are in [ATTRIBUTION.md](ATTRIBUTION.md).
 
-FilmCraft is an independent implementation. It contains no Adobe code, icons, images, presets or LUTs, and no GPL or LGPL code; every icon is drawn in code and every asset is openly licensed and attributed ([AGENTS.md](AGENTS.md)), apart from the ArtCraft name and logos, which are trademarks of the ArtCraft Team used under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt). ffmpeg is used only as an external test oracle.
+FilmCraft is an independent implementation. It contains no proprietary code, icons, images, presets or LUTs, and no GPL or LGPL code; every icon is drawn in code and every asset is openly licensed and attributed ([AGENTS.md](AGENTS.md)), apart from the ArtCraft name and logos, which are trademarks of the ArtCraft Team used under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt). ffmpeg is used only as an external test oracle.
 
 The ArtCraft name, wordmark and logos in [`docs/brand/`](docs/brand/) are trademarks of the
 ArtCraft Team and are not covered by this license. They may be used only unmodified, and only as
 part of this repository and FilmCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Adobe, Photoshop, Illustrator, Premiere Pro, Lightroom, Acrobat, After Effects and InDesign are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. FilmCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Adobe Inc.; these names are used only to describe the workflows it is compatible with.</sub>
-
 <br>
 
 <p align="center">
diff --git a/ROADMAP.md b/ROADMAP.md
index 91fc63a58..4225d8f21 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -5,7 +5,7 @@
 
 **Stage: alpha** · next: beta, ~19 points of ready-for-real-work and ~400–700 h away, plus opening Premiere's `.prproj` ([why](docs/target-app-parity.md#stage); passes the [core-workflow gate](docs/roadmap.md#alpha-gate))
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (language table: German ships the menus, #630) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (ProRes alpha final-run conformance and native macOS validation) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
 
 Progress toward parity with Adobe Premiere Pro. This page is the summary; the detail is in
 [docs/target-app-parity.md](docs/target-app-parity.md) (assessment, methodology, calibration),
@@ -87,7 +87,7 @@ Premiere ships 10 interface languages. Measured from our catalogs (3,498 strings
 | Italian | partial (whole interface; native review welcome) | ~100% |
 | Korean | partial (whole interface; needs an installed Hangul font; native review welcome) | ~100% |
 | Japanese | partial (whole interface) | 99.7% |
-| German | menus only (native-reviewed) | 10.6% |
+| German | partial (whole interface; menus native-reviewed, the rest welcome) | ~100% |
 | Vietnamese | none | 0% |
 
 Also shipped: Swedish (whole interface; native review welcome, ~100%) and Ukrainian (menus only, 10%). Detail: [docs/localization-parity.md](docs/localization-parity.md).
@@ -107,6 +107,8 @@ Ranked; detail and "done when" in [docs/roadmap.md](docs/roadmap.md) and [docs/g
 
 ## Progress log
 
+- **2026-10-22:** ProRes 4444 / XQ alpha slices include the final singleton run code required by RDD 36:2022. Six HD fixtures rejected by native macOS decoding now pass; syntax regression tests cover final runs and slice widths ([details](crates/prores/README.md#alpha-bitstream-conformance), EffectCraft #293).
+
 - **2026-10-12:** Transform's motion-blur shutter on adjustment layers uses the sequence frame rate instead of 24 fps, so a 360° shutter in a 60 fps sequence spans one frame, not 2.5 (#1088)
 - **2026-10-10 (changed media):** Settings ▸ Media ▸ Automatically refresh growing files works: media files that change on disk while the project is open (a recording still being written, a render written over the file a clip uses) are read again every *Refresh growing files every* seconds and as soon as the window comes back to the front: the new length, picture and identity, without an undo step (`media.refreshChanged`, `media_watch`).
 - **2026-10-10 (re-measure):** full parity re-measure against Premiere Pro 26.5.2: menu label diff 338 / 366 (92%), installed bundle listings (10 UI languages, exporter and codec frameworks), 188 open issues. Breadth ~86% (file formats now counted), ready ~55%, stage **alpha**; progress docs reorganized per the craftrules standard ([target-app-parity](docs/target-app-parity.md), [gaps](docs/gaps.md), [roadmap](docs/roadmap.md), [codec](docs/codec-parity.md), [file-format](docs/file-format-parity.md), [hardware](docs/hardware-parity.md), [UI](docs/ui-parity.md), [localization](docs/localization-parity.md)).
@@ -166,6 +168,8 @@ Ranked; detail and "done when" in [docs/roadmap.md](docs/roadmap.md) and [docs/g
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-22 | minor | ProRes alpha: write the final singleton run code; 4444/XQ HD clips that failed native macOS decoding now decode, with syntax regression tests (EffectCraft #293) |
+| 2026-10-13 | minor | Language table: German covers the whole interface (~100%) |
 | 2026-10-12 | trivial | Progress log: Transform shutter on adjustment layers (#1088) |
 | 2026-10-11 | minor | Language table: German ships the menus (#630, 10.6%) |
 | 2026-10-10 | minor | Readiness-by-audience table with hours to ~95% per audience |
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..706f5f247
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,37 @@
+# Security policy
+
+FilmCraft processes untrusted media, projects, interchange files, fonts and presets,
+and provides CLI, control-channel and MCP automation. Security reports about those
+inputs, automation boundaries, dependencies or release artifacts are welcome.
+
+## Reporting a vulnerability
+
+GitHub private vulnerability reporting is not currently enabled for this repository,
+and no dedicated private security address is documented. Contact the maintainers
+through the [project's existing community channels](https://discord.gg/artcraft)
+with a minimal, non-exploitable description and ask for a private transfer method.
+Do not publish a working exploit, malicious attachment, credential, private project,
+or sensitive crash dump in a public issue or chat. Wait for a private channel before
+sharing those details; if none is established, withhold sensitive material.
+
+A useful report includes the FilmCraft version or commit, operating system and
+architecture, affected component, impact, reproduction steps, and any workaround.
+For media or project parsing problems, initially describe the file format, size,
+cryptographic hash and whether the sample is synthetic or privately owned. Remove
+personal paths, credentials and unrelated project content from logs. Coordinate
+sample transfer with a maintainer instead of uploading a malicious file publicly.
+
+Please allow maintainers time to investigate and coordinate a fix before disclosing
+exploitable details. This policy does not promise a response deadline or a particular
+supported-version window. Include the exact affected version and, when safe to do
+so, whether the problem also occurs on the latest release.
+
+## Regression samples
+
+A regression fixture must be minimized, legally redistributable, free of private
+content, and documented with the expected safe failure. Follow [AGENTS.md](AGENTS.md)
+for clean-room implementation, asset attribution and the no-crash rules. Large media
+fixtures belong in the project's approved corpus workflow rather than ordinary PRs.
+
+Ordinary feature requests, editing problems and usage questions should use the
+normal issue forms or community help channel.
diff --git a/apps/filmcraft-cli/src/main.rs b/apps/filmcraft-cli/src/main.rs
index b57f1888b..cfc04fc3b 100644
--- a/apps/filmcraft-cli/src/main.rs
+++ b/apps/filmcraft-cli/src/main.rs
@@ -69,7 +69,9 @@ USAGE
 SUBCOMMANDS
   exec <id> [key=value ...]     run one command; prints its result as JSON
   exec <id> '<json params>'     same, params as one JSON object
-  run <script.jsonl | ->        run commands, one {\"id\",\"params\"} per line (# comments ok)
+  run <script.jsonl | ->        run commands, one {\"id\",\"params\"} per line (# comments ok), in
+                                order: file.exportMedia waits for its file before the next line
+                                (and before exit) unless its params say \"wait\": false
   commands [filter] [--json]    list commands (id, label, shortcut, params)
   describe <id>                 one command as JSON (menu, shortcut, params, enabled now)
   inspect [project|sequence]    project tree or active sequence as JSON (default: both)
@@ -135,6 +137,25 @@ fn usage(msg: impl std::fmt::Display) -> ! {
     std::process::exit(2)
 }
 
+/// Read a file off the runtime thread: `cli` is async because MCP, bridge calls and control
+/// commands await, so a blocking `std::fs` read would stall every other task on that thread.
+async fn read_file(path: impl Into<std::path::PathBuf>) -> std::io::Result<Vec<u8>> {
+    let path = path.into();
+    tokio::task::spawn_blocking(move || std::fs::read(path)).await.map_err(std::io::Error::other)?
+}
+
+/// `read_file` for UTF-8 text.
+async fn read_text(path: impl Into<std::path::PathBuf>) -> std::io::Result<String> {
+    let path = path.into();
+    tokio::task::spawn_blocking(move || std::fs::read_to_string(path)).await.map_err(std::io::Error::other)?
+}
+
+/// Write a file off the runtime thread; see `read_file`.
+async fn write_file(path: impl Into<std::path::PathBuf>, data: Vec<u8>) -> std::io::Result<()> {
+    let path = path.into();
+    tokio::task::spawn_blocking(move || std::fs::write(path, data)).await.map_err(std::io::Error::other)?
+}
+
 fn fail(msg: impl std::fmt::Display) -> ! {
     diag(format_args!("filmcraft-cli: {msg}"));
     std::process::exit(1)
@@ -169,9 +190,21 @@ impl Backend {
         Backend::Local(Box::new(s))
     }
 
-    async fn exec(&mut self, id: &str, params: Value) -> Result<Value, String> {
+    async fn exec(&mut self, id: &str, mut params: Value) -> Result<Value, String> {
         match self {
-            Backend::Local(s) => s.execute(id, params).map_err(|e| e.to_string()),
+            // this process exits after the command, so a background export would never be written:
+            // long commands wait unless the caller says otherwise (#2342)
+            Backend::Local(s) => {
+                if filmcraft_automation::long_job::LONG_COMMANDS.contains(&id)
+                    && let Some(p) = params.as_object_mut()
+                {
+                    // anything but an explicit `false` (missing, null, a typo'd value) waits
+                    if p.get("wait").and_then(Value::as_bool) != Some(false) {
+                        p.insert("wait".into(), json!(true));
+                    }
+                }
+                s.execute(id, params).map_err(|e| e.to_string())
+            }
             // a blocking export runs as an app job polled by the client (#91, #92)
             Backend::Bridge(b) => b.execute(id, params).await.map_err(|e| e.to_string()),
         }
@@ -293,7 +326,7 @@ async fn cli() {
         "bench-decode" => {
             let path = a.pos(1).unwrap_or_else(|| usage("bench-decode <media>"));
             let n: i64 = a.opt("--frames").and_then(|v| v.parse().ok()).unwrap_or(120);
-            let src = filmcraft_codecs::open_bytes(path, std::fs::read(path).unwrap_or_else(|e| fail(e)).into()).unwrap_or_else(|e| fail(e));
+            let src = filmcraft_codecs::open_bytes(path, read_file(path).await.unwrap_or_else(|e| fail(e)).into()).unwrap_or_else(|e| fail(e));
             let rate = src.info().frame_rate();
             let t0 = std::time::Instant::now();
             for f in 0..n {
@@ -349,7 +382,7 @@ async fn cli() {
             let text = if script == "-" {
                 std::io::read_to_string(std::io::stdin()).unwrap_or_else(|e| fail(e))
             } else {
-                std::fs::read_to_string(script).unwrap_or_else(|e| fail(format!("{script}: {e}")))
+                read_text(script).await.unwrap_or_else(|e| fail(format!("{script}: {e}")))
             };
             let mut b = Backend::open(&a);
             let mut failed = 0;
@@ -473,7 +506,7 @@ async fn cli() {
             let (img, offline) = render_at_playhead(&s, scale).unwrap_or_else(|e| fail(e));
             let dt = t0.elapsed();
             let png = filmcraft_automation::png_rgba(img.w as u32, img.h as u32, img.over_black_rgba8(), 0).unwrap_or_else(|e| fail(e));
-            std::fs::write(out, png).unwrap_or_else(|e| fail(format!("{out}: {e}")));
+            write_file(out, png).await.unwrap_or_else(|e| fail(format!("{out}: {e}")));
             let offline: Vec<Value> = offline.iter().filter_map(|o| serde_json::to_value(o).ok()).collect();
             check_offline(&a, &offline, &format!("render: {out}"));
             diag(format_args!("rendered {}x{} in {:.1} ms → {out}", img.w, img.h, dt.as_secs_f64() * 1000.0));
diff --git a/apps/filmcraft-cli/tests/cli.rs b/apps/filmcraft-cli/tests/it/cli.rs
similarity index 94%
rename from apps/filmcraft-cli/tests/cli.rs
rename to apps/filmcraft-cli/tests/it/cli.rs
index d5ded27fa..57db7ae47 100644
--- a/apps/filmcraft-cli/tests/cli.rs
+++ b/apps/filmcraft-cli/tests/it/cli.rs
@@ -3,7 +3,7 @@
 use std::io::Write;
 use std::process::{Command, Output, Stdio};
 
-use serde_json::Value;
+use serde_json::{Value, json};
 
 fn cli(args: &[&str]) -> Output {
     Command::new(env!("CARGO_BIN_EXE_filmcraft-cli")).args(args).output().expect("spawn filmcraft-cli")
@@ -150,6 +150,23 @@ fn export_wav_waits_for_job() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+#[test]
+fn run_waits_for_an_export_on_its_last_line() {
+    // #2342: `file.exportMedia` as the last line of a script is written before `run` exits
+    let dir = std::env::temp_dir().join(format!("fc-cli-run-x-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let out = dir.join("last.wav");
+    // `"wait": null` waits too: only an explicit `false` doesn't
+    let script = json!({"id": "file.exportMedia", "params": {"path": out.to_str().unwrap(), "format": "wav", "wait": null}}).to_string();
+    let mut child =
+        Command::new(env!("CARGO_BIN_EXE_filmcraft-cli")).args(["--demo", "run", "-"]).stdin(Stdio::piped()).stdout(Stdio::piped()).spawn().unwrap();
+    child.stdin.take().unwrap().write_all(format!("{script}\n").as_bytes()).unwrap();
+    let o = child.wait_with_output().unwrap();
+    assert!(o.status.success(), "{}", String::from_utf8_lossy(&o.stdout));
+    assert!(std::fs::metadata(&out).map(|m| m.len() > 44).unwrap_or(false), "{}", String::from_utf8_lossy(&o.stdout));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// `export --preset`: a built-in preset by name (dash or en dash), a custom range, a user preset
 /// from `--data-dir`, `--list-presets`, `--queue`, and a clean failure for an unknown preset.
 #[test]
diff --git a/apps/filmcraft-cli/tests/it/main.rs b/apps/filmcraft-cli/tests/it/main.rs
new file mode 100644
index 000000000..9bdd14068
--- /dev/null
+++ b/apps/filmcraft-cli/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod cli;
+mod workflows;
diff --git a/apps/filmcraft-cli/tests/workflows.rs b/apps/filmcraft-cli/tests/it/workflows.rs
similarity index 100%
rename from apps/filmcraft-cli/tests/workflows.rs
rename to apps/filmcraft-cli/tests/it/workflows.rs
diff --git a/apps/filmcraft-web/src/download_pacing.rs b/apps/filmcraft-web/src/download_pacing.rs
index 01f9f4212..944e74bd3 100644
--- a/apps/filmcraft-web/src/download_pacing.rs
+++ b/apps/filmcraft-web/src/download_pacing.rs
@@ -1,4 +1,4 @@
-//! Spacing of browser downloads (pure, so it is tested natively in `tests/download_pacing.rs`; the
+//! Spacing of browser downloads (pure, so it is tested natively in `tests/it/download_pacing.rs`; the
 //! anchor clicks live in [`crate::fs::download`]).
 //!
 //! Chrome drops anchor-click downloads that start in one tight burst, so an image-sequence export
diff --git a/apps/filmcraft-web/src/fs.rs b/apps/filmcraft-web/src/fs.rs
index 416fbf9d7..7f715b4da 100644
--- a/apps/filmcraft-web/src/fs.rs
+++ b/apps/filmcraft-web/src/fs.rs
@@ -352,6 +352,24 @@ impl Services for WebServices {
         Ok(())
     }
 
+    fn write_file_new(&self, path: &str, data: &[u8]) -> io::Result<()> {
+        if path.starts_with("/opfs/") {
+            return Err(io::Error::new(io::ErrorKind::Unsupported, "exclusive OPFS writes are unavailable"));
+        }
+        let hook = FS.with(|fs| {
+            let mut fs = fs.borrow_mut();
+            if fs.entries.contains_key(path) {
+                return Err(io::Error::from(io::ErrorKind::AlreadyExists));
+            }
+            fs.entries.insert(path.to_owned(), Entry::Mem(Arc::from(data)));
+            Ok(fs.on_write.clone())
+        })?;
+        if let Some(h) = hook {
+            h(path, data);
+        }
+        Ok(())
+    }
+
     fn file_size(&self, path: &str) -> io::Result<u64> {
         Self::entry_reader(path).map(|r| r.len())
     }
@@ -406,6 +424,10 @@ impl Services for WebServices {
     }
 }
 
+thread_local! {
+    static DOWNLOAD_CLOCK: web_time::Instant = web_time::Instant::now();
+}
+
 /// Offer bytes as a browser download named `name`. Downloads are clicked at least
 /// [`crate::download_pacing::GAP_MS`] apart: Chrome drops a burst of them (#378).
 pub fn download(name: &str, data: &[u8]) -> Result<(), wasm_bindgen::JsValue> {
@@ -416,7 +438,8 @@ pub fn download(name: &str, data: &[u8]) -> Result<(), wasm_bindgen::JsValue> {
     a.set_href(&url);
     a.set_download(file_name(name));
     a.style().set_property("display", "none")?;
-    let delay = DOWNLOADS.with(|d| d.borrow_mut().reserve(js_sys::Date::now()));
+    let now_ms = DOWNLOAD_CLOCK.with(|clock| clock.elapsed().as_secs_f64() * 1000.0);
+    let delay = DOWNLOADS.with(|d| d.borrow_mut().reserve(now_ms));
     let name = name.to_owned();
     wasm_bindgen_futures::spawn_local(async move {
         if delay > 0.0 {
@@ -435,3 +458,32 @@ pub fn download(name: &str, data: &[u8]) -> Result<(), wasm_bindgen::JsValue> {
     });
     Ok(())
 }
+
+#[cfg(test)]
+mod exclusive_write_tests {
+    use super::*;
+
+    #[test]
+    fn virtual_file_creation_is_exclusive_and_opfs_fails_closed() {
+        let host = WebServices;
+        let existing = "/files/collision-test.wav";
+        let fresh = "/files/new-extraction-test.wav";
+        FS.with(|fs| {
+            let mut fs = fs.borrow_mut();
+            fs.on_write = None;
+            fs.entries.insert(existing.into(), Entry::Mem(Arc::from(&b"original"[..])));
+            fs.entries.remove(fresh);
+        });
+        assert_eq!(host.write_file_new(existing, b"replacement").unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+        assert_eq!(host.read_file(existing).unwrap(), b"original");
+        host.write_file_new(fresh, b"new").unwrap();
+        assert_eq!(host.read_file(fresh).unwrap(), b"new");
+        assert_eq!(host.write_file_new(fresh, b"again").unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+        assert_eq!(host.write_file_new("/opfs/media/new.wav", b"new").unwrap_err().kind(), io::ErrorKind::Unsupported);
+        FS.with(|fs| {
+            let mut fs = fs.borrow_mut();
+            fs.entries.remove(existing);
+            fs.entries.remove(fresh);
+        });
+    }
+}
diff --git a/apps/filmcraft-web/src/import.rs b/apps/filmcraft-web/src/import.rs
index a075f9a93..44d293b75 100644
--- a/apps/filmcraft-web/src/import.rs
+++ b/apps/filmcraft-web/src/import.rs
@@ -264,7 +264,7 @@ pub fn install_hooks(app: &mut FilmcraftApp) {
     // Saving writes the file in memory and offers it as a download (`fs::WebServices`).
     app.hooks.pick_save = Some(Box::new(|name: &str| Some(format!("/projects/{name}"))));
     app.hooks.pick_save_as = Some(Box::new(|_filter: &str, _exts: &[&str], name: &str| {
-        let file = std::path::Path::new(name).file_name().map_or(name.into(), |n| n.to_string_lossy());
+        let file = std::path::Path::new(name).file_name().map_or(name.into(), std::ffi::OsStr::to_string_lossy);
         Some(format!("/exports/{file}"))
     }));
     // Link Media ▸ Locate…, Attach Proxies, Reconnect Full Resolution: the picker is async, so the
diff --git a/apps/filmcraft-web/src/lib.rs b/apps/filmcraft-web/src/lib.rs
index 21512ccc5..1110c64e4 100644
--- a/apps/filmcraft-web/src/lib.rs
+++ b/apps/filmcraft-web/src/lib.rs
@@ -94,12 +94,13 @@ impl eframe::App for WebApp {
         self.app.raw_input_hook(ctx, raw_input);
     }
 
-    fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
+    /// Hidden logic pass: host actions, app logic, API replies, jobs, audio, autosave, then IME reset; it does not draw UI.
+    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         let actions = ACTIONS.with(|a| std::mem::take(&mut *a.borrow_mut()));
         for f in actions {
             f(self, ctx);
         }
-        self.app.logic(ctx, frame);
+        self.app.logic_inner(ctx);
         api::poll_replies();
         // exports advance between frames (no threads)
         if self.app.session.pump_jobs(std::time::Duration::from_millis(30)) {
@@ -109,6 +110,7 @@ impl eframe::App for WebApp {
             a.pump();
         }
         self.autosave.tick(&self.app.session, ctx);
+        self.app.finish_ime_reset_logic(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
@@ -159,6 +161,7 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
             canvas,
             web_options,
             Box::new(move |cc| {
+                filmcraft_ui_egui::install_ime_reset_callbacks(&cc.egui_ctx);
                 set_context(cc.egui_ctx.clone());
                 let ctx = cc.egui_ctx.clone();
                 fs::set_on_data(move || ctx.request_repaint());
diff --git a/apps/filmcraft-web/src/recovery.rs b/apps/filmcraft-web/src/recovery.rs
index 6001531e8..fc556013a 100644
--- a/apps/filmcraft-web/src/recovery.rs
+++ b/apps/filmcraft-web/src/recovery.rs
@@ -28,10 +28,18 @@ enum Outcome {
     Clean { ok: bool },
 }
 
-#[derive(Default)]
 pub struct Autosave {
     policy: Policy,
     outcomes: Rc<RefCell<Vec<Outcome>>>,
+    /// Monotonic host clock. Web `logic` may run for hidden tabs; egui's input time is stale there.
+    clock: web_time::Instant,
+}
+
+impl Default for Autosave {
+    /// Default policy with a monotonic host clock, so hidden-tab logic never uses a stale egui input time.
+    fn default() -> Self {
+        Self { policy: Policy::default(), outcomes: Rc::default(), clock: web_time::Instant::now() }
+    }
 }
 
 impl Autosave {
@@ -40,7 +48,7 @@ impl Autosave {
         if !opfs::available() {
             return;
         }
-        let now = ctx.input(|i| i.time);
+        let now = self.clock.elapsed().as_secs_f64();
         for o in self.outcomes.borrow_mut().drain(..) {
             match o {
                 Outcome::Snapshot { revision, ok } => self.policy.written(revision, ok, now),
@@ -64,7 +72,9 @@ impl Autosave {
                         }
                     })
                 };
-                let meta = json!({"dirty": true, "name": s.project.name, "revision": s.revision, "time": js_sys::Date::now()});
+                // No wall-clock timestamp: recovery policy scheduling uses the monotonic clock
+                // above, and the snapshot schema needs no display time.
+                let meta = json!({"dirty": true, "name": s.project.name, "revision": s.revision});
                 let d1 = done(self.outcomes.clone(), failed.clone(), left.clone(), ctx.clone());
                 let d2 = done(self.outcomes.clone(), failed, left, ctx.clone());
                 opfs::write_then(SNAPSHOT.into(), filmcraft_format::encode(&s.project, false), Some(d1));
diff --git a/apps/filmcraft-web/src/recovery_policy.rs b/apps/filmcraft-web/src/recovery_policy.rs
index 8426d3c39..7a2e0fc26 100644
--- a/apps/filmcraft-web/src/recovery_policy.rs
+++ b/apps/filmcraft-web/src/recovery_policy.rs
@@ -1,5 +1,5 @@
 //! When the web recovery snapshot is written or marked clean (pure, so it is tested natively in
-//! `tests/recovery_policy.rs`; the OPFS side lives in [`crate::recovery`]).
+//! `tests/it/recovery_policy.rs`; the OPFS side lives in [`crate::recovery`]).
 //!
 //! - A dirty project is snapshotted at most every [`INTERVAL_S`] seconds, once per revision. A write
 //!   that fails is retried after the interval, without waiting for another edit (#197).
diff --git a/apps/filmcraft-web/src/webcodecs.rs b/apps/filmcraft-web/src/webcodecs.rs
index 48fa7a1c8..48b1d3bad 100644
--- a/apps/filmcraft-web/src/webcodecs.rs
+++ b/apps/filmcraft-web/src/webcodecs.rs
@@ -68,8 +68,15 @@ thread_local! {
     static TRANSFERS: RefCell<Transfers> = RefCell::new(Transfers::default());
 }
 
+thread_local! {
+    /// Monotonic browser clock. `Date::now()` is wall time and can move backwards across NTP or
+    /// suspend/resume; codec idle/staleness accounting must not.
+    static CLOCK: web_time::Instant = web_time::Instant::now();
+}
+
+/// Milliseconds from a monotonic browser clock; codec idle and staleness accounting must never use wall time.
 fn now_ms() -> f64 {
-    js_sys::Date::now()
+    CLOCK.with(|clock| clock.elapsed().as_secs_f64() * 1000.0)
 }
 
 fn get(o: &JsValue, k: &str) -> JsValue {
diff --git a/apps/filmcraft-web/tests/download_pacing.rs b/apps/filmcraft-web/tests/it/download_pacing.rs
similarity index 87%
rename from apps/filmcraft-web/tests/download_pacing.rs
rename to apps/filmcraft-web/tests/it/download_pacing.rs
index 893f40d3f..4f2ee8d26 100644
--- a/apps/filmcraft-web/tests/download_pacing.rs
+++ b/apps/filmcraft-web/tests/it/download_pacing.rs
@@ -1,10 +1,10 @@
 //! Download spacing. It is pure, so it runs natively even though the rest of the crate is
 //! wasm32-only.
 
-#[path = "../src/download_pacing.rs"]
-mod download_pacing;
+#[path = "../../src/download_pacing.rs"]
+mod pacing;
 
-use download_pacing::{GAP_MS, Pacer};
+use pacing::{GAP_MS, Pacer};
 
 /// #378: 20 downloads requested in the same instant are spread out, not clicked in one burst.
 #[test]
diff --git a/apps/filmcraft-web/tests/it/main.rs b/apps/filmcraft-web/tests/it/main.rs
new file mode 100644
index 000000000..a223d161d
--- /dev/null
+++ b/apps/filmcraft-web/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod download_pacing;
+mod recovery_policy;
diff --git a/apps/filmcraft-web/tests/recovery_policy.rs b/apps/filmcraft-web/tests/it/recovery_policy.rs
similarity index 96%
rename from apps/filmcraft-web/tests/recovery_policy.rs
rename to apps/filmcraft-web/tests/it/recovery_policy.rs
index c60b34d5b..fe64599d7 100644
--- a/apps/filmcraft-web/tests/recovery_policy.rs
+++ b/apps/filmcraft-web/tests/it/recovery_policy.rs
@@ -1,10 +1,10 @@
 //! The web recovery snapshot policy. It is pure, so it runs natively even though the rest of the
 //! crate is wasm32-only.
 
-#[path = "../src/recovery_policy.rs"]
-mod recovery_policy;
+#[path = "../../src/recovery_policy.rs"]
+mod policy;
 
-use recovery_policy::{Action, INTERVAL_S, Policy};
+use policy::{Action, INTERVAL_S, Policy};
 
 /// #197: a snapshot write that fails is retried after the interval without another edit.
 #[test]
diff --git a/apps/filmcraft/Cargo.toml b/apps/filmcraft/Cargo.toml
index 3ae35e6c6..9e3f1cba8 100644
--- a/apps/filmcraft/Cargo.toml
+++ b/apps/filmcraft/Cargo.toml
@@ -27,14 +27,16 @@ filmcraft-gpu = { workspace = true }
 filmcraft-ui-egui = { workspace = true }
 filmcraft-platform = { workspace = true }
 egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard", "wayland", "x11"] }
 serde_json = { workspace = true }
+# Constant-time comparison of control-channel credentials.
+subtle = "2.6"
 log = { workspace = true }
 rfd = { workspace = true }
 cpal = "0.16"
 # Files and images on the system clipboard for Paste (#611); egui already uses it for text.
 arboard = "3"
-chrono = { version = "0.4", default-features = false, features = ["clock"] }
+chrono = { workspace = true, features = ["clock"] }
 sys-locale = "0.3"
 # Help menu / About / Discord links in the system browser (MIT; as PhotoCraft).
 open = "5"
@@ -42,7 +44,7 @@ open = "5"
 [dev-dependencies]
 glob = "0.3"
 # graphics.rs: enumerate the real adapters in a test.
-pollster = "0.4"
+pollster = "1"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 muda = "0.21"
@@ -52,6 +54,9 @@ objc2 = "0.6"
 # Same winit as eframe: macOS event-loop options (no app activation when driven by an agent).
 winit = { version = "0.30", default-features = false }
 
+[target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
+winit = { version = "0.30", default-features = false, features = ["x11"] }
+
 [target.'cfg(target_os = "linux")'.dependencies]
 # Settings ▸ Appearance ▸ Sync with system: the XDG desktop portal's colour scheme. The zbus the
 # portal file dialogs (rfd) and accesskit already use.
@@ -60,3 +65,6 @@ zbus = "5.19"
 # Icon + VERSIONINFO for filmcraft.exe (build.rs); only needed when building on Windows.
 [target.'cfg(windows)'.build-dependencies]
 winresource = "0.1"
+
+[target.'cfg(windows)'.dependencies]
+craft-update = { workspace = true }
diff --git a/apps/filmcraft/src/args.rs b/apps/filmcraft/src/args.rs
index c64e3509f..130e23ee2 100644
--- a/apps/filmcraft/src/args.rs
+++ b/apps/filmcraft/src/args.rs
@@ -9,7 +9,8 @@ Usage: filmcraft [options] [project.fcproj | media files...]
 
 Options:
   --control <port>   start the localhost JSON-lines control server
-                     (also: FILMCRAFT_CONTROL_PORT)
+                     (also: FILMCRAFT_CONTROL_PORT; requires FILMCRAFT_CONTROL_TOKEN,
+                     64 random hex characters; see docs/control-protocol.md)
   --control-input-only  accept widget input only from the control server
                      (requires --control or FILMCRAFT_CONTROL_PORT)
   --demo             open the demo project
diff --git a/apps/filmcraft/src/audio.rs b/apps/filmcraft/src/audio.rs
index cb56e059e..a29596f81 100644
--- a/apps/filmcraft/src/audio.rs
+++ b/apps/filmcraft/src/audio.rs
@@ -51,11 +51,12 @@ enum Note {
 }
 
 impl Note {
+    /// Localized status text for a fallback device (name interpolated through `fmt`) or for no output device.
     fn text(&self) -> String {
         use filmcraft_ui_egui::i18n::{fmt, t};
         match self {
             Note::Fallback(device) => fmt(t("Audio hardware: the default output device cannot be opened; using '{device}'"), &[("device", device)]),
-            Note::NoDevice => t("No audio output device found: playing without sound (check Settings ▸ Audio Hardware)").to_string(),
+            Note::NoDevice => t("No audio output device found: playing without sound (check Settings > Audio Hardware)").to_string(),
         }
     }
 }
diff --git a/apps/filmcraft/src/control_server.rs b/apps/filmcraft/src/control_server.rs
index d3b40f320..cba27a6b0 100644
--- a/apps/filmcraft/src/control_server.rs
+++ b/apps/filmcraft/src/control_server.rs
@@ -4,7 +4,9 @@
 //! (an HTTP request line from a browser's cross-origin `fetch`, a stray `nc`, binary junk) gets
 //! one error reply and the connection is closed, so nothing after it is executed. Lines are
 //! bounded ([`MAX_LINE`]) and so is the number of open connections ([`MAX_CONNECTIONS`]); junk
-//! never reaches the UI thread. See `docs/control-protocol.md`.
+//! never reaches the UI thread. Every request must carry the session credential from
+//! `FILMCRAFT_CONTROL_TOKEN`; without a configured credential the listener stays closed.
+//! See `docs/control-protocol.md`.
 
 use std::io::{BufRead, BufReader, Read, Write};
 use std::net::{TcpListener, TcpStream};
@@ -15,15 +17,28 @@ use std::time::Duration;
 
 use filmcraft_ui_egui::ControlRequest;
 use serde_json::{Value, json};
+use subtle::ConstantTimeEq;
 
 /// Longest accepted request line (bytes, without the newline). Requests are small JSON objects;
 /// anything longer is refused and the connection closed.
 pub const MAX_LINE: usize = 4 * 1024 * 1024;
 /// Connections served at once; further ones get an error line and are closed.
 pub const MAX_CONNECTIONS: usize = 16;
+/// A peer that stops sending or reading must eventually give back its connection slot.
+const CONNECTION_TIMEOUT: Duration = Duration::from_secs(120);
 
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
+    start_with_token(port, ctx, std::env::var("FILMCRAFT_CONTROL_TOKEN").ok())
+}
+
+fn start_with_token(port: u16, ctx: egui::Context, token: Option<String>) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
+    // An inherited environment variable shares the credential with the owner's bridge process
+    // without exposing it in command-line arguments, logs, or a shared discovery file.
+    let Some(token) = token.filter(|t| t.len() == 64 && t.bytes().all(|b| b.is_ascii_hexdigit())) else {
+        eprintln!("filmcraft: control server disabled: FILMCRAFT_CONTROL_TOKEN must contain 64 random hex characters (see docs/control-protocol.md)");
+        return rx;
+    };
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
         Ok(l) => l,
         Err(e) => {
@@ -32,11 +47,11 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
         }
     };
     eprintln!("filmcraft: control server listening on 127.0.0.1:{port}");
-    std::thread::spawn(move || accept_loop(listener, tx, ctx));
+    std::thread::spawn(move || accept_loop(listener, tx, ctx, token));
     rx
 }
 
-fn accept_loop(listener: TcpListener, tx: Sender<ControlRequest>, ctx: egui::Context) {
+fn accept_loop(listener: TcpListener, tx: Sender<ControlRequest>, ctx: egui::Context, token: String) {
     let open = Arc::new(AtomicUsize::new(0));
     for mut stream in listener.incoming().flatten() {
         if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
@@ -46,12 +61,13 @@ fn accept_loop(listener: TcpListener, tx: Sender<ControlRequest>, ctx: egui::Con
         }
         let tx = tx.clone();
         let ctx = ctx.clone();
+        let token = token.clone();
         // The slot is given back when the guard drops: after `serve` returns, if it panics, or if
         // the thread can't be started (the closure, and with it the guard, is dropped).
         let slot = Slot(Arc::clone(&open));
         let spawned = std::thread::Builder::new().name("control-conn".into()).spawn(move || {
             let _slot = slot;
-            serve(stream, &tx, &ctx);
+            serve(stream, &tx, &ctx, &token);
         });
         if let Err(e) = spawned {
             eprintln!("filmcraft: control server could not start a connection thread: {e}");
@@ -68,14 +84,23 @@ impl Drop for Slot {
     }
 }
 
-fn serve(stream: TcpStream, tx: &Sender<ControlRequest>, ctx: &egui::Context) {
-    let Ok(read) = stream.try_clone() else { return };
-    serve_lines(read, stream, |method, params| {
+fn serve(stream: TcpStream, tx: &Sender<ControlRequest>, ctx: &egui::Context, token: &str) {
+    if let Err(e) = serve_with_timeout(stream, tx, ctx, token, CONNECTION_TIMEOUT) {
+        eprintln!("filmcraft: could not configure control connection: {e}");
+    }
+}
+
+fn serve_with_timeout(stream: TcpStream, tx: &Sender<ControlRequest>, ctx: &egui::Context, token: &str, timeout: Duration) -> std::io::Result<()> {
+    stream.set_read_timeout(Some(timeout))?;
+    stream.set_write_timeout(Some(timeout))?;
+    let read = stream.try_clone()?;
+    serve_lines(read, stream, token, |method, params| {
         let (req, rrx) = ControlRequest::new(method, params);
         tx.send(req).ok()?;
         ctx.request_repaint();
         Some(rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"})))
     });
+    Ok(())
 }
 
 /// One parsed line.
@@ -90,7 +115,7 @@ enum Line {
     Reject(String),
 }
 
-fn parse_line(bytes: &[u8]) -> Line {
+fn parse_line(bytes: &[u8], token: &str) -> Line {
     let Ok(text) = std::str::from_utf8(bytes) else {
         return Line::Reject("not a control request (invalid UTF-8); closing the connection".into());
     };
@@ -108,16 +133,31 @@ fn parse_line(bytes: &[u8]) -> Line {
     let Some(method) = obj.get("method").and_then(Value::as_str) else {
         return Line::Reject("not a control request (missing string `method`); closing the connection".into());
     };
+    // Authenticate every request before constructing or enqueueing a ControlRequest. A valid
+    // earlier request must not authorize a later one with a missing or incorrect credential.
+    let authenticated = obj.get("token").and_then(Value::as_str).is_some_and(|supplied| bool::from(supplied.as_bytes().ct_eq(token.as_bytes())));
+    if !authenticated {
+        return Line::Reject("control authentication failed; closing the connection".into());
+    }
     Line::Request { id: obj.get("id").cloned().unwrap_or(Value::Null), method: method.to_string(), params: obj.get("params").cloned().unwrap_or(json!({})) }
 }
 
+#[derive(Debug, PartialEq, Eq)]
+enum ReadFailure {
+    Timeout,
+    Rejected(String),
+}
+
 /// Read one `\n`-terminated line of at most `max` bytes into `buf` (newline stripped).
 /// `Ok(false)` at end of stream; `Err` when the line is too long or the read fails.
-fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -> Result<bool, String> {
+fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -> Result<bool, ReadFailure> {
     buf.clear();
     // `take` bounds the bytes buffered for one line: a peer can't make us allocate more than `max`.
     let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
-    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| e.to_string())?;
+    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| match e.kind() {
+        std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => ReadFailure::Timeout,
+        _ => ReadFailure::Rejected(e.to_string()),
+    })?;
     if n == 0 {
         return Ok(false);
     }
@@ -129,7 +169,7 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -
         return Ok(true);
     }
     if buf.len() > max {
-        return Err(format!("request line longer than {max} bytes; closing the connection"));
+        return Err(ReadFailure::Rejected(format!("request line longer than {max} bytes; closing the connection")));
     }
     // Last line without a newline, then end of stream.
     Ok(true)
@@ -138,14 +178,17 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -
 /// Serve requests from `read`, answering on `out`, until the peer closes, sends something that is
 /// not a request, or `handle` returns `None` (app gone). `handle` gets `(method, params)` and
 /// returns the reply object (the request's `id` is added here).
-fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(String, Value) -> Option<Value>) {
+fn serve_lines<R: Read, W: Write>(read: R, mut out: W, token: &str, mut handle: impl FnMut(String, Value) -> Option<Value>) {
     let mut reader = BufReader::new(read);
     let mut buf = Vec::new();
     loop {
         let reject = match read_bounded_line(&mut reader, &mut buf, MAX_LINE) {
             Ok(false) => return,
-            Err(e) => e,
-            Ok(true) => match parse_line(&buf) {
+            // Expiration is not a request: a pooled client must see EOF and reconnect, rather
+            // than read a stale error reply. A partial line must not be parsed on timeout.
+            Err(ReadFailure::Timeout) => return,
+            Err(ReadFailure::Rejected(e)) => e,
+            Ok(true) => match parse_line(&buf, token) {
                 Line::Blank => continue,
                 Line::Reject(e) => e,
                 Line::Request { id, method, params } => {
@@ -169,10 +212,12 @@ fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(St
 mod tests {
     use super::*;
 
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
     fn run(input: &[u8]) -> (Vec<Value>, Vec<String>) {
         let mut out = Vec::new();
         let mut calls = Vec::new();
-        serve_lines(input, &mut out, |m, _p| {
+        serve_lines(input, &mut out, TOKEN, |m, _p| {
             calls.push(m);
             Some(json!({"ok": true, "result": null}))
         });
@@ -182,7 +227,10 @@ mod tests {
 
     #[test]
     fn requests_are_answered_in_order_with_ids() {
-        let (r, calls) = run(b"{\"id\":1,\"method\":\"a\"}\n\n{\"id\":2,\"method\":\"b\",\"params\":{}}\r\n{\"method\":\"c\"}");
+        let input = format!(
+            "{{\"token\":\"{TOKEN}\",\"id\":1,\"method\":\"a\"}}\n\n{{\"token\":\"{TOKEN}\",\"id\":2,\"method\":\"b\",\"params\":{{}}}}\r\n{{\"token\":\"{TOKEN}\",\"method\":\"c\"}}"
+        );
+        let (r, calls) = run(input.as_bytes());
         assert_eq!(calls, ["a", "b", "c"]);
         assert_eq!(r.len(), 3);
         assert_eq!(r[0]["id"], 1);
@@ -220,7 +268,8 @@ mod tests {
 
     #[test]
     fn a_request_before_junk_still_runs() {
-        let (r, calls) = run(b"{\"method\":\"a\"}\nGET / HTTP/1.1\n{\"method\":\"b\"}\n");
+        let input = format!("{{\"token\":\"{TOKEN}\",\"method\":\"a\"}}\nGET / HTTP/1.1\n{{\"token\":\"{TOKEN}\",\"method\":\"b\"}}\n");
+        let (r, calls) = run(input.as_bytes());
         assert_eq!(calls, ["a"]);
         assert_eq!(r.len(), 2);
         assert_eq!(r[1]["ok"], false);
@@ -256,11 +305,11 @@ mod tests {
         let server = std::thread::spawn(move || {
             let (s, _) = listener.accept().unwrap();
             let read = s.try_clone().unwrap();
-            serve_lines(read, s, |_, _| Some(json!({"ok": true})));
+            serve_lines(read, s, TOKEN, |_, _| Some(json!({"ok": true})));
         });
         let mut c = TcpStream::connect(addr).unwrap();
         c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-        c.write_all(b"{\"id\":7,\"method\":\"x\"}\nhello\n{\"method\":\"y\"}\n").unwrap();
+        c.write_all(format!("{{\"token\":\"{TOKEN}\",\"id\":7,\"method\":\"x\"}}\nhello\n{{\"token\":\"{TOKEN}\",\"method\":\"y\"}}\n").as_bytes()).unwrap();
         let mut text = String::new();
         c.read_to_string(&mut text).unwrap(); // returns at EOF: the server closed the connection
         server.join().unwrap();
@@ -275,7 +324,7 @@ mod tests {
         let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
         let addr = listener.local_addr().unwrap();
         let (tx, _rx) = channel::<ControlRequest>();
-        std::thread::spawn(move || accept_loop(listener, tx, egui::Context::default()));
+        std::thread::spawn(move || accept_loop(listener, tx, egui::Context::default(), TOKEN.into()));
         // Idle connections are accepted in order and held open.
         let held: Vec<TcpStream> = (0..16).map(|_| TcpStream::connect(addr).unwrap()).collect();
         let mut extra = TcpStream::connect(addr).unwrap();
@@ -285,4 +334,200 @@ mod tests {
         assert!(line.contains("too many control connections"), "{line}");
         drop(held);
     }
+
+    /// Idle and unterminated requests must release a counted connection without client EOF.
+    fn timed_out_connection_releases_slot(partial: &[u8]) {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let open = Arc::new(AtomicUsize::new(1));
+        let counted = Arc::clone(&open);
+        let (tx, rx) = channel::<ControlRequest>();
+        let (done, finished) = channel();
+        let server = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            {
+                let _slot = Slot(counted);
+                serve_with_timeout(stream, &tx, &egui::Context::default(), TOKEN, Duration::from_millis(100)).unwrap();
+            }
+            done.send(()).unwrap();
+        });
+        let mut client = TcpStream::connect(addr).unwrap();
+        client.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        client.write_all(partial).unwrap();
+        let completion = finished.recv_timeout(Duration::from_secs(5));
+        let mut unsolicited = String::new();
+        if completion.is_ok() {
+            client.read_to_string(&mut unsolicited).unwrap();
+        }
+        // Always unblock and join the test worker before asserting, even on the unfixed server.
+        let unexpected_command = rx.try_recv().is_ok();
+        drop(rx);
+        drop(client);
+        server.join().unwrap();
+        assert!(completion.is_ok(), "an idle peer held its connection slot until the client closed");
+        assert!(unsolicited.is_empty(), "expiration must not leave a stale reply for a pooled client: {unsolicited}");
+        assert_eq!(open.load(Ordering::SeqCst), 0);
+        assert!(!unexpected_command, "an incomplete request must not reach the UI queue");
+    }
+
+    #[test]
+    /// A silent unauthenticated peer must not retain control-server capacity.
+    fn idle_connection_releases_its_slot() {
+        timed_out_connection_releases_slot(b"");
+    }
+
+    #[test]
+    /// Sending a partial JSON line must not bypass idle expiration.
+    fn unterminated_request_releases_its_slot() {
+        timed_out_connection_releases_slot(b"{\"method\":");
+    }
+
+    #[test]
+    /// A timeout is not EOF: valid JSON without its newline must not be dispatched.
+    fn valid_unterminated_request_is_not_dispatched() {
+        let request = json!({"id": 1, "token": TOKEN, "method": "ui.inspect"}).to_string();
+        timed_out_connection_releases_slot(request.as_bytes());
+    }
+
+    #[test]
+    /// Waiting for the UI is separate from socket idleness; buffered requests remain answerable.
+    fn idle_timeout_does_not_cancel_a_pending_ui_reply() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let server = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            serve_with_timeout(stream, &tx, &egui::Context::default(), TOKEN, Duration::from_millis(100)).unwrap();
+        });
+        let mut client = TcpStream::connect(addr).unwrap();
+        client.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        let mut read = BufReader::new(client.try_clone().unwrap());
+        // Buffer complete requests, as the bridge does. Queue both before waiting for replies:
+        // client scheduling after reply 1 must not create a genuine idle gap in this test.
+        let requests: String = [1, 2].into_iter().map(|id| format!("{}\n", json!({"token": TOKEN, "id": id, "method": "ui.inspect"}))).collect();
+        client.write_all(requests.as_bytes()).unwrap();
+        for id in [1, 2] {
+            let request = rx.recv_timeout(Duration::from_secs(5)).unwrap_or_else(|e| panic!("request {id} did not reach the UI: {e}"));
+            // Deliberately exceed the read timeout while the server is awaiting a UI reply.
+            std::thread::sleep(Duration::from_millis(250));
+            request.reply.send(json!({"ok": true})).unwrap();
+            let mut line = String::new();
+            read.read_line(&mut line).unwrap();
+            assert_eq!(serde_json::from_str::<Value>(&line).unwrap(), json!({"id": id, "ok": true}));
+        }
+        client.shutdown(std::net::Shutdown::Write).unwrap();
+        server.join().unwrap();
+    }
+
+    #[test]
+    /// An active client can send another request after consuming its previous reply.
+    fn active_connection_can_be_reused() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let server = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            serve_with_timeout(stream, &tx, &egui::Context::default(), TOKEN, Duration::from_secs(5)).unwrap();
+        });
+        let mut client = TcpStream::connect(addr).unwrap();
+        client.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        let mut read = BufReader::new(client.try_clone().unwrap());
+        for id in [1, 2] {
+            let line = format!("{}\n", json!({"token": TOKEN, "id": id, "method": "ui.inspect"}));
+            client.write_all(line.as_bytes()).unwrap();
+            rx.recv_timeout(Duration::from_secs(5)).unwrap().reply.send(json!({"ok": true})).unwrap();
+            let mut reply = String::new();
+            read.read_line(&mut reply).unwrap();
+            assert_eq!(serde_json::from_str::<Value>(&reply).unwrap(), json!({"id": id, "ok": true}));
+        }
+        client.shutdown(std::net::Shutdown::Write).unwrap();
+        server.join().unwrap();
+    }
+
+    #[test]
+    fn missing_or_invalid_token_leaves_the_listener_closed() {
+        for token in [None, Some(String::new()), Some("a".repeat(63)), Some("a".repeat(65)), Some("z".repeat(64))] {
+            let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+            let port = listener.local_addr().unwrap().port();
+            drop(listener);
+            let rx = start_with_token(port, egui::Context::default(), token);
+            assert!(matches!(rx.try_recv(), Err(std::sync::mpsc::TryRecvError::Disconnected)));
+            let _still_available = TcpListener::bind(("127.0.0.1", port)).unwrap();
+        }
+    }
+
+    #[test]
+    fn unauthenticated_save_as_closes_before_any_command_runs() {
+        for token in
+            [Value::Null, json!(false), json!(42), json!([]), json!({}), json!(""), json!("a".repeat(64)), json!(&TOKEN[..63]), json!(format!("{TOKEN}0"))]
+        {
+            let mut request = json!({"id": 1, "method": "engine.execute", "params": {"command": "file.saveAs", "params": {"path": "/owner/project.fcproj"}}});
+            if !token.is_null() {
+                request["token"] = token;
+            }
+            // A valid request after a rejected one must never execute, either.
+            let input = format!("{request}\n{}\n", json!({"token": TOKEN, "method": "ui.inspect"}));
+            let (replies, calls) = run(input.as_bytes());
+            assert!(calls.is_empty());
+            assert_eq!(replies, [json!({"ok": false, "error": "control authentication failed; closing the connection"})]);
+        }
+    }
+
+    #[test]
+    fn authentication_is_required_on_every_request() {
+        let input = format!(
+            "{}\n{}\n{}\n",
+            json!({"token": TOKEN, "method": "ui.inspect"}),
+            json!({"method": "app.quit"}),
+            json!({"token": TOKEN, "method": "app.quit"})
+        );
+        let (replies, calls) = run(input.as_bytes());
+        assert_eq!(calls, ["ui.inspect"]);
+        assert_eq!(replies.len(), 2);
+        assert_eq!(replies[1]["ok"], false);
+    }
+
+    #[test]
+    fn tcp_authentication_happens_before_enqueueing() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let server = std::thread::spawn(move || {
+            let (s, _) = listener.accept().unwrap();
+            serve(s, &tx, &egui::Context::default(), TOKEN);
+        });
+        let mut c = TcpStream::connect(addr).unwrap();
+        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        c.write_all(b"{\"method\":\"engine.execute\",\"params\":{\"command\":\"file.saveAs\",\"params\":{\"path\":\"/owner/project.fcproj\"}}}\n").unwrap();
+        c.shutdown(std::net::Shutdown::Write).unwrap();
+        let mut reply = String::new();
+        c.read_to_string(&mut reply).unwrap();
+        server.join().unwrap();
+        assert!(reply.contains("control authentication failed"));
+        assert!(matches!(rx.try_recv(), Err(std::sync::mpsc::TryRecvError::Disconnected)));
+    }
+
+    #[test]
+    fn authenticated_tcp_request_reaches_the_ui_queue() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let server = std::thread::spawn(move || {
+            let (s, _) = listener.accept().unwrap();
+            serve(s, &tx, &egui::Context::default(), TOKEN);
+        });
+        let params = json!({"command": "file.saveAs", "params": {"path": "/owner/project.fcproj"}});
+        let mut c = TcpStream::connect(addr).unwrap();
+        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        writeln!(c, "{}", json!({"id": 7, "token": TOKEN, "method": "engine.execute", "params": params})).unwrap();
+        c.shutdown(std::net::Shutdown::Write).unwrap();
+        let request = rx.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert_eq!(request.method, "engine.execute");
+        assert_eq!(request.params, params);
+        request.reply.send(json!({"ok": true})).unwrap();
+        let mut reply = String::new();
+        c.read_to_string(&mut reply).unwrap();
+        server.join().unwrap();
+        assert_eq!(serde_json::from_str::<Value>(&reply).unwrap(), json!({"id": 7, "ok": true}));
+    }
 }
diff --git a/apps/filmcraft/src/dev_icon.rs b/apps/filmcraft/src/dev_icon.rs
index 8c9876794..b14af1505 100644
--- a/apps/filmcraft/src/dev_icon.rs
+++ b/apps/filmcraft/src/dev_icon.rs
@@ -215,6 +215,8 @@ fn desktop_file_content(app_id: &str, name: &str, exe: &str) -> String {
     out.push_str("StartupNotify=true\n");
     out.push_str(&format!("StartupWMClass={app_id}\n"));
     out.push_str("Categories=AudioVideo;Video;AudioVideoEditing;\n");
+    out.push_str("MimeType=application/x-filmcraft;video/mp4;video/x-m4v;video/quicktime;video/x-matroska;video/webm;");
+    out.push_str("video/vnd.avi;video/x-msvideo;application/mxf;video/mp2t;video/mpeg;video/3gpp;\n");
     out.push_str("Keywords=video;editor;film;timeline;color;grading;nle;\n");
     out
 }
diff --git a/apps/filmcraft/src/logging.rs b/apps/filmcraft/src/logging.rs
index 3d7c713fb..006b7f884 100644
--- a/apps/filmcraft/src/logging.rs
+++ b/apps/filmcraft/src/logging.rs
@@ -97,29 +97,35 @@ fn matches(name: &str, target: &str) -> bool {
     }
 }
 
-/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch; a clock
+/// set absurdly far ahead keeps its real year (years far outside chrono's own range are preserved)
+/// instead of panicking.
 pub fn timestamp(t: SystemTime) -> String {
     let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
-    let secs = since.as_secs();
-    let (days, rem) = (secs / 86_400, secs % 86_400);
-    let (y, m, d) = civil_from_days(days);
-    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
+    let (y, dt) = utc_parts(since.as_secs(), since.subsec_nanos());
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", dt.format("%m-%dT%H:%M:%S%.3fZ"))
 }
 
-/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
-/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch; saturating so an absurd
-/// clock can't overflow).
-fn civil_from_days(days: u64) -> (u64, u64, u64) {
-    let z = days.saturating_add(719_468);
-    let era = z / 146_097;
-    let doe = z % 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
-    (y, m, d)
+/// Unix seconds (+ nanos) → (proleptic Gregorian year, the same wall-clock instant moved into
+/// chrono's range by whole 400-year cycles). The Gregorian calendar repeats every 400 years
+/// (146_097 days), so month, day and time of day come from chrono and only the year is carried,
+/// which keeps every input exact instead of collapsing out-of-range years to the epoch. `secs` is
+/// `u64` (the clock is clamped at the epoch before 1970), so `days` always fits an `i64`.
+fn utc_parts(secs: u64, nanos: u32) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((secs / 86_400) as i64, (secs % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, nanos.min(999_999_999)));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
 }
 
 fn numbered(dir: &Path, n: usize) -> PathBuf {
@@ -390,6 +396,17 @@ mod tests {
         assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
         // Before the epoch (a clock set wrong) clamps instead of panicking.
         assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+        // A clock set absurdly far ahead (past chrono's own range) keeps its real year rather than
+        // collapsing to the epoch (reviewer FredApps). Windows' SystemTime can't hold such an
+        // instant, so it is built with a checked add and only asserted where it exists.
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
+            assert_eq!(timestamp(far), "292277026596-12-04T15:30:07.000Z");
+        }
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
+            assert_eq!(timestamp(far), "318857-05-20T17:46:40.000Z");
+        }
+        // Years past 9999 keep the plain zero-padded year (no `+`).
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(253_402_300_800)), "10000-01-01T00:00:00.000Z");
     }
 
     #[test]
diff --git a/apps/filmcraft/src/main.rs b/apps/filmcraft/src/main.rs
index f850b1638..f296c1c39 100644
--- a/apps/filmcraft/src/main.rs
+++ b/apps/filmcraft/src/main.rs
@@ -8,6 +8,7 @@
 //! (the demo project), Open Most Recent, or an empty project.
 //!
 //! `--control <port>` (or `FILMCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server;
+//! `FILMCRAFT_CONTROL_TOKEN` is required (see `docs/control-protocol.md`).
 //! see `filmcraft_ui_egui::control` for the methods. A port that is not a number is an error from
 //! either source.
 //!
@@ -77,6 +78,11 @@ fn tell(text: &str, error: bool) {
 }
 
 fn main() -> eframe::Result {
+    // Windows: the update helper is a copy of this program started with `--finish-update`.
+    #[cfg(windows)]
+    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::FILMCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        std::process::exit(i32::from(result.is_err()));
+    }
     // First, so the panic hook and every start-up record are logged (`logging`).
     let logger = logging::install();
     // lossy, so a value that is not Unicode is reported like any other bad port instead of ignored
@@ -189,6 +195,7 @@ fn native_options(agent: bool) -> eframe::NativeOptions {
 fn app_creator(launch: Launch, graphics: graphics::GraphicsStart, created: Arc<AtomicBool>) -> eframe::AppCreator<'static> {
     let Launch { control_port, control_input_only, files, demo, startup_flag, recover, data_dir, graphics: _ } = launch;
     Box::new(move |cc| {
+        filmcraft_ui_egui::install_ime_reset_callbacks(&cc.egui_ctx);
         created.store(true, Ordering::Relaxed);
         // A fallback graphics mode says so in the window, with a button back to the default.
         let notice = graphics.degraded().then(|| {
@@ -247,6 +254,7 @@ fn app_creator(launch: Launch, graphics: graphics::GraphicsStart, created: Arc<A
             }
         }
         let mut app = FilmcraftApp::new(session);
+        app.set_startup_update_check(true);
         app.graphics_notice = notice;
         if recover == Some(false) {
             app.dialog = None;
@@ -288,7 +296,7 @@ fn app_creator(launch: Launch, graphics: graphics::GraphicsStart, created: Arc<A
             let path = std::path::Path::new(name);
             let mut dialog = rfd::FileDialog::new()
                 .add_filter(filmcraft_ui_egui::i18n::t(filter), &file_filters::extensions(exts))
-                .set_file_name(path.file_name().map_or(name.into(), |n| n.to_string_lossy()));
+                .set_file_name(path.file_name().map_or(name.into(), std::ffi::OsStr::to_string_lossy));
             if let Some(dir) = path.parent().filter(|d| d.is_dir()) {
                 dialog = dialog.set_directory(dir);
             }
@@ -434,6 +442,16 @@ fn agent_event_loop(agent: bool) -> Option<eframe::EventLoopBuilderHook> {
             b.with_activate_ignoring_other_apps(false);
         }));
     }
+    // winit has no file drag-and-drop on Wayland (only on X11), so dropping files from the file
+    // manager showed a "no" cursor. Run through XWayland when it's there; FILMCRAFT_WAYLAND=1
+    // keeps the native Wayland backend.
+    #[cfg(all(unix, not(target_os = "macos")))]
+    if std::env::var_os("DISPLAY").is_some() && std::env::var_os("FILMCRAFT_WAYLAND").is_none() {
+        return Some(Box::new(|b| {
+            use winit::platform::x11::EventLoopBuilderExtX11;
+            b.with_x11();
+        }));
+    }
     let _ = agent;
     None
 }
diff --git a/apps/filmcraft/src/native_menu.rs b/apps/filmcraft/src/native_menu.rs
index 07a47648c..c404c59e3 100644
--- a/apps/filmcraft/src/native_menu.rs
+++ b/apps/filmcraft/src/native_menu.rs
@@ -19,6 +19,15 @@ fn accel(s: &str) -> Option<Accelerator> {
     mapped.parse().ok()
 }
 
+/// The app menu's Quit item: the `app.quit` command (which asks to save unsaved changes) on its
+/// shortcut, Cmd+Q unless remapped in the Keyboard Shortcuts editor. The key equivalent is read
+/// once, when the menu bar is built: `app.quit` has no menu path, so it is not in the menu tree the
+/// updater receives, and a remap shows on the Quit item after the next launch.
+fn quit_item(app: &FilmcraftApp) -> (&'static str, Option<Accelerator>) {
+    let keys = app.session.shortcuts.primary("app.quit").unwrap_or_else(|| "Cmd+Q".into());
+    ("app.quit", accel(&keys))
+}
+
 /// Updates native item labels, key equivalents and enablement when the menu tree changes.
 pub type MenuUpdater = Box<dyn FnMut(&[Item])>;
 
@@ -53,9 +62,12 @@ pub fn install(app: &FilmcraftApp, ctx: egui::Context) -> (Receiver<String>, Men
     let predefined = [
         (hide_label, PredefinedMenuItem::hide(Some(app.ui.language.tr(hide_label)))),
         (hide_others_label, PredefinedMenuItem::hide_others(Some(app.ui.language.tr(hide_others_label)))),
-        (quit_label, PredefinedMenuItem::quit(Some(app.ui.language.tr(quit_label)))),
     ];
-    let [(_, hide), (_, hide_others), (_, quit)] = &predefined;
+    let [(_, hide), (_, hide_others)] = &predefined;
+    // Quit is ours, not the predefined item: that one calls `terminate:` and skips the unsaved
+    // changes prompt (#1943); the `app.quit` command closes the window through it
+    let (quit_id, quit_accel) = quit_item(app);
+    let quit = MenuItem::with_id(quit_id, app.ui.language.tr(quit_label), true, quit_accel);
     let _ = app_menu.append_items(&[
         &about,
         &discord,
@@ -65,7 +77,7 @@ pub fn install(app: &FilmcraftApp, ctx: egui::Context) -> (Receiver<String>, Men
         hide,
         hide_others,
         &PredefinedMenuItem::separator(),
-        quit,
+        &quit,
     ]);
     let _ = bar.append(&app_menu);
     for top in MENUS {
@@ -149,6 +161,7 @@ pub fn install(app: &FilmcraftApp, ctx: egui::Context) -> (Receiver<String>, Men
         for (label, item) in &predefined {
             item.set_text(language.tr(label));
         }
+        quit.set_text(language.tr(quit_label));
         for (shown, mi) in &mut native {
             let Some(it) = items.iter().find(|i| i.id == shown.id) else { continue };
             if it.label != shown.label {
@@ -166,3 +179,20 @@ pub fn install(app: &FilmcraftApp, ctx: egui::Context) -> (Receiver<String>, Men
     });
     (rx, update)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use filmcraft_engine::Session;
+
+    /// #1943: Cmd+Q must reach the `app.quit` command, which closes the window through the unsaved
+    /// changes prompt, instead of the predefined Quit item's `terminate:`.
+    #[test]
+    fn quit_item_runs_the_app_quit_command_on_cmd_q() {
+        let app = FilmcraftApp::new(Session::default());
+        let (id, accelerator) = quit_item(&app);
+        assert_eq!(id, "app.quit");
+        assert_eq!(accelerator, accel("Cmd+Q"));
+        assert!(accelerator.is_some(), "Cmd+Q is a native key equivalent");
+    }
+}
diff --git a/crates/aac/tests/common/mod.rs b/crates/aac/tests/it/common/mod.rs
similarity index 100%
rename from crates/aac/tests/common/mod.rs
rename to crates/aac/tests/it/common/mod.rs
diff --git a/crates/aac/tests/decoder_oracle.rs b/crates/aac/tests/it/decoder_oracle.rs
similarity index 99%
rename from crates/aac/tests/decoder_oracle.rs
rename to crates/aac/tests/it/decoder_oracle.rs
index 721b94486..b5591a56a 100644
--- a/crates/aac/tests/decoder_oracle.rs
+++ b/crates/aac/tests/it/decoder_oracle.rs
@@ -1,7 +1,7 @@
 //! Decoder accuracy against ffmpeg's decoder on streams produced by ffmpeg's AAC encoder (oracle
 //! only; skipped when ffmpeg is absent).
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/aac/tests/encoder_oracle.rs b/crates/aac/tests/it/encoder_oracle.rs
similarity index 99%
rename from crates/aac/tests/encoder_oracle.rs
rename to crates/aac/tests/it/encoder_oracle.rs
index 3cc312ace..d73abdbb8 100644
--- a/crates/aac/tests/encoder_oracle.rs
+++ b/crates/aac/tests/it/encoder_oracle.rs
@@ -1,6 +1,6 @@
 //! Encoder quality/bitrate tests using ffmpeg as an external decoding oracle (skipped if absent).
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_aac::{BitrateMode, EncoderConfig, WindowShape};
diff --git a/crates/aac/tests/it/main.rs b/crates/aac/tests/it/main.rs
new file mode 100644
index 000000000..6f4d1e3bd
--- /dev/null
+++ b/crates/aac/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod common;
+mod decoder_oracle;
+mod encoder_oracle;
+mod robustness;
diff --git a/crates/aac/tests/robustness.rs b/crates/aac/tests/it/robustness.rs
similarity index 99%
rename from crates/aac/tests/robustness.rs
rename to crates/aac/tests/it/robustness.rs
index 9c1bb9ea0..fd0e83ee6 100644
--- a/crates/aac/tests/robustness.rs
+++ b/crates/aac/tests/it/robustness.rs
@@ -1,7 +1,7 @@
 //! Fuzz-style robustness: mutated access units, configs and ADTS streams must never panic, and the
 //! encoder must accept hostile input (NaN, ±inf, > full scale, silence, odd chunk sizes).
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_aac::{AudioSpecificConfig, Decoder, Encoder, EncoderConfig, split_adts};
diff --git a/crates/apv/README.md b/crates/apv/README.md
index e84c9f5f8..906e4b4ae 100644
--- a/crates/apv/README.md
+++ b/crates/apv/README.md
@@ -54,7 +54,7 @@ let apvc: Vec<u8> = enc.decoder_config_record();  // APVDecoderConfigurationReco
 - **Metadata (§8)**: Parses `metadata_mdcv` (`payloadType == 5`, Mastering Display Color Volume)
   and `metadata_cll` (`payloadType == 6`, Content Light-Level Information).
 - **Robustness (§10)**: All size fields, tile coordinates, VLC codeword lengths, and coefficient
-  ranges (`-32768..=32767`) are checked before allocation or shift. Verified by `tests/fuzz.rs`
+  ranges (`-32768..=32767`) are checked before allocation or shift. Verified by `tests/it/fuzz.rs`
   across thousands of mutated and random inputs.
 
 ### Encoder
@@ -67,7 +67,7 @@ let apvc: Vec<u8> = enc.decoder_config_record();  // APVDecoderConfigurationReco
 
 ## Accuracy (vs FFmpeg as an External Oracle)
 
-`tests/oracle.rs` encodes synthetic test patterns across all 7 profiles, odd dimensions, multiple
+`tests/it/oracle.rs` encodes synthetic test patterns across all 7 profiles, odd dimensions, multiple
 tiles, custom asymmetric quantization matrices, and HDR metadata PBUs, then decodes the resulting
 `.apv` streams with `ffmpeg -v error -xerror -f apv` and compares against `filmcraft_apv::decode_frame`.
 Because APV specifies an exact integer inverse transform, **`filmcraft-apv` is 100% bit-exact
diff --git a/crates/apv/src/decode.rs b/crates/apv/src/decode.rs
index 997aaa0b4..910ea5207 100644
--- a/crates/apv/src/decode.rs
+++ b/crates/apv/src/decode.rs
@@ -377,7 +377,20 @@ fn decode_tile_comp(hdr: &FrameHeader, tile_idx: usize, c: usize, comp_bytes: &[
     let blocks_x = blk_w / 8;
     let blocks_y = blk_h / 8;
 
-    let mut comp_buf = vec![0u16; tw_c * th_c];
+    // Every coded 8x8 block needs at least one bit for its DC code. Validate
+    // that the component can describe every required block before allocating
+    // its complete reconstructed plane.
+    let block_count = (num_mb_cols as usize)
+        .checked_mul(num_mb_rows as usize)
+        .and_then(|n| n.checked_mul(blocks_x))
+        .and_then(|n| n.checked_mul(blocks_y))
+        .ok_or(Error::CorruptTile(tile_idx))?;
+    if comp_bytes.len() < block_count.div_ceil(8) {
+        return Err(Error::CorruptTile(tile_idx));
+    }
+    let samples = tw_c.checked_mul(th_c).ok_or(Error::CorruptTile(tile_idx))?;
+
+    let mut comp_buf = vec![0u16; samples];
     let mut r = BitReader::new(comp_bytes);
 
     let mut prev_dc: i32 = 0;
diff --git a/crates/apv/tests/fuzz.rs b/crates/apv/tests/it/fuzz.rs
similarity index 100%
rename from crates/apv/tests/fuzz.rs
rename to crates/apv/tests/it/fuzz.rs
diff --git a/crates/apv/tests/it/fuzz_hostile.rs b/crates/apv/tests/it/fuzz_hostile.rs
new file mode 100644
index 000000000..bb02fdd07
--- /dev/null
+++ b/crates/apv/tests/it/fuzz_hostile.rs
@@ -0,0 +1,108 @@
+//! Hostile-input robustness: every header byte set to extreme values, every bit flipped,
+//! truncation at (nearly) every length must never panic or run away (errors are fine).
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use filmcraft_apv::*;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+fn seeds() -> Vec<Vec<u8>> {
+    let mut v = Vec::new();
+    for (p, w, h) in [(Profile::P422_10, 64u32, 48u32), (Profile::P444_10, 48, 32), (Profile::P4444_10, 32, 32), (Profile::P400_10, 32, 32)] {
+        let chroma = p.default_chroma();
+        let depth = p.default_bit_depth();
+        let mut f = Frame::new(w, h, chroma, depth, chroma == ChromaFormat::Yuv4444);
+        for (i, s) in f.y.iter_mut().enumerate() {
+            *s = (64 + (i * 37) % 800) as u16;
+        }
+        let mut cfg = EncoderConfig::new(p, w, h);
+        cfg.qp = Some(16);
+        let Ok(mut enc) = Encoder::with_config(cfg) else { continue };
+        if let Ok(d) = enc.encode(&f) {
+            v.push(d);
+        }
+        if let Ok(d) = enc.encode_raw_au(&f) {
+            v.push(d);
+        }
+    }
+    v
+}
+
+fn run(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for depth in [None, Some(8), Some(16)] {
+            let _ = decode_frame_with(d, &DecodeOptions { bit_depth: depth, threads: depth.is_none() });
+        }
+        let _ = probe(d);
+        let _ = split_raw_bitstream(d);
+    }));
+    assert!(res.is_ok(), "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+#[test]
+fn hostile_frames_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let seeds = seeds();
+    assert!(!seeds.is_empty());
+    for (si, seed) in seeds.iter().enumerate() {
+        let stride = (seed.len() / 400).max(1);
+        for n in (0..seed.len()).step_by(stride) {
+            run(&seed[..n], &format!("seed {si} truncate {n}"));
+        }
+        for p in 0..seed.len().min(256) {
+            for v in [0u8, 0xff, 0x80, 0x01, 0x7f] {
+                let mut d = seed.clone();
+                d[p] = v;
+                run(&d, &format!("seed {si} byte {p}={v:#x}"));
+            }
+            for b in 0..8 {
+                let mut d = seed.clone();
+                d[p] ^= 1 << b;
+                run(&d, &format!("seed {si} flip {p}.{b}"));
+            }
+        }
+        // Whole big-endian 32-bit words of the header set to 0 / huge values (sizes, counts, dimensions).
+        for p in 0..seed.len().min(128) {
+            for v in [0u32, 0xffff_ffff, 0x0001_0000, 0x7fff_ffff] {
+                let mut d = seed.clone();
+                if let Some(s) = d.get_mut(p..p + 4) {
+                    s.copy_from_slice(&v.to_be_bytes());
+                }
+                run(&d, &format!("seed {si} u32 {p}={v:#x}"));
+            }
+        }
+        let mut rng = Rng(0x9e3779b97f4a7c15 ^ si as u64);
+        let iters = std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()).unwrap_or(1000);
+        for i in 0..iters {
+            let mut d = seed.clone();
+            for _ in 0..1 + rng.below(8) {
+                let p = rng.below(d.len());
+                if rng.below(2) == 0 {
+                    d[p] ^= 1 << rng.below(8);
+                } else {
+                    d[p] = rng.next() as u8;
+                }
+            }
+            run(&d, &format!("seed {si} random {i}"));
+        }
+    }
+}
diff --git a/crates/apv/tests/it/main.rs b/crates/apv/tests/it/main.rs
new file mode 100644
index 000000000..51c79839a
--- /dev/null
+++ b/crates/apv/tests/it/main.rs
@@ -0,0 +1,3 @@
+mod fuzz;
+mod fuzz_hostile;
+mod oracle;
diff --git a/crates/apv/tests/oracle.rs b/crates/apv/tests/it/oracle.rs
similarity index 100%
rename from crates/apv/tests/oracle.rs
rename to crates/apv/tests/it/oracle.rs
diff --git a/crates/audio-dsp/src/effects/mod.rs b/crates/audio-dsp/src/effects/mod.rs
index 1a6f02a33..9a6f781cc 100644
--- a/crates/audio-dsp/src/effects/mod.rs
+++ b/crates/audio-dsp/src/effects/mod.rs
@@ -271,31 +271,37 @@ mod tests {
 
     #[test]
     fn extreme_settings_stay_finite_and_denormal_free() {
-        for e in effects() {
-            for setting in [0.0f32, 1.0] {
-                let mut fx = (e.create)(SR, 2);
-                for p in e.params {
-                    fx.set_param(p.id, if setting == 0.0 { p.min } else { p.max });
-                }
-                let mut l = noise(3, 24000, 4.0);
-                let mut r = noise(4, 24000, 4.0);
-                l[100] = 1e6;
-                r[200] = -1e6;
-                fx.process(&mut [&mut l, &mut r]);
-                assert!(l.iter().chain(&r).all(|v| v.is_finite()), "{} setting {setting}", e.id);
-                // Long silence afterwards: output decays without denormals.
-                fx.reset();
-                let mut l = noise(3, 4800, 0.5);
-                let mut r = noise(4, 4800, 0.5);
-                fx.process(&mut [&mut l, &mut r]);
-                for _ in 0..40 {
-                    let mut l = vec![0.0f32; 48000];
-                    let mut r = vec![0.0f32; 48000];
-                    fx.process(&mut [&mut l, &mut r]);
-                    assert!(l.iter().chain(&r).all(|v| v.is_finite() && !v.is_subnormal()), "{} setting {setting}: denormal/NaN in tail", e.id);
-                }
+        // One thread per effect. The tail stays 40 s long: delays, reverbs and graphic EQs still
+        // produce output in its last second, some of it within 3x of the smallest normal f32.
+        std::thread::scope(|scope| {
+            for e in effects() {
+                scope.spawn(move || {
+                    for setting in [0.0f32, 1.0] {
+                        let mut fx = (e.create)(SR, 2);
+                        for p in e.params {
+                            fx.set_param(p.id, if setting == 0.0 { p.min } else { p.max });
+                        }
+                        let mut l = noise(3, 24000, 4.0);
+                        let mut r = noise(4, 24000, 4.0);
+                        l[100] = 1e6;
+                        r[200] = -1e6;
+                        fx.process(&mut [&mut l, &mut r]);
+                        assert!(l.iter().chain(&r).all(|v| v.is_finite()), "{} setting {setting}", e.id);
+                        // Long silence afterwards: output decays without denormals.
+                        fx.reset();
+                        let mut l = noise(3, 4800, 0.5);
+                        let mut r = noise(4, 4800, 0.5);
+                        fx.process(&mut [&mut l, &mut r]);
+                        for _ in 0..40 {
+                            let mut l = vec![0.0f32; 48000];
+                            let mut r = vec![0.0f32; 48000];
+                            fx.process(&mut [&mut l, &mut r]);
+                            assert!(l.iter().chain(&r).all(|v| v.is_finite() && !v.is_subnormal()), "{} setting {setting}: denormal/NaN in tail", e.id);
+                        }
+                    }
+                });
             }
-        }
+        });
     }
 
     #[test]
diff --git a/crates/audio-dsp/src/remix.rs b/crates/audio-dsp/src/remix.rs
index 78d4ea8b1..52b1de990 100644
--- a/crates/audio-dsp/src/remix.rs
+++ b/crates/audio-dsp/src/remix.rs
@@ -37,6 +37,13 @@ pub const CONTEXT: usize = 4;
 pub const MIN_PIECE_BEATS: usize = 4;
 /// Crossfade at each joint (seconds).
 pub const XFADE_S: f64 = 0.02;
+/// Long enough for a complete music cue while bounding the audio decoded and analysed by Remix.
+pub const MAX_ANALYSIS_SECONDS: u64 = 10 * 60;
+/// A dense similarity matrix is useful for planning, but must remain a bounded allocation.
+const MAX_SIMILARITY_CELLS: usize = 4_000_000;
+/// Remix analysis supports ordinary production and high-resolution audio rates, not arbitrary
+/// integers supplied through a public library API.
+pub const MAX_ANALYSIS_SAMPLE_RATE: u32 = 384_000;
 
 /// One piece of the output: `len` samples read from the source at `src`.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -139,6 +146,12 @@ impl Analysis {
 /// Why music cannot be remixed.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum RemixError {
+    /// The source sample rate is zero or above the supported analysis limit.
+    InvalidSampleRate,
+    /// The source would exceed the bounded Remix analysis duration.
+    TooLong,
+    /// The detected beat grid would need too much similarity storage or work.
+    TooComplex,
     /// Not enough rhythmic content to find a beat (silence, noise, speech).
     NoBeat,
     /// The source has fewer beats than a remix needs.
@@ -150,6 +163,9 @@ pub enum RemixError {
 impl std::fmt::Display for RemixError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(match self {
+            RemixError::InvalidSampleRate => "the audio sample rate is not supported for remix analysis",
+            RemixError::TooLong => "the music is too long to remix",
+            RemixError::TooComplex => "the music has too many beats to remix",
             RemixError::NoBeat => "no beat found in the audio",
             RemixError::TooShort => "the music is too short to remix",
             RemixError::TargetTooShort => "the target duration is too short for this music",
@@ -188,7 +204,8 @@ fn stft_mag(x: &[f32], n: usize, hop: usize) -> Vec<Vec<f32>> {
 /// STFT frame for the onset envelope: the power of two nearest to 46 ms (1024 at 22.05 kHz, 2048
 /// at 44.1/48 kHz).
 fn onset_frame(sr: u32) -> usize {
-    let n = (sr as f64 * 0.046).max(256.0);
+    // `onset_envelope` is public on its own, so it must remain bounded even outside `analyze`.
+    let n = (sr.min(MAX_ANALYSIS_SAMPLE_RATE) as f64 * 0.046).max(256.0);
     1usize << n.log2().round() as u32
 }
 
@@ -344,31 +361,34 @@ fn beat_features(x: &[f32], sr: u32, beats: &[i64]) -> (Vec<[f32; 12]>, Vec<[f32
         }
         frame_cep.push(cep);
     }
-    let mut chroma = Vec::with_capacity(beats.len());
-    let mut cep = Vec::with_capacity(beats.len());
+    // Frames and beats are both ordered. Assign every frame once instead of scanning the entire
+    // feature timeline for every beat interval.
+    let mut chroma = vec![[0f32; 12]; beats.len()];
+    let mut cep = vec![[0f32; 12]; beats.len()];
+    let mut counts = vec![0f32; beats.len()];
     let end = x.len() as i64;
-    for (i, &b) in beats.iter().enumerate() {
-        let e = beats.get(i + 1).copied().unwrap_or(end);
-        let (mut c, mut q, mut cnt) = ([0f32; 12], [0f32; 12], 0f32);
-        for (t, (fc, fq)) in frame_chroma.iter().zip(&frame_cep).enumerate() {
-            let centre = (t * hop + n / 2) as i64;
-            if centre >= b && centre < e {
-                for k in 0..12 {
-                    c[k] += fc[k];
-                    q[k] += fq[k];
-                }
-                cnt += 1.0;
-            }
+    let mut beat = 0;
+    for (t, (fc, fq)) in frame_chroma.iter().zip(&frame_cep).enumerate() {
+        let centre = (t * hop + n / 2) as i64;
+        while beat + 1 < beats.len() && centre >= beats[beat + 1] {
+            beat += 1;
         }
-        if cnt > 0.0 {
-            q.iter_mut().for_each(|v| *v /= cnt);
+        if centre >= beats[beat] && centre < end {
+            for k in 0..12 {
+                chroma[beat][k] += fc[k];
+                cep[beat][k] += fq[k];
+            }
+            counts[beat] += 1.0;
+        }
+    }
+    for ((c, q), count) in chroma.iter_mut().zip(&mut cep).zip(counts) {
+        if count > 0.0 {
+            q.iter_mut().for_each(|v| *v /= count);
         }
         let norm = c.iter().map(|v| v * v).sum::<f32>().sqrt();
         if norm > 0.0 {
             c.iter_mut().for_each(|v| *v /= norm);
         }
-        chroma.push(c);
-        cep.push(q);
     }
     // z-score the cepstra across beats
     let m = cep.len().max(1) as f32;
@@ -380,6 +400,10 @@ fn beat_features(x: &[f32], sr: u32, beats: &[i64]) -> (Vec<[f32; 12]>, Vec<[f32
     (chroma, cep)
 }
 
+fn similarity_cells(beats: usize) -> Result<usize, RemixError> {
+    beats.checked_mul(beats).filter(|&n| n <= MAX_SIMILARITY_CELLS).ok_or(RemixError::TooComplex)
+}
+
 fn cos(a: &[f32; 12], b: &[f32; 12]) -> f32 {
     let d: f32 = a.iter().zip(b).map(|(x, y)| x * y).sum();
     let na = a.iter().map(|v| v * v).sum::<f32>().sqrt();
@@ -398,7 +422,13 @@ fn local_max(env: &[f32], t: usize, r: usize) -> f32 {
 
 /// Analyse planar audio (channels are summed to mono).
 pub fn analyze(channels: &[&[f32]], sample_rate: u32) -> Result<Analysis, RemixError> {
+    if sample_rate == 0 || sample_rate > MAX_ANALYSIS_SAMPLE_RATE {
+        return Err(RemixError::InvalidSampleRate);
+    }
     let len = channels.iter().map(|c| c.len()).max().unwrap_or(0);
+    if (len as u64) > u64::from(sample_rate).saturating_mul(MAX_ANALYSIS_SECONDS) {
+        return Err(RemixError::TooLong);
+    }
     let k = 1.0 / channels.len().max(1) as f32;
     let mono: Vec<f32> = (0..len).map(|i| channels.iter().map(|c| c.get(i).copied().unwrap_or(0.0)).sum::<f32>() * k).collect();
     let (env, n, hop) = onset_envelope(&mono, sample_rate);
@@ -434,7 +464,7 @@ pub fn analyze(channels: &[&[f32]], sample_rate: u32) -> Result<Analysis, RemixE
     }
     let (chroma, cep) = beat_features(&mono, sample_rate, &beats);
     let m = beats.len();
-    let mut sim = vec![0f32; m * m];
+    let mut sim = vec![0f32; similarity_cells(m)?];
     for i in 0..m {
         for j in 0..m {
             sim[i * m + j] = 0.6 * cos(&chroma[i], &chroma[j]) + 0.4 * (1.0 + cos(&cep[i], &cep[j])) * 0.5;
@@ -796,6 +826,22 @@ mod tests {
         assert!(analyze(&[&noise], SR).is_err());
     }
 
+    #[test]
+    fn analysis_duration_and_similarity_storage_are_bounded() {
+        let too_long = vec![0.0; MAX_ANALYSIS_SECONDS as usize + 1];
+        assert_eq!(analyze(&[&too_long], 1), Err(RemixError::TooLong));
+        assert_eq!(similarity_cells(2_000), Ok(4_000_000));
+        assert_eq!(similarity_cells(2_001), Err(RemixError::TooComplex));
+    }
+
+    #[test]
+    fn public_analysis_rate_is_bounded_before_fft_planning() {
+        assert_eq!(analyze(&[], 0), Err(RemixError::InvalidSampleRate));
+        assert_eq!(analyze(&[], u32::MAX), Err(RemixError::InvalidSampleRate));
+        let (_, n, _) = onset_envelope(&[], u32::MAX);
+        assert!(n <= onset_frame(MAX_ANALYSIS_SAMPLE_RATE));
+    }
+
     #[test]
     fn render_crossfades_without_clicks_and_ignores_block_size() {
         let (m, _, a) = music(120.0, 24);
diff --git a/crates/audio-dsp/src/resample.rs b/crates/audio-dsp/src/resample.rs
index 01dfee55d..b1686583e 100644
--- a/crates/audio-dsp/src/resample.rs
+++ b/crates/audio-dsp/src/resample.rs
@@ -20,6 +20,9 @@ pub struct StreamResampler {
     next_out: Option<i64>,
 }
 
+/// Maximum source frames fetched in a single resampler pull.
+pub const MAX_RESAMPLE_SOURCE_SPAN: usize = 384_000 * 10;
+
 impl StreamResampler {
     /// Rates of zero are treated as 1 Hz rather than dividing by zero.
     pub fn new(from: u32, to: u32) -> Self {
@@ -53,7 +56,7 @@ impl StreamResampler {
         }
         let held_end = self.held_start + self.held.first().map_or(0, Vec::len) as i64;
         if last + 1 > held_end {
-            let want = (last + 1 - held_end) as usize;
+            let want = ((last + 1 - held_end) as usize).min(MAX_RESAMPLE_SOURCE_SPAN);
             let got = pull(held_end, want);
             if self.held.is_empty() {
                 self.held = vec![Vec::new(); got.len().max(1)];
diff --git a/crates/audio-dsp/src/sync.rs b/crates/audio-dsp/src/sync.rs
index 73b6e0e82..c4bc007b7 100644
--- a/crates/audio-dsp/src/sync.rs
+++ b/crates/audio-dsp/src/sync.rs
@@ -77,9 +77,13 @@ pub fn mixdown(channels: &[&[f32]]) -> Vec<f32> {
 /// Low-pass filter (Blackman-windowed sinc, cutoff at 0.42 × the new sample rate) and keep every
 /// `d`-th sample.
 pub fn decimate(x: &[f32], d: usize) -> Vec<f32> {
-    if d <= 1 {
+    if x.is_empty() || d <= 1 {
         return x.to_vec();
     }
+    // Factors above the input length cannot produce another output sample. Cap the useful factor
+    // as well as the filter width so a public caller cannot turn a tiny input into a huge plan.
+    const MAX_FACTOR: usize = 4096;
+    let d = d.min(x.len()).min(MAX_FACTOR);
     let half = 8 * d;
     let fc = 0.42 / d as f64; // cycles per input sample
     let taps: Vec<f32> = {
@@ -396,6 +400,13 @@ mod tests {
         assert!(rh < 0.01, "{rh}");
     }
 
+    #[test]
+    fn decimate_does_not_plan_a_filter_for_empty_or_extreme_requests() {
+        assert!(decimate(&[], usize::MAX).is_empty());
+        let tiny = [1.0, -1.0];
+        assert_eq!(decimate(&tiny, usize::MAX), decimate(&tiny, tiny.len()));
+    }
+
     #[test]
     fn pure_delay_exact_both_signs() {
         let sr = 48_000;
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 14b090e7d..29121042e 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -16,7 +16,8 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 rmcp = { version = "3.5", default-features = false, features = ["server", "macros", "transport-io"] }
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "sync", "net", "io-util", "time"] }
-base64 = "0.22"
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "sync", "net", "io-util", "time", "fs"] }
+base64 = "0.23"
 schemars = "1"
 image = { version = "0.25", default-features = false, features = ["png"] }
+tempfile = "3"
diff --git a/crates/automation/src/bridge.rs b/crates/automation/src/bridge.rs
index f51db9adf..032e4e657 100644
--- a/crates/automation/src/bridge.rs
+++ b/crates/automation/src/bridge.rs
@@ -20,6 +20,8 @@ type Conn = (BufReader<tokio::net::tcp::OwnedReadHalf>, tokio::net::tcp::OwnedWr
 
 pub struct BridgeClient {
     addr: String,
+    /// Inherited from the same owner-controlled environment as the desktop app.
+    token: Option<String>,
     /// Connections with no request in flight. A request takes one (or opens one) for its whole
     /// round trip and puts it back only once the reply is read, so a slow or abandoned request
     /// never holds up the others or leaves its late reply for the next one to read (#1538).
@@ -28,14 +30,15 @@ pub struct BridgeClient {
 }
 
 impl BridgeClient {
-    /// `addr` such as `127.0.0.1:9876` (loopback only).
+    /// `addr` such as `127.0.0.1:9876` (loopback only). Reads `FILMCRAFT_CONTROL_TOKEN`
+    /// from the environment; the desktop app requires this credential on every request.
     pub fn new(addr: impl Into<String>) -> Result<Self, AutomationError> {
         let addr = addr.into();
         let host = addr.rsplit_once(':').map(|(h, _)| h).unwrap_or(&addr);
         if !matches!(host, "127.0.0.1" | "localhost" | "[::1]" | "::1") {
             return Err(AutomationError::BadRequest(format!("bridge address must be loopback, got `{addr}`")));
         }
-        Ok(Self { addr, idle: Mutex::new(Vec::new()), next_id: AtomicU64::new(1) })
+        Ok(Self { addr, token: std::env::var("FILMCRAFT_CONTROL_TOKEN").ok(), idle: Mutex::new(Vec::new()), next_id: AtomicU64::new(1) })
     }
 
     /// Run engine command `id` in the app. A blocking export (`file.exportMedia` with
@@ -85,7 +88,7 @@ impl BridgeClient {
                 None => self.connect().await?,
             };
             let id = self.next_id.fetch_add(1, Ordering::Relaxed);
-            let line = format!("{}\n", json!({"id": id, "method": method, "params": params}));
+            let line = format!("{}\n", json!({"id": id, "token": self.token, "method": method, "params": params}));
             let res: Result<Value, AutomationError> = async {
                 conn.1.write_all(line.as_bytes()).await.map_err(|e| AutomationError::Bridge(e.to_string()))?;
                 let mut buf = String::new();
@@ -282,4 +285,19 @@ mod tests {
         assert_eq!(seen.len(), 2);
         assert_eq!(seen[1]["params"]["command"], "sequence.inspect");
     }
+
+    #[tokio::test]
+    async fn credential_is_sent_on_every_request() {
+        let (addr, seen) = fake_app(Value::Null).await;
+        let mut b = BridgeClient::new(addr).unwrap();
+        // Inject directly to avoid mutating the process environment in parallel tests.
+        let token = "0123456789abcdef".repeat(4);
+        b.token = Some(token.clone());
+        b.call("ui.inspect", json!({})).await.unwrap();
+        b.execute("file.saveAs", json!({"path": "/owner/project.fcproj"})).await.unwrap();
+        let seen = seen.lock().await;
+        assert_eq!(seen.len(), 2);
+        assert!(seen.iter().all(|request| request["token"] == token));
+        assert_eq!(seen[1]["params"]["params"]["path"], "/owner/project.fcproj");
+    }
 }
diff --git a/crates/automation/src/long_job.rs b/crates/automation/src/long_job.rs
index bdc756cf5..87fb7e825 100644
--- a/crates/automation/src/long_job.rs
+++ b/crates/automation/src/long_job.rs
@@ -4,6 +4,7 @@
 //! `notifications/cancelled`, deleting the partial output. The session lock is only held for
 //! short polls, so other requests are answered while the export runs.
 
+use std::ffi::OsStr;
 use std::path::Path;
 use std::time::{Duration, SystemTime};
 
@@ -118,10 +119,10 @@ impl FilmcraftMcp {
 /// never touched, even when they were saved during the export.
 pub fn remove_partial(path: &str, since: SystemTime) {
     let p = Path::new(path);
-    let (Some(dir), Some(stem), Some(file)) = (p.parent(), p.file_stem().and_then(|s| s.to_str()), p.file_name().and_then(|s| s.to_str())) else {
+    let (Some(dir), Some(stem), Some(file)) = (p.parent(), p.file_stem().and_then(OsStr::to_str), p.file_name().and_then(OsStr::to_str)) else {
         return;
     };
-    let ext = p.extension().and_then(|s| s.to_str()).unwrap_or_default();
+    let ext = p.extension().and_then(OsStr::to_str).unwrap_or_default();
     let dir = if dir.as_os_str().is_empty() { Path::new(".") } else { dir };
     let Ok(entries) = std::fs::read_dir(dir) else { return };
     // file times are coarser than the clock
diff --git a/crates/automation/src/server.rs b/crates/automation/src/server.rs
index 0aebbc31d..33f5dc653 100644
--- a/crates/automation/src/server.rs
+++ b/crates/automation/src/server.rs
@@ -108,7 +108,7 @@ pub struct ClickParams {
     /// left | right | middle
     #[serde(default)]
     pub button: Option<String>,
-    /// 2 for double-click.
+    /// Number of clicks (0–10; defaults to 1). Use 2 for double-click. Larger values are rejected.
     #[serde(default)]
     pub count: Option<u32>,
     /// {"shift":bool,"alt":bool,"command":bool,"ctrl":bool}
@@ -122,6 +122,7 @@ pub struct DragParams {
     pub from: Value,
     /// End point, same forms.
     pub to: Value,
+    /// Movement steps (0–1024; defaults to 12; 0 or 1 uses 2). Larger values are rejected.
     #[serde(default)]
     pub steps: Option<u32>,
     #[serde(default)]
@@ -278,9 +279,22 @@ impl FilmcraftMcp {
     }
 
     /// The project tree plus the active sequence (null when there is none).
+    ///
+    /// `project.inspect` and `sequence.inspect` are two separate calls (two lock scopes in
+    /// headless mode, two round trips to the app in bridge mode), so the active sequence can
+    /// change between them if another client, or the app's own UI, switches sequence tabs in
+    /// that window (#1477). Pinning `sequence.inspect` to the `activeSequence` id this
+    /// `project.inspect` just reported keeps the pair consistent: the returned `sequence`, when
+    /// not null, always describes the sequence the returned `project.activeSequence` names.
     async fn document(&self) -> Result<Value, AutomationError> {
         let project = self.run("project.inspect", json!({})).await?;
-        let sequence = self.run("sequence.inspect", json!({})).await.ok();
+        // `ItemId` is a u64 (`item_p` parses the `item` param with `u64_p`): read it as one too,
+        // not `as_i64`, so an id above `i64::MAX` is still looked up instead of silently going null.
+        let active = project.get("activeSequence").and_then(Value::as_u64);
+        let sequence = match active {
+            Some(id) => self.run("sequence.inspect", json!({"item": id})).await.ok(),
+            None => None,
+        };
         Ok(json!({"project": project, "sequence": sequence}))
     }
 
@@ -484,6 +498,7 @@ impl FilmcraftMcp {
         self.ui("ui.elements", json!({"prefix": p.prefix.unwrap_or_default()})).await
     }
 
+    /// Forward a click to the live editor; an omitted count is sent as null and uses its default.
     #[tool(
         title = "Live app: click",
         description = "Live app: click an element by id or at x,y (points). Supports right/middle button, double-click (count=2) and modifiers.",
@@ -500,6 +515,7 @@ impl FilmcraftMcp {
         self.ui("ui.click", v).await
     }
 
+    /// Forward a drag to the live editor, which applies the step default and validates its bounds.
     #[tool(
         title = "Live app: drag",
         description = "Live app: press-drag-release from one point/element to another (move clips, trim edges, scrub, resize panels, drop project items onto tracks).",
@@ -551,15 +567,21 @@ impl FilmcraftMcp {
 
 impl FilmcraftMcp {
     async fn screenshot(&self, b: &BridgeClient, panel: Option<String>, max: u32) -> Result<CallToolResult, McpError> {
-        let path = std::env::temp_dir().join(format!("filmcraft-mcp-{}.png", std::process::id()));
+        // The desktop bridge needs a pathname, so use a freshly-created,
+        // owner-only directory rather than exposing image bytes at a
+        // predictable shared-temp filename.
+        let dir = match tempfile::tempdir() {
+            Ok(dir) => dir,
+            Err(e) => return Ok(fail(format!("screenshot: {e}"))),
+        };
+        let path = dir.path().join("screenshot.png");
         if let Err(e) = b.call("ui.screenshot", json!({"path": path.to_string_lossy(), "panel": panel})).await {
             return Ok(fail(e));
         }
-        let bytes = match std::fs::read(&path) {
+        let bytes = match tokio::fs::read(&path).await {
             Ok(b) => b,
             Err(e) => return Ok(fail(format!("screenshot: {e}"))),
         };
-        let _ = std::fs::remove_file(&path);
         let bytes = match image::load_from_memory(&bytes) {
             Ok(img) => {
                 let rgba = img.to_rgba8();
@@ -998,4 +1020,73 @@ mod tests {
         let r = m.render_frame(Parameters(RenderParams { seconds: Some(0.5), max_side: Some(64) })).await.unwrap();
         assert_ne!(r.is_error, Some(true));
     }
+
+    /// `doc_inspect` composes `project.inspect` and `sequence.inspect` as two separate round
+    /// trips to the app. If the active sequence changes between them (another client, or the
+    /// app's own UI, switching tabs in that window), an unscoped `sequence.inspect` answers for
+    /// whichever sequence is active *now*, not the one `project.inspect` just reported, so the
+    /// pair comes back inconsistent (#1477, reproduced with a real bridge client and a flipping
+    /// `sequence.open` in `race_test.py`: ~300/300 calls mismatched). Pinning the second call to
+    /// the id the first one reported keeps `sequence`, when not null, always describing the
+    /// sequence `project.activeSequence` names.
+    #[tokio::test]
+    async fn doc_inspect_pins_the_sequence_to_the_reported_active_id() {
+        use tokio::io::{AsyncBufReadExt, AsyncWriteExt};
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap().to_string();
+        tokio::spawn(async move {
+            let (s, _) = listener.accept().await.unwrap();
+            let (r, mut w) = s.into_split();
+            let mut lines = tokio::io::BufReader::new(r).lines();
+            while let Ok(Some(line)) = lines.next_line().await {
+                let req: Value = serde_json::from_str(&line).unwrap();
+                let result = match req["params"]["command"].as_str().unwrap_or_default() {
+                    "project.inspect" => json!({"activeSequence": 21}),
+                    // The app's own active sequence has since moved on to 54; only an explicit
+                    // `item` still gets 21's data (an unscoped call would wrongly answer for 54).
+                    "sequence.inspect" => json!({"id": req["params"]["params"]["item"].as_i64().unwrap_or(54)}),
+                    _ => Value::Null,
+                };
+                let line = format!("{}\n", json!({"id": req["id"], "ok": true, "result": result}));
+                w.write_all(line.as_bytes()).await.unwrap();
+            }
+        });
+        let m = FilmcraftMcp::bridge(&addr).unwrap();
+        let v = m.document().await.unwrap();
+        assert_eq!(v["project"]["activeSequence"], json!(21), "{v}");
+        assert_eq!(v["sequence"]["id"], json!(21), "sequence must describe the reported active id, not whatever is active now: {v}");
+    }
+
+    /// `activeSequence` is a `u64` (`ItemId`'s representation; `item_p` parses the `item` param
+    /// with `u64_p`), so an id above `i64::MAX` must still round-trip through `document()`:
+    /// reading it with `as_i64` would silently return `None` and make `sequence` go null instead
+    /// of inspecting the (valid) id project.inspect reported.
+    #[tokio::test]
+    async fn doc_inspect_handles_an_active_sequence_id_above_i64_max() {
+        use tokio::io::{AsyncBufReadExt, AsyncWriteExt};
+        const HUGE: u64 = i64::MAX as u64 + 1;
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap().to_string();
+        tokio::spawn(async move {
+            let (s, _) = listener.accept().await.unwrap();
+            let (r, mut w) = s.into_split();
+            let mut lines = tokio::io::BufReader::new(r).lines();
+            while let Ok(Some(line)) = lines.next_line().await {
+                let req: Value = serde_json::from_str(&line).unwrap();
+                let result = match req["params"]["command"].as_str().unwrap_or_default() {
+                    "project.inspect" => json!({"activeSequence": HUGE}),
+                    // Echoes back whatever `item` it was actually asked for, so the test can
+                    // check that `document()` asked for `HUGE` rather than nothing at all.
+                    "sequence.inspect" => json!({"id": req["params"]["params"]["item"]}),
+                    _ => Value::Null,
+                };
+                let line = format!("{}\n", json!({"id": req["id"], "ok": true, "result": result}));
+                w.write_all(line.as_bytes()).await.unwrap();
+            }
+        });
+        let m = FilmcraftMcp::bridge(&addr).unwrap();
+        let v = m.document().await.unwrap();
+        assert_eq!(v["project"]["activeSequence"].as_u64(), Some(HUGE), "{v}");
+        assert_eq!(v["sequence"]["id"].as_u64(), Some(HUGE), "an id above i64::MAX must still be inspected, not dropped to a null sequence: {v}");
+    }
 }
diff --git a/crates/av1/README.md b/crates/av1/README.md
index 354484158..8d29c1eeb 100644
--- a/crates/av1/README.md
+++ b/crates/av1/README.md
@@ -43,12 +43,12 @@ reference) is used only as an external test oracle.
 
 ## Accuracy
 
-`tests/oracle_intra.rs` encodes all-intra streams with ffmpeg's libsvtav1 (with and without the
+`tests/it/oracle_intra.rs` encodes all-intra streams with ffmpeg's libsvtav1 (with and without the
 in-loop filters; 64×64 and 128×128 superblocks; intra edge filter on and off) and compares every
 decoded frame with libdav1d: **bit-exact** on all 13 fixtures (8- and 10-bit 4:2:0; 128×128 to
 1280×720 including odd sizes; testsrc2, mandelbrot, gradients and noise; presets 1–8).
 
-`tests/conformance.rs` downloads libaom's conformance test vectors on first use
+`tests/it/conformance.rs` downloads libaom's conformance test vectors on first use
 (storage.googleapis.com/aom-test-data) and compares with libdav1d: `av1-1-b8-02-allintra`
 (39 frames, deblocking + CDEF + self-guided restoration), `05-mv`, `06-mfmv`, `24-monochrome`
 and `b10-23-film_grain-50` are **bit-exact** in the default run. The ignored
@@ -58,8 +58,8 @@ and `b10-23-film_grain-50` are **bit-exact** in the default run. The ignored
 with scaled inter-layer prediction), `24-monochrome` (8 and 10-bit) and
 `16-intra_only-intrabc-extreme-dv` (1080p intra block copy), `23-film_grain-50` (8 and 10-bit).
 
-`tests/oracle_inter.rs` also checks draft mode: every unflagged frame stays bit-exact with
-libdav1d and only flagged frames differ, with 1 and 4 threads. `tests/oracle_inter.rs` encodes SVT-AV1 GOPs (hierarchical references, compound prediction,
+`tests/it/oracle_inter.rs` also checks draft mode: every unflagged frame stays bit-exact with
+libdav1d and only flagged frames differ, with 1 and 4 threads. `tests/it/oracle_inter.rs` encodes SVT-AV1 GOPs (hierarchical references, compound prediction,
 OBMC / warped motion, motion-field projection, all loop filters; presets 3–8, 8- and 10-bit, odd
 sizes), plus super-resolution (denominator 12) and film-grain streams, and compares every frame
 with libdav1d: **bit-exact** on all 6 fixtures.
@@ -76,13 +76,13 @@ independent). Results never depend on scheduling (the oracle tests compare 1 thr
 and libdav1d). With frame threads, pictures may be returned by a
 later `decode_pts` call or by `flush`; each carries the `pts` of the temporal unit that showed it.
 
-`tests/perf.rs` (ignored) prints single-threaded fps (thread CPU time), per-stage ms/frame
+`tests/it/perf.rs` (ignored) prints single-threaded fps (thread CPU time), per-stage ms/frame
 (`Decoder::stats()`) and all-core fps with its per-stage ms/frame for 1080p fixtures (key frames,
 GOPs, tiles, low delay) and a single-tile 2160p GOP; `AV1_PERF_ONLY=a,b` picks fixtures. The hot loops (sub-pixel filters,
 CDEF, inverse transforms, deblocking, entropy decoding) are written for auto-vectorisation.
 
 Measured 2026-10-01 on a 14-core Apple Silicon Mac (release build, SVT-AV1 preset 8 1080p
-fixtures from `tests/perf.rs`), before (`31f8b3d`: hot loops only, no threading) and after tile / frame /
+fixtures from `tests/it/perf.rs`), before (`31f8b3d`: hot loops only, no threading) and after tile / frame /
 post-filter threading. The machine was heavily loaded by other builds during both runs (load
 average 200–400), so the all-core wall figures understate what an idle machine reaches and are
 noisy; single-threaded figures use thread CPU time and are comparable.
@@ -125,6 +125,13 @@ motion vectors nor CDFs reach another frame — skip deblocking, CDEF and loop r
 (super-resolution still runs, it sets the output size) and are flagged `Picture::draft`. In
 SVT-AV1's hierarchical GOPs that is the top layer, half of the frames.
 
+## Limits
+
+Frames beyond the AV1 level 6.x limits (Annex A: at most 16384 wide, 8704 high and 35 651 584 luma samples
+in total, so 16384 x 2176 or 8192 x 4352 at most) are refused with `Error::Invalid("frame size")`. The sequence
+header can code up to 65536 x 65536, which would ask for gigabytes of buffers from a few bytes of hostile input;
+no real stream comes close to level 6.3, the highest defined level.
+
 ## API
 
 ```rust
diff --git a/crates/av1/src/decoder.rs b/crates/av1/src/decoder.rs
index 66c966986..c9f487d95 100644
--- a/crates/av1/src/decoder.rs
+++ b/crates/av1/src/decoder.rs
@@ -23,6 +23,17 @@ use crate::stats::{DecodeStats, Stage, Timer};
 use crate::tile::TileDecoder;
 use crate::{Error, Picture, Result};
 
+/// Largest accepted frame: the AV1 level 6.x limits (Annex A: MaxHSize 16384, MaxVSize 8704, MaxPicSize
+/// 35 651 584 luma samples; level 6.3 is the highest defined). The sequence header allows 65536 x 65536
+/// (gigabytes of buffers), so nothing larger than a level 6.3 frame is decoded.
+const MAX_FRAME_WIDTH: u32 = 16384;
+const MAX_FRAME_HEIGHT: u32 = 8704;
+const MAX_FRAME_AREA: u64 = 35_651_584;
+
+/// Whether a frame of `width` x `height` luma samples is within the decoder's resource limits.
+fn frame_size_allowed(width: u32, height: u32) -> bool {
+    width <= MAX_FRAME_WIDTH && height <= MAX_FRAME_HEIGHT && u64::from(width) * u64::from(height) <= MAX_FRAME_AREA
+}
 const OBU_SEQUENCE_HEADER_T: u32 = 1;
 const OBU_TEMPORAL_DELIMITER_T: u32 = 2;
 const OBU_FRAME_HEADER_T: u32 = 3;
@@ -92,6 +103,8 @@ struct FrameJob {
     ref_info: [RefInfo; NUM_REF_FRAMES],
     /// Tile payloads (tile number, data).
     tiles: Vec<(usize, Vec<u8>)>,
+    /// Each tile may be supplied by exactly one tile group.
+    tile_covered: Vec<bool>,
     slot: Arc<FrameSlot>,
     /// The output picture, when the frame is shown.
     picture: Option<Arc<Slot<Arc<Picture>>>>,
@@ -505,7 +518,7 @@ impl Decoder {
         }
         // Encoders exist that code frames slightly larger than the sequence maximum (e.g. a
         // 270-line stream coded as 272 lines); like other decoders we accept them.
-        if fh.upscaled_width > 65536 || fh.frame_height > 65536 {
+        if !frame_size_allowed(fh.upscaled_width, fh.frame_height) {
             return Err(Error::Invalid("frame size"));
         }
         if !fh.frame_is_intra {
@@ -520,12 +533,14 @@ impl Decoder {
         }
         let picture = fh.show_frame.then(Slot::new);
         let draft = self.draft && fh.show_frame && fh.refresh_frame_flags == 0;
+        let tile_count = fh.tile_info.cols.checked_mul(fh.tile_info.rows).ok_or(Error::Invalid("tile count overflows"))?;
         self.pending = Some(Box::new(FrameJob {
             seq,
             fh,
             refs: self.ref_frames.clone(),
             ref_info: self.refs.clone(),
             tiles: Vec::new(),
+            tile_covered: vec![false; tile_count],
             slot: Slot::new(),
             picture,
             pts: self.pts,
@@ -568,13 +583,20 @@ impl Decoder {
                 v + 1
             };
             let end = pos.checked_add(size).filter(|&e| e <= data.len()).ok_or(Error::Truncated)?;
+            if job.tile_covered.get(tile_num).copied() != Some(false) {
+                return Err(Error::Invalid("tile is covered by multiple tile groups"));
+            }
             job.tiles.push((tile_num, data[pos..end].to_vec()));
+            job.tile_covered[tile_num] = true;
             pos = end;
         }
         if tg_end != num_tiles - 1 {
             self.pending = Some(job);
             return Ok(None);
         }
+        if job.tile_covered.iter().any(|&covered| !covered) {
+            return Err(Error::Invalid("frame is missing tile coverage"));
+        }
         self.seen_frame_header = false;
         Ok(self.submit(job))
     }
@@ -947,3 +969,26 @@ fn project(fs: &mut FrameState, src: usize, dst_sign: i32) -> bool {
     }
     true
 }
+
+#[cfg(test)]
+mod tests {
+    use super::frame_size_allowed;
+
+    #[test]
+    fn frames_up_to_the_level_6_3_limits_are_allowed() {
+        assert!(frame_size_allowed(16384, 2176)); // exactly MaxPicSize
+        assert!(frame_size_allowed(4096, 8704)); // exactly MaxVSize
+        assert!(frame_size_allowed(8192, 4352)); // exactly MaxPicSize
+        assert!(frame_size_allowed(7680, 4320)); // 8K UHD
+        assert!(frame_size_allowed(1, 1));
+    }
+
+    #[test]
+    fn frames_beyond_the_limits_are_refused() {
+        assert!(!frame_size_allowed(16384, 2177)); // one row over MaxPicSize
+        assert!(!frame_size_allowed(16384, 8704)); // within both sides, four times MaxPicSize
+        assert!(!frame_size_allowed(4096, 8705)); // one row over MaxVSize
+        assert!(!frame_size_allowed(16385, 1)); // one column over MaxHSize
+        assert!(!frame_size_allowed(65536, 65536));
+    }
+}
diff --git a/crates/av1/src/grain.rs b/crates/av1/src/grain.rs
index d4baad621..677243644 100644
--- a/crates/av1/src/grain.rs
+++ b/crates/av1/src/grain.rs
@@ -133,6 +133,10 @@ pub(crate) fn apply(pic: &mut Picture, g: &FilmGrainParams, seq: &SequenceHeader
         for i in 0..n - 1 {
             let dy = ys[i + 1] as i32 - ys[i] as i32;
             let dx = xs[i + 1] as i32 - xs[i] as i32;
+            // The header parser rejects non-increasing points; never divide by zero regardless.
+            if dx <= 0 {
+                continue;
+            }
             let delta = dy * ((65536 + (dx >> 1)) / dx);
             for x in 0..dx {
                 l[xs[i] as usize + x as usize] = ys[i] as i32 + ((x * delta + 32768) >> 16);
@@ -274,3 +278,34 @@ pub(crate) fn apply(pic: &mut Picture, g: &FilmGrainParams, seq: &SequenceHeader
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Regression: two equal scaling points divided by zero building the scaling lookup.
+    #[test]
+    fn equal_scaling_points_do_not_panic() {
+        let mut g = FilmGrainParams { apply_grain: true, num_y_points: 2, ..Default::default() };
+        g.point_y_value[..2].copy_from_slice(&[64, 64]);
+        g.point_y_scaling[..2].copy_from_slice(&[20, 40]);
+        let (w, h) = (16usize, 16usize);
+        let mut pic = Picture {
+            width: w as u32,
+            height: h as u32,
+            bit_depth: 10,
+            subsampling_x: 1,
+            subsampling_y: 1,
+            mono_chrome: false,
+            planes: [vec![512; w * h], vec![512; w * h / 4], vec![512; w * h / 4]],
+            color_primaries: 1,
+            transfer_characteristics: 1,
+            matrix_coefficients: 1,
+            full_range: false,
+            pts: 0,
+            draft: false,
+        };
+        apply(&mut pic, &g, &SequenceHeader::default());
+        assert_eq!(pic.planes[0].len(), w * h);
+    }
+}
diff --git a/crates/av1/src/header.rs b/crates/av1/src/header.rs
index 73d7ec437..c4e5f8a16 100644
--- a/crates/av1/src/header.rs
+++ b/crates/av1/src/header.rs
@@ -1251,6 +1251,9 @@ impl FrameHeader {
             g.point_y_value[i] = r.f(8)? as u8;
             g.point_y_scaling[i] = r.f(8)? as u8;
         }
+        if !strictly_increasing(&g.point_y_value[..g.num_y_points]) {
+            return Err(Error::Invalid("point_y_value"));
+        }
         g.chroma_scaling_from_luma = if seq.color.mono_chrome { false } else { r.flag()? };
         if seq.color.mono_chrome || g.chroma_scaling_from_luma || (seq.color.subsampling_x == 1 && seq.color.subsampling_y == 1 && g.num_y_points == 0) {
             g.num_cb_points = 0;
@@ -1264,6 +1267,9 @@ impl FrameHeader {
                 g.point_cb_value[i] = r.f(8)? as u8;
                 g.point_cb_scaling[i] = r.f(8)? as u8;
             }
+            if !strictly_increasing(&g.point_cb_value[..g.num_cb_points]) {
+                return Err(Error::Invalid("point_cb_value"));
+            }
             g.num_cr_points = r.f(4)? as usize;
             if g.num_cr_points > 10 {
                 return Err(Error::Invalid("num_cr_points"));
@@ -1272,6 +1278,9 @@ impl FrameHeader {
                 g.point_cr_value[i] = r.f(8)? as u8;
                 g.point_cr_scaling[i] = r.f(8)? as u8;
             }
+            if !strictly_increasing(&g.point_cr_value[..g.num_cr_points]) {
+                return Err(Error::Invalid("point_cr_value"));
+            }
         }
         g.grain_scaling_minus_8 = r.f(2)?;
         g.ar_coeff_lag = r.f(2)?;
@@ -1322,6 +1331,12 @@ pub(crate) fn default_gm_params() -> [[i32; 6]; 8] {
     p
 }
 
+/// Film grain scaling points must strictly increase (6.8.20); equal points would divide by zero when
+/// the scaling lookup is interpolated.
+fn strictly_increasing(values: &[u8]) -> bool {
+    values.windows(2).all(|w| w.first() < w.get(1))
+}
+
 fn inverse_recenter(r: i32, v: i32) -> i32 {
     if v > 2 * r {
         v
@@ -1359,3 +1374,17 @@ fn decode_subexp(r: &mut BitReader, num_syms: i32) -> Result<i32> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::strictly_increasing;
+
+    #[test]
+    fn film_grain_points_must_strictly_increase() {
+        assert!(strictly_increasing(&[]));
+        assert!(strictly_increasing(&[7]));
+        assert!(strictly_increasing(&[0, 64, 255]));
+        assert!(!strictly_increasing(&[0, 64, 64]));
+        assert!(!strictly_increasing(&[128, 64]));
+    }
+}
diff --git a/crates/av1/src/tile.rs b/crates/av1/src/tile.rs
index 9d5344652..6776f201f 100644
--- a/crates/av1/src/tile.rs
+++ b/crates/av1/src/tile.rs
@@ -394,6 +394,10 @@ impl<'a, 'f> TileDecoder<'a, 'f> {
     fn decode_block(&mut self, r: usize, c: usize, sub_size: usize) -> Result<()> {
         let (ssx, ssy) = (self.fs.ssx, self.fs.ssy);
         let num_planes = self.fs.num_planes;
+        // Conformance requirement (4:2:2 has no chroma size for 4x16 and similar blocks); indexing the size tables with BLOCK_INVALID would panic.
+        if num_planes > 1 && self.fs.plane_residual_size(sub_size, 1) == BLOCK_INVALID {
+            return Err(crate::Error::Invalid("block size has no chroma size at this subsampling"));
+        }
         let mut b = Block { mi_row: r, mi_col: c, mi_size: sub_size, ..Default::default() };
         b.bw4 = NUM_4X4_BLOCKS_WIDE[sub_size] as usize;
         b.bh4 = NUM_4X4_BLOCKS_HIGH[sub_size] as usize;
diff --git a/crates/av1/tests/fuzz_hostile.rs b/crates/av1/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..4421b18c4
--- /dev/null
+++ b/crates/av1/tests/fuzz_hostile.rs
@@ -0,0 +1,156 @@
+//! Hostile-input robustness: truncation, header-region sweeps and random mutation of small
+//! ffmpeg-generated AV1 streams (frame by frame) must never panic or run away. Skips without ffmpeg.
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use filmcraft_av1::Decoder;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+/// (name, encoder args, pix_fmt)
+const SEEDS: &[(&str, &str, &str)] = &[("av1_fz_default", "-c:v libsvtav1 -g 4", "yuv420p"), ("av1_fz_10bit", "-c:v libsvtav1 -g 6", "yuv420p10le")];
+
+fn ivf_frames(data: &[u8]) -> Vec<Vec<u8>> {
+    let mut out = Vec::new();
+    let Some(h) = data.get(6..8) else { return out };
+    let mut pos = usize::from(u16::from_le_bytes([h[0], h[1]]));
+    while let Some(hd) = data.get(pos..pos + 12) {
+        let size = u32::from_le_bytes([hd[0], hd[1], hd[2], hd[3]]) as usize;
+        pos += 12;
+        let end = pos.saturating_add(size).min(data.len());
+        out.push(data[pos..end].to_vec());
+        pos = end;
+    }
+    out
+}
+
+fn make(ff: &std::path::Path, name: &str, args: &str, pix: &str) -> Option<Vec<Vec<u8>>> {
+    let out = filmcraft_testkit::fixtures_dir("av1").join(format!("{name}.ivf"));
+    let p = filmcraft_testkit::fixtures::generate(&out, |tmp| {
+        let a: Vec<&str> = args.split_whitespace().collect();
+        matches!(
+            Command::new(ff)
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=25", "-frames:v", "6", "-pix_fmt", pix])
+                .args(a)
+                .args(["-f", "ivf"])
+                .arg(tmp)
+                .stdin(Stdio::null())
+                .status(),
+            Ok(s) if s.success()
+        )
+    })?;
+    Some(ivf_frames(&std::fs::read(p).ok()?))
+}
+
+static PANICS: AtomicUsize = AtomicUsize::new(0);
+
+/// Decoder worker threads may catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(frames: &[Vec<u8>], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for threads in [1, 3] {
+            let mut dec = Decoder::with_threads(threads);
+            for (i, f) in frames.iter().enumerate() {
+                let _ = dec.decode_pts(f, i as i64);
+            }
+            let _ = dec.flush_result();
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(Ordering::SeqCst) == before, "panic: {label}");
+}
+
+/// Random-mutation rounds per seed (raise with FILMCRAFT_FUZZ_ITERS for a long hunt).
+fn iters() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()).unwrap_or(300)
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("AV1 fuzz") else { return };
+    for &(name, args, pix) in SEEDS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, "libsvtav1") {
+            filmcraft_testkit::skip("AV1 fuzz", &format!("this ffmpeg has no libsvtav1 encoder (seed {name})"));
+            continue;
+        }
+        let Some(seed) = make(&ff, name, args, pix) else {
+            panic!("ffmpeg has libsvtav1 but could not encode the {name} seed");
+        };
+        if seed.is_empty() {
+            filmcraft_testkit::skip("AV1 fuzz", &format!("the {name} seed has no frames"));
+            continue;
+        }
+        // truncate each of the first frames at every length
+        for fi in 0..seed.len().min(3) {
+            let len = seed[fi].len();
+            for n in (0..len).step_by((len / 200).max(1)) {
+                let mut d = seed.clone();
+                d[fi].truncate(n);
+                run_all(&d, &format!("{name} frame {fi} truncate {n}"));
+            }
+        }
+        // header region of every frame: every byte to a few values, every bit
+        for fi in 0..seed.len() {
+            for p in 0..seed[fi].len().min(96) {
+                for v in [0u8, 0xff, 0x80, 0x01, 0x7f] {
+                    let mut d = seed.clone();
+                    d[fi][p] = v;
+                    run_all(&d, &format!("{name} frame {fi} byte {p}={v:#x}"));
+                }
+                for b in 0..8 {
+                    let mut d = seed.clone();
+                    d[fi][p] ^= 1 << b;
+                    run_all(&d, &format!("{name} frame {fi} flip {p}.{b}"));
+                }
+            }
+        }
+        let mut rng = Rng(0x9e3779b97f4a7c15 ^ name.len() as u64);
+        for i in 0..iters() {
+            let mut d = seed.clone();
+            for _ in 0..1 + rng.below(6) {
+                let fi = rng.below(d.len());
+                if d[fi].is_empty() {
+                    continue;
+                }
+                let p = rng.below(d[fi].len());
+                if rng.below(2) == 0 {
+                    d[fi][p] ^= 1 << rng.below(8);
+                } else {
+                    d[fi][p] = rng.next() as u8;
+                }
+            }
+            run_all(&d, &format!("{name} random {i}"));
+        }
+    }
+}
diff --git a/crates/av1/tests/adhoc.rs b/crates/av1/tests/it/adhoc.rs
similarity index 92%
rename from crates/av1/tests/adhoc.rs
rename to crates/av1/tests/it/adhoc.rs
index e140b9768..1595bc257 100644
--- a/crates/av1/tests/adhoc.rs
+++ b/crates/av1/tests/it/adhoc.rs
@@ -1,7 +1,7 @@
 //! Compare an arbitrary IVF file with libdav1d:
-//! `AV1_IVF=/path/x.ivf AV1_PIX=yuv420p cargo test -p filmcraft-av1 --test adhoc -- --ignored --nocapture`
+//! `AV1_IVF=/path/x.ivf AV1_PIX=yuv420p cargo test -p filmcraft-av1 --test it adhoc:: -- --ignored --nocapture`
 
-mod common;
+use crate::common;
 use common::*;
 
 #[test]
diff --git a/crates/av1/tests/common/mod.rs b/crates/av1/tests/it/common/mod.rs
similarity index 100%
rename from crates/av1/tests/common/mod.rs
rename to crates/av1/tests/it/common/mod.rs
diff --git a/crates/av1/tests/conformance.rs b/crates/av1/tests/it/conformance.rs
similarity index 94%
rename from crates/av1/tests/conformance.rs
rename to crates/av1/tests/it/conformance.rs
index 033f590e2..b70270af0 100644
--- a/crates/av1/tests/conformance.rs
+++ b/crates/av1/tests/it/conformance.rs
@@ -1,6 +1,6 @@
 //! libaom conformance test vectors (downloaded on first use), compared with libdav1d.
 
-mod common;
+use crate::common;
 use common::*;
 
 /// Vectors the decoder handles today (more are added as stages land).
@@ -17,7 +17,7 @@ fn conformance_vectors() {
 }
 
 /// The wider libaom set (slow: many downloads and decodes):
-/// `cargo test -p filmcraft-av1 --test conformance -- --ignored`; `AV1_VECTORS=a,b` overrides it.
+/// `cargo test -p filmcraft-av1 --test it conformance:: -- --ignored`; `AV1_VECTORS=a,b` overrides it.
 #[test]
 #[ignore]
 fn conformance_vectors_extended() {
diff --git a/crates/av1/tests/it/hostile_dims.rs b/crates/av1/tests/it/hostile_dims.rs
new file mode 100644
index 000000000..1312e938d
--- /dev/null
+++ b/crates/av1/tests/it/hostile_dims.rs
@@ -0,0 +1,161 @@
+//! A few bytes must not make the decoder allocate gigabytes: oversized sequences are refused.
+//! Hand-built (no ffmpeg): a reduced still-picture sequence header plus a lossless key frame whose
+//! tiles are one zero byte each.
+
+use filmcraft_av1::{Decoder, Error};
+
+#[derive(Default)]
+struct Bits {
+    bytes: Vec<u8>,
+    n: usize,
+}
+
+impl Bits {
+    fn put(&mut self, value: u32, bits: usize) {
+        for i in (0..bits).rev() {
+            if self.n.is_multiple_of(8) {
+                self.bytes.push(0);
+            }
+            if (value >> i) & 1 == 1
+                && let Some(b) = self.bytes.last_mut()
+            {
+                *b |= 0x80 >> (self.n % 8);
+            }
+            self.n += 1;
+        }
+    }
+}
+
+fn obu(kind: u8, payload: &[u8]) -> Vec<u8> {
+    let mut v = vec![kind << 3 | 0b10];
+    let mut n = payload.len();
+    loop {
+        let b = (n & 0x7f) as u8;
+        n >>= 7;
+        v.push(if n > 0 { b | 0x80 } else { b });
+        if n == 0 {
+            break;
+        }
+    }
+    v.extend_from_slice(payload);
+    v
+}
+
+fn tile_log2(blk: u32, target: u32) -> u32 {
+    let mut k = 0;
+    while (blk << k) < target {
+        k += 1;
+    }
+    k
+}
+
+/// Temporal delimiter, reduced still-picture sequence header of `w` x `h` (64x64 superblocks) and a
+/// lossless key frame whose uniformly spaced tiles are one zero byte each.
+fn stream(w: u32, h: u32) -> Vec<u8> {
+    let mut s = Bits::default();
+    s.put(0, 3); // seq_profile
+    s.put(1, 1); // still_picture
+    s.put(1, 1); // reduced_still_picture_header
+    s.put(0, 5); // seq_level_idx
+    s.put(15, 4); // frame_width_bits_minus_1
+    s.put(15, 4); // frame_height_bits_minus_1
+    s.put(w - 1, 16);
+    s.put(h - 1, 16);
+    s.put(0, 3 + 3 + 7 + 1); // sb size, filter intra, edge; superres, cdef, restoration; color config; film grain
+    s.put(1, 1); // trailing bit
+
+    let (sb_cols, sb_rows) = (w.div_ceil(64), h.div_ceil(64));
+    let cols_log2 = tile_log2(64, sb_cols); // MAX_TILE_WIDTH / 64 superblocks
+    let min_log2_tiles = cols_log2.max(tile_log2(2304, sb_rows * sb_cols));
+    let rows_log2 = min_log2_tiles.saturating_sub(cols_log2);
+    let tiles = (sb_cols.div_ceil(sb_cols.div_ceil(1 << cols_log2))) * (sb_rows.div_ceil(sb_rows.div_ceil(1 << rows_log2)));
+    let mut f = Bits::default();
+    f.put(0b0001, 4); // disable_cdf_update, allow_screen_content_tools, render_and_frame_size_different, uniform_tile_spacing_flag
+    f.put(0, 2); // no increment of the tile column / row counts
+    if tiles > 1 {
+        f.put(0, (cols_log2 + rows_log2) as usize + 2); // context_update_tile_id, tile_size_bytes_minus_1
+    }
+    f.put(0, 8 + 4 + 1 + 1); // base_q_idx 0 (lossless), delta flags, using_qmatrix, segmentation_enabled, reduced_tx_set
+    let mut frame = f.bytes;
+    frame.push(0); // tile_start_and_end_present_flag
+    for _ in 1..tiles {
+        frame.extend([0, 0]); // tile_size_minus_1 = 0, one data byte
+    }
+    frame.extend([0, 0]);
+
+    let mut out = obu(2, &[]);
+    out.extend(obu(1, &s.bytes));
+    out.extend(obu(6, &frame));
+    out
+}
+
+fn refused(w: u32, h: u32) {
+    let mut dec = Decoder::new();
+    let r = dec.decode(&stream(w, h)).and_then(|_| dec.flush_result());
+    assert!(matches!(r, Err(Error::Invalid(m)) if m.contains("frame size")), "{w}x{h} must be refused as too large, got {:?}", r.as_ref().map(|p| p.len()));
+}
+
+#[test]
+fn very_wide_frame_is_refused() {
+    refused(65536, 16);
+}
+
+#[test]
+fn very_tall_frame_is_refused() {
+    refused(16, 65536);
+}
+
+#[test]
+fn huge_frames_are_refused_without_allocating() {
+    refused(65536, 65536);
+    refused(65535, 65535);
+    refused(30000, 30000);
+}
+
+/// Frames past the level 6.x limits (width 16384, height 8704, area 35 651 584) are refused. The accepted side of
+/// each boundary is unit-tested on `frame_size_allowed` in `decoder.rs`: decoding a maximum-size frame end to end
+/// needs gigabytes.
+#[test]
+fn frames_past_the_level_6_limits_are_refused() {
+    refused(16384, 2177);
+    refused(16384, 8704);
+    refused(4096, 8705);
+}
+
+/// A 64x48 4:2:0 key frame whose sequence profile bit was flipped to 2 (4:2:2): blocks such as 4x16 then have no
+/// chroma size (BLOCK_INVALID) and used to index the size tables out of bounds.
+const PROFILE_FLIPPED: &[u8] = &[
+    0x12, 0x00, 0x0a, 0x0b, 0x42, 0x00, 0x00, 0x05, 0x55, 0x7f, 0xbc, 0x6a, 0xf9, 0x00, 0x40, 0x32, 0x81, 0x05, 0x14, 0x00, 0xa5, 0xa0, 0x40, 0xd9, 0x52, 0xb9,
+    0xe7, 0x3c, 0xa6, 0xc1, 0xe4, 0xe9, 0xff, 0x6d, 0x12, 0xc3, 0xce, 0xac, 0x00, 0x92, 0x6f, 0x29, 0x6a, 0xee, 0x7e, 0x1a, 0x31, 0xfe, 0xe6, 0xb8, 0x2e, 0xe2,
+    0xcf, 0x3d, 0xce, 0x24, 0xe6, 0x30, 0x03, 0xcd, 0x89, 0x49, 0x1f, 0xa7, 0x8a, 0x75, 0xb3, 0x93, 0x27, 0x7b, 0x2f, 0x39, 0xc7, 0x60, 0xb7, 0xf8, 0x69, 0xbc,
+    0x53, 0x71, 0x30, 0x64, 0x20, 0x7e, 0xc1, 0x10, 0x17, 0xe4, 0xca, 0x34, 0xe9, 0xae, 0x47, 0x39, 0x68, 0x68, 0xef, 0x33, 0x9f, 0x26, 0xe2, 0x3f, 0xf1, 0xef,
+    0x02, 0xb7, 0xfd, 0xb1, 0x78, 0x4c, 0x35, 0x31, 0x17, 0x27, 0x11, 0x2f, 0xd7, 0x25, 0x01, 0x30, 0xa5, 0x7a, 0xaf, 0x9b, 0x5b, 0x3b, 0x8d, 0x9e, 0xd5, 0x23,
+    0x06, 0x22, 0x3a, 0xec, 0x57, 0xae, 0xdb, 0x4d, 0x00, 0x36, 0xff, 0xbd, 0x3b, 0xef, 0x0a, 0xf0, 0x39, 0x2a, 0xa9, 0x2a, 0x56, 0x9d, 0x7e, 0xc2, 0x05, 0x46,
+    0x21, 0x8b, 0xd9, 0x45, 0x33, 0x59, 0x3c, 0x40, 0xe0, 0x2b, 0xec, 0x51, 0x0a, 0xf2, 0xf0, 0xe5, 0x61, 0x99, 0xfd, 0x2e, 0xe5, 0x8c, 0x69, 0x72, 0x44, 0xb8,
+    0x92, 0x9e, 0x2e, 0x51, 0x0b, 0x8c, 0x16, 0x0f, 0xd9, 0xf2, 0x47, 0xc4, 0x36, 0x9d, 0x54, 0xc6, 0x9f, 0x26, 0x68, 0xf7, 0xfa, 0x80, 0xab, 0x68, 0xd6, 0x61,
+    0xd2, 0x59, 0x4b, 0x07, 0xc4, 0x7a, 0xde, 0x37, 0xfb, 0x02, 0xd5, 0x3d, 0xb0, 0xeb, 0x71, 0x1b, 0x07, 0x45, 0xdc, 0x03, 0x3b, 0x4f, 0xdf, 0x44, 0xa6, 0x28,
+    0xd4, 0xb0, 0xbb, 0x26, 0xa4, 0x4f, 0xee, 0xbb, 0xda, 0x59, 0x69, 0xfc, 0xf2, 0x4f, 0xf6, 0x6c, 0x0c, 0xd9, 0xe2, 0xc0, 0xa7, 0x64, 0x96, 0xd5, 0x7b, 0x1a,
+    0x71, 0xe0, 0xcc, 0x9e, 0xd7, 0xaf, 0xb9, 0x9a, 0x99, 0xcc, 0xe9, 0xa9, 0x79, 0xa3, 0xa8, 0xbc, 0xfe, 0xdb, 0xed, 0xa3, 0xd6, 0x7d, 0x31, 0xb0, 0x18, 0x3c,
+    0x9e, 0x55, 0x0f, 0x1a, 0xdf, 0x5d, 0x8c, 0x33, 0x5f, 0x2d, 0x00, 0xfc, 0x9d, 0x55, 0xc2, 0xc8, 0x10, 0x25, 0xc8, 0x7f, 0xa6, 0x47, 0xbf, 0xab, 0xf3, 0x97,
+    0xfb, 0xda, 0xd6, 0x6a, 0x14, 0x87, 0x9d, 0xef, 0x85, 0x12, 0x43, 0x31, 0xc4, 0x4c, 0x4c, 0x7a, 0x50, 0xd1, 0x87, 0xb8, 0x65, 0x2d, 0x3f, 0xf4, 0xa3, 0x54,
+    0xea, 0x19, 0xa6, 0xfe, 0x70, 0x30, 0x52, 0x7e, 0xbb, 0x9c, 0x3f, 0x2d, 0x10, 0x4b, 0x43, 0x04, 0x6c, 0x03, 0xc7, 0x15, 0xa8, 0x8e, 0x20, 0xde, 0x46, 0x9a,
+    0x12, 0xdf, 0xe5, 0xce, 0x08, 0x91, 0x3e, 0x74, 0xa4, 0x20, 0x78, 0x52, 0xfd, 0x4d, 0x9d, 0x5a, 0xca, 0xa2, 0xdc, 0xc8, 0x95, 0xa6, 0x69, 0x3a, 0x1a, 0x18,
+    0x48, 0x76, 0x8c, 0xfa, 0x58, 0xa0, 0x0d, 0xf4, 0xbd, 0xe1, 0x05, 0x37, 0xe6, 0xbb, 0x60, 0xa1, 0x83, 0x40, 0x08, 0xeb, 0x02, 0xa6, 0x6a, 0x7a, 0x16, 0x1f,
+    0xb3, 0xbb, 0x58, 0x66, 0x51, 0x79, 0xc7, 0x7a, 0xb2, 0xc2, 0x84, 0x69, 0x17, 0x4d, 0x27, 0xa7, 0xa4, 0xd9, 0xc2, 0xb4, 0x03, 0x57, 0x53, 0x44, 0xb9, 0x8f,
+    0x48, 0xd2, 0x1c, 0x74, 0xd9, 0xdd, 0x9b, 0x88, 0xdc, 0xda, 0xef, 0x70, 0xee, 0xf1, 0x04, 0xdf, 0x35, 0x39, 0x22, 0x49, 0xfe, 0x22, 0x9a, 0x0a, 0x33, 0x60,
+    0x49, 0xbe, 0x28, 0xfa, 0xdf, 0x71, 0xf6, 0x53, 0x87, 0x49, 0x01, 0x95, 0xfa, 0x22, 0x94, 0x7c, 0x0e, 0xf6, 0x7d, 0x7e, 0x1d, 0x41, 0x8d, 0xc9, 0x1b, 0xf9,
+    0x53, 0xc9, 0xea, 0x46, 0xee, 0xb2, 0x80, 0x75, 0xe1, 0xca, 0xa4, 0x0a, 0x9c, 0x2b, 0x7b, 0x18, 0x70, 0x56, 0x22, 0x76, 0xaf, 0x4d, 0x84, 0xdd, 0xad, 0x77,
+    0x0e, 0xea, 0x2e, 0xa9, 0xbf, 0x42, 0x95, 0xdf, 0x17, 0x61, 0xae, 0x46, 0x20, 0xb4, 0x57, 0xca, 0xe0, 0x78, 0x86, 0xd0, 0x51, 0xae, 0xfe, 0x51, 0x53, 0x0f,
+    0x36, 0x64, 0x5f, 0xb4, 0x5c, 0xac, 0x8b, 0x63, 0xe7, 0x5d, 0x98, 0x8e, 0x65, 0xe9, 0x93, 0xe4, 0x23, 0x10, 0xa3, 0x5b, 0x3b, 0x38, 0x5b, 0x8a, 0x7c, 0xe8,
+    0x60, 0x01, 0xc1, 0x0e, 0x53, 0x5e, 0x0e, 0x81, 0x33, 0x63, 0x8d, 0x53, 0x82, 0xa6, 0x7b, 0xbd, 0x02, 0x58, 0x1f, 0xe9, 0x50, 0x75, 0x24, 0x64, 0x80, 0x47,
+    0x02, 0x9e, 0x42, 0x28, 0xb0, 0xa2, 0xab, 0x8e, 0xd0, 0x81, 0xcc, 0xbd, 0x22, 0x87, 0x3f, 0xe4, 0x49, 0x4d, 0x5f, 0x6a, 0x5c, 0x5a, 0x5e, 0xe5, 0x30, 0x9d,
+    0x7f, 0xc5, 0xaf, 0xce, 0x6c, 0x9c, 0xaf, 0x09, 0x96, 0x1a, 0x62, 0x42, 0x61, 0xa3, 0x1d, 0x1c, 0xe6, 0xcf, 0xa8, 0x90, 0x4d, 0x05, 0x28, 0xef, 0x22, 0x81,
+    0x12, 0xa7, 0x70, 0x04, 0x0a, 0x0d, 0xe5, 0xa0, 0xd8,
+];
+
+#[test]
+fn block_without_chroma_size_is_an_error_not_a_panic() {
+    let mut dec = Decoder::new();
+    let r = dec.decode(PROFILE_FLIPPED).and_then(|_| dec.flush_result());
+    assert!(matches!(r, Err(Error::Invalid(m)) if m.contains("chroma size")), "got {:?}", r.as_ref().map(|p| p.len()));
+}
diff --git a/crates/av1/tests/it/main.rs b/crates/av1/tests/it/main.rs
new file mode 100644
index 000000000..decf05989
--- /dev/null
+++ b/crates/av1/tests/it/main.rs
@@ -0,0 +1,7 @@
+mod adhoc;
+mod common;
+mod conformance;
+mod hostile_dims;
+mod oracle_inter;
+mod oracle_intra;
+mod perf;
diff --git a/crates/av1/tests/oracle_inter.rs b/crates/av1/tests/it/oracle_inter.rs
similarity index 99%
rename from crates/av1/tests/oracle_inter.rs
rename to crates/av1/tests/it/oracle_inter.rs
index 06a4d88fe..5d443194f 100644
--- a/crates/av1/tests/oracle_inter.rs
+++ b/crates/av1/tests/it/oracle_inter.rs
@@ -2,7 +2,7 @@
 //! GOPs with hierarchical references, compound prediction, OBMC / warped motion, global motion,
 //! motion-field projection and all loop filters.
 
-mod common;
+use crate::common;
 use common::*;
 
 fn specs() -> Vec<Spec> {
diff --git a/crates/av1/tests/oracle_intra.rs b/crates/av1/tests/it/oracle_intra.rs
similarity index 99%
rename from crates/av1/tests/oracle_intra.rs
rename to crates/av1/tests/it/oracle_intra.rs
index 441220f18..d002af67e 100644
--- a/crates/av1/tests/oracle_intra.rs
+++ b/crates/av1/tests/it/oracle_intra.rs
@@ -1,6 +1,6 @@
 //! Intra-frame bit-exactness against libdav1d (run as an external ffmpeg process).
 
-mod common;
+use crate::common;
 use common::*;
 
 const NO_FILTERS: &str = "enable-cdef=0:enable-restoration=0:enable-dlf=0:keyint=1";
diff --git a/crates/av1/tests/perf.rs b/crates/av1/tests/it/perf.rs
similarity index 97%
rename from crates/av1/tests/perf.rs
rename to crates/av1/tests/it/perf.rs
index 9047605aa..518a0cac3 100644
--- a/crates/av1/tests/perf.rs
+++ b/crates/av1/tests/it/perf.rs
@@ -1,11 +1,11 @@
 //! Decode throughput and per-stage breakdown (ignored; run with
-//! `cargo test --release -p filmcraft-av1 --test perf -- --ignored --nocapture`).
+//! `cargo test --release -p filmcraft-av1 --test it perf:: -- --ignored --nocapture`).
 //!
 //! The machine may be busy (other builds), so single-threaded work is also measured with the
 //! thread CPU clock, which is robust to load; wall-clock figures are printed next to the load
 //! average.
 
-mod common;
+use crate::common;
 use common::*;
 use filmcraft_av1::{DecodeStats, Decoder, Stage};
 use std::time::Instant;
diff --git a/crates/av1/tools/extract_tables.py b/crates/av1/tools/extract_tables.py
index 83c4e2c9f..b4df9155b 100644
--- a/crates/av1/tools/extract_tables.py
+++ b/crates/av1/tools/extract_tables.py
@@ -14,11 +14,27 @@ Only the specification text is read:
 Each table is emitted as a nested Rust array whose shape is checked against the declared
 dimensions; the element type is the narrowest of u8/i8/u16/i16/i32 that holds every value.
 """
+import ast
+import operator
 import os
 import re
 import sys
+from pathlib import Path
 
-root = sys.argv[1]
+
+def _spec_dir(arg):
+    """Resolve the CLI argument and require it to be an existing directory."""
+    path = Path(arg).resolve()
+    if not path.is_dir():
+        sys.exit(f"not a directory: {arg}")
+    return path
+
+
+if len(sys.argv) != 2:
+    sys.exit("usage: extract_tables.py <av1-spec checkout>")
+# The argument is the operator's own spec checkout; _spec_dir requires it to be an existing
+# directory before anything is read from it.
+root = _spec_dir(sys.argv[1])  # NOSONAR
 files = sorted(f for f in os.listdir(root) if f.endswith(".md"))
 texts = {f: open(os.path.join(root, f), encoding="utf-8").read() for f in files}
 
@@ -29,13 +45,36 @@ def ev(expr):
     e = expr.strip().replace("\\", "")
     e = re.sub(r"\b([A-Z][A-Z0-9_]*)\b", lambda m: str(consts[m.group(1)]) if m.group(1) in consts else m.group(1), e)
     e = e.replace("/", "//")
-    return int(eval(e, {"__builtins__": {}}, {}))
+    binary = {
+        ast.Add: operator.add,
+        ast.Sub: operator.sub,
+        ast.Mult: operator.mul,
+        ast.FloorDiv: operator.floordiv,
+        ast.Mod: operator.mod,
+        ast.LShift: operator.lshift,
+        ast.RShift: operator.rshift,
+        ast.BitOr: operator.or_,
+        ast.BitAnd: operator.and_,
+        ast.BitXor: operator.xor,
+    }
+    unary = {ast.UAdd: operator.pos, ast.USub: operator.neg, ast.Invert: operator.invert}
+
+    def calculate(node):
+        if isinstance(node, ast.Constant) and isinstance(node.value, int):
+            return node.value
+        if isinstance(node, ast.BinOp) and type(node.op) in binary:
+            return binary[type(node.op)](calculate(node.left), calculate(node.right))
+        if isinstance(node, ast.UnaryOp) and type(node.op) in unary:
+            return unary[type(node.op)](calculate(node.operand))
+        raise ValueError("unsupported specification expression")
+
+    return int(calculate(ast.parse(e, mode="eval").body))
 
 
 # --- constants: symbol table (section 3) ---
 pending = []
 for line in texts["03.symbols.md"].split("\n"):
-    m = re.match(r"^\|\s*`([A-Z][A-Z0-9_]*)`\s*\|\s*([^|]+?)\s*\|", line)
+    m = re.match(r"^\|\s*`([A-Z][A-Z0-9_]*)`\s*\|\s*([^\s|](?:[^|]*[^|\s])?)\s*\|", line)
     if m:
         pending.append((m.group(1), m.group(2)))
 # --- constants: value/name tables (section 6 semantics, section 8/9) ---
@@ -77,7 +116,7 @@ for name, val in pending:
 def cells(text):
     """Split one initialiser cell. A missing comma between two operands on separate lines
     (Split_Tx_Size in the spec text: `TX_32X32` / `TX_4X8`) yields two cells."""
-    parts = re.split(r"(?<=[A-Za-z0-9_])\s*\n\s*(?=[A-Za-z0-9_])", text.strip())
+    parts = re.split(r"(?<=[A-Za-z0-9_])[^\S\n]*\n[^\S\n]*(?=[A-Za-z0-9_])", text.strip())
     if len(parts) > 1:
         sys.stderr.write("note: missing comma in spec table between %s\n" % parts)
     return parts
@@ -118,10 +157,25 @@ def shape(x):
     return []
 
 
+# `~~~~` opens a block on its own line (with an optional `c` marker) and the next run of
+# tildes closes it. Walk the pairs with two linear searches instead of the lazy `(.*?)`
+# with re.S, which rescans the whole remaining text at every position (super-linear).
+FENCE_OPEN = re.compile(r"~~~~~?\s*c?\n")
+FENCE_CLOSE = re.compile(r"~~~~~?")
+
 tables = {}
 for f in files:
     t = texts[f]
-    for block in re.findall(r"~~~~~?\s*c?\n(.*?)~~~~~?", t, re.S):
+    pos = 0
+    while True:
+        m = FENCE_OPEN.search(t, pos)
+        if not m:
+            break
+        c = FENCE_CLOSE.search(t, m.end())
+        if not c:
+            break
+        block = t[m.end():c.start()]
+        pos = c.end()
         b = re.sub(r"//[^\n]*", "", block)
         b = re.sub(r"/\*.*?\*/", "", b, flags=re.S)
         for m in re.finditer(r"(?m)^\s*([A-Z][A-Za-z0-9_]*)\s*((?:\[[^\]=]*\]\s*)+)=\s*", b):
diff --git a/crates/avi/src/lib.rs b/crates/avi/src/lib.rs
index 0294fdfea..e11bc7b5f 100644
--- a/crates/avi/src/lib.rs
+++ b/crates/avi/src/lib.rs
@@ -21,6 +21,8 @@ mod tests;
 
 pub use source::ByteSource;
 
+use std::collections::HashSet;
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum Error {
     /// Not an AVI file (no `RIFF` … `AVI ` header).
@@ -175,6 +177,9 @@ pub struct OpenOptions {
 
 /// Headers larger than this are refused (a real `hdrl` is a few kilobytes).
 const MAX_HEADER: u64 = 16 << 20;
+/// Total OpenDML standard-index bytes accepted while opening one file. This bounds hostile
+/// repeated index references without constraining practical large-file indexes.
+const MAX_ODML_INDEX_BYTES: u64 = 64 << 20;
 /// Streams beyond this are ignored.
 const MAX_STREAMS: usize = 64;
 /// `LIST rec ` inside `movi` nests once; deeper is refused.
@@ -443,34 +448,52 @@ fn super_index(b: &[u8]) -> Vec<u64> {
 /// Fill the chunk tables from the OpenDML standard indexes; false (tables cleared) when a stream
 /// that has data lacks one or none could be read.
 fn read_odml<S: ByteSource + ?Sized>(src: &S, streams: &mut [Stream]) -> bool {
-    let limit = src.len() / 8;
-    let mut total = 0u64;
+    let entry_limit = src.len() / 8;
+    let mut entries = 0u64;
+    let mut index_bytes = 0u64;
+    let mut seen = HashSet::new();
     for s in streams.iter_mut() {
         s.chunks.clear();
         s.keyframes_known = true;
         for &at in &s.super_index {
+            // A super index can repeat an offset (even across streams). Read and process a
+            // standard index once, rather than multiplying its work and allocations.
+            if !seen.insert(at) {
+                continue;
+            }
             let Ok((id, size, data)) = header_at(src, at) else { continue };
             if &id[..2] != b"ix" {
                 continue;
             }
-            let Ok(b) = read(src, data, size.min(MAX_HEADER * 8)) else { continue };
-            let (longs, subtype, itype) = (usize::from(le16(&b, 0)), b.get(2).copied().unwrap_or(0), b.get(3).copied().unwrap_or(0));
+            // Validate the fixed header before allocating the variable entry body.
+            if size < 24 || index_bytes.checked_add(24).is_none_or(|n| n > MAX_ODML_INDEX_BYTES) {
+                return false;
+            }
+            let Ok(header) = read(src, data, 24) else { continue };
+            index_bytes += 24;
+            let (longs, subtype, itype) = (usize::from(le16(&header, 0)), header.get(2).copied().unwrap_or(0), header.get(3).copied().unwrap_or(0));
             // AVI_INDEX_OF_CHUNKS; 2 longs per entry, or 3 for the field index (AVI_INDEX_2FIELD)
             if itype != 1 || !(longs == 2 && subtype == 0 || longs == 3 && subtype == 1) {
                 continue;
             }
-            let base = le64(&b, 12);
             let step = longs * 4;
-            let n = (le32(&b, 4) as usize).min(b.len().saturating_sub(24) / step);
+            let n = u64::from(le32(&header, 4)).min(size.saturating_sub(24) / step as u64);
+            let body = n.saturating_mul(step as u64);
+            let Some(next_bytes) = index_bytes.checked_add(body) else { return false };
+            let Some(next_entries) = entries.checked_add(n) else { return false };
+            if next_bytes > MAX_ODML_INDEX_BYTES || next_entries > entry_limit {
+                return false;
+            }
+            let Ok(b) = read(src, data, 24 + body) else { continue };
+            index_bytes = next_bytes;
+            entries = next_entries;
+            let base = le64(&b, 12);
+            let n = usize::try_from(n).unwrap_or(0);
             for k in 0..n {
                 let e = 24 + k * step;
                 let (off, raw) = (u64::from(le32(&b, e)), le32(&b, e + 4));
                 let size = raw & 0x7FFF_FFFF;
                 let Some(offset) = base.checked_add(off).filter(|o| o.checked_add(u64::from(size)).is_some_and(|end| end <= src.len())) else { continue };
-                total += 1;
-                if total > limit {
-                    return false;
-                }
                 s.chunks.push(Chunk { offset, size, key: raw & 0x8000_0000 == 0 });
             }
         }
diff --git a/crates/avi/src/tests.rs b/crates/avi/src/tests.rs
index 248364d6f..42e3dce9f 100644
--- a/crates/avi/src/tests.rs
+++ b/crates/avi/src/tests.rs
@@ -267,3 +267,18 @@ fn opendml_standard_indexes() {
         }
     }
 }
+
+#[test]
+fn opendml_repeated_index_offsets_are_read_once() {
+    let (_, at) = avi_odml([0, 0]);
+    let (file, _) = avi_odml(at);
+    let mut streams = open(&file).unwrap().streams;
+    // A malicious super index repeats each valid standard-index address. It must not multiply
+    // its chunks, allocations, or traversal work.
+    for (stream, &index) in streams.iter_mut().zip(&at) {
+        stream.super_index = vec![index; 100];
+    }
+    assert!(read_odml(&file, &mut streams));
+    assert_eq!(streams[0].chunks.len(), 3);
+    assert_eq!(streams[1].chunks.len(), 2);
+}
diff --git a/crates/bitstream/Cargo.toml b/crates/bitstream/Cargo.toml
index 8510e348e..07e798ae4 100644
--- a/crates/bitstream/Cargo.toml
+++ b/crates/bitstream/Cargo.toml
@@ -9,6 +9,4 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-
-[dev-dependencies]
-proptest = { workspace = true }
+craft-media = { workspace = true, features = ["bitstream"] }
diff --git a/crates/bitstream/src/lib.rs b/crates/bitstream/src/lib.rs
index 1bdb51265..812b0d68c 100644
--- a/crates/bitstream/src/lib.rs
+++ b/crates/bitstream/src/lib.rs
@@ -1,478 +1,5 @@
-//! Bit-level reading and writing shared by FilmCraft's codec crates.
-//!
-//! - [`BitReader`]: MSB-first reader with Exp-Golomb (`ue(v)`, `se(v)`), as used by H.264/HEVC/AV1 headers.
-//! - [`BitWriter`]: the matching writer (for encoders and header rewriting).
-//! - [`unescape_rbsp`] / [`escape_rbsp`]: remove/insert H.264/HEVC emulation-prevention bytes.
-//! - [`annexb_nals`] / [`length_prefixed_nals`]: split Annex-B byte streams and AVCC/HVCC samples into NAL units.
+//! Bit-level reading and writing: a re-export of [`craft_media::bitstream`] from craft-libs.
 
 #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
 
-use std::fmt;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum BitError {
-    /// Tried to read past the end of the buffer.
-    Eof,
-    /// An Exp-Golomb code longer than 32 leading zeros.
-    InvalidExpGolomb,
-}
-
-impl fmt::Display for BitError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            BitError::Eof => f.write_str("unexpected end of bitstream"),
-            BitError::InvalidExpGolomb => f.write_str("invalid Exp-Golomb code"),
-        }
-    }
-}
-impl std::error::Error for BitError {}
-
-pub type Result<T> = std::result::Result<T, BitError>;
-
-/// MSB-first bit reader over a byte slice.
-#[derive(Clone)]
-pub struct BitReader<'a> {
-    data: &'a [u8],
-    /// Position in bits.
-    pos: usize,
-}
-
-impl<'a> BitReader<'a> {
-    pub fn new(data: &'a [u8]) -> Self {
-        Self { data, pos: 0 }
-    }
-    pub fn data(&self) -> &'a [u8] {
-        self.data
-    }
-    /// Bit position from the start.
-    pub fn position(&self) -> usize {
-        self.pos
-    }
-    pub fn bits_left(&self) -> usize {
-        (self.data.len() * 8).saturating_sub(self.pos)
-    }
-    pub fn is_byte_aligned(&self) -> bool {
-        self.pos.is_multiple_of(8)
-    }
-    pub fn byte_align(&mut self) {
-        self.pos = self.pos.div_ceil(8) * 8;
-    }
-    /// Byte offset of the current position (rounded down).
-    pub fn byte_pos(&self) -> usize {
-        self.pos / 8
-    }
-    pub fn seek_bits(&mut self, pos: usize) {
-        self.pos = pos;
-    }
-
-    /// Peek up to 32 bits without consuming (zero-padded past the end).
-    #[inline]
-    pub fn peek(&self, n: u32) -> u32 {
-        debug_assert!(n <= 32);
-        if n == 0 {
-            return 0;
-        }
-        let byte = self.pos / 8;
-        let shift = self.pos % 8;
-        let mut v: u64 = 0;
-        for i in 0..5 {
-            v = (v << 8) | *self.data.get(byte + i).unwrap_or(&0) as u64;
-        }
-        // v holds 40 bits starting at `byte`
-        ((v << (24 + shift)) >> (64 - n)) as u32
-    }
-
-    #[inline]
-    pub fn read_bits(&mut self, n: u32) -> Result<u32> {
-        if n as usize > self.bits_left() {
-            return Err(BitError::Eof);
-        }
-        let v = self.peek(n);
-        self.pos += n as usize;
-        Ok(v)
-    }
-
-    pub fn read_bits_u64(&mut self, n: u32) -> Result<u64> {
-        if n <= 32 {
-            return self.read_bits(n).map(u64::from);
-        }
-        let hi = self.read_bits(n - 32)? as u64;
-        let lo = self.read_bits(32)? as u64;
-        Ok((hi << 32) | lo)
-    }
-
-    #[inline]
-    pub fn read_bit(&mut self) -> Result<bool> {
-        self.read_bits(1).map(|b| b == 1)
-    }
-    pub fn read_flag(&mut self) -> Result<bool> {
-        self.read_bit()
-    }
-
-    pub fn skip(&mut self, n: usize) -> Result<()> {
-        if n > self.bits_left() {
-            return Err(BitError::Eof);
-        }
-        self.pos += n;
-        Ok(())
-    }
-
-    /// Raw Exp-Golomb codeNum, up to 32 leading zeros (so below 2^33).
-    fn read_code_num(&mut self) -> Result<u64> {
-        let mut zeros = 0u32;
-        while !self.read_bit()? {
-            zeros += 1;
-            if zeros > 32 {
-                return Err(BitError::InvalidExpGolomb);
-            }
-        }
-        if zeros == 0 {
-            return Ok(0);
-        }
-        let v = self.read_bits_u64(zeros)?;
-        Ok((1u64 << zeros) - 1 + v)
-    }
-
-    /// Unsigned Exp-Golomb `ue(v)`.
-    pub fn read_ue(&mut self) -> Result<u32> {
-        u32::try_from(self.read_code_num()?).map_err(|_| BitError::InvalidExpGolomb)
-    }
-
-    /// Signed Exp-Golomb `se(v)`.
-    pub fn read_se(&mut self) -> Result<i32> {
-        // codeNum 2^32 is -2^31, so the mapping is done before narrowing to 32 bits.
-        let k = self.read_code_num()? as i64;
-        let v = if k & 1 == 1 { (k + 1) / 2 } else { -(k / 2) };
-        i32::try_from(v).map_err(|_| BitError::InvalidExpGolomb)
-    }
-
-    /// Truncated Exp-Golomb `te(v)` with range `max`.
-    pub fn read_te(&mut self, max: u32) -> Result<u32> {
-        if max > 1 { self.read_ue() } else { Ok(!self.read_bit()? as u32) }
-    }
-
-    /// H.264/HEVC `more_rbsp_data()`: true if there is data before the rbsp trailing bits.
-    pub fn more_rbsp_data(&self) -> bool {
-        let total = self.data.len() * 8;
-        if self.pos >= total {
-            return false;
-        }
-        // find last set bit (the rbsp_stop_one_bit)
-        let mut last = None;
-        for (i, &b) in self.data.iter().enumerate().rev() {
-            if b != 0 {
-                last = Some(i * 8 + 7 - b.trailing_zeros() as usize);
-                break;
-            }
-        }
-        match last {
-            Some(stop) => self.pos < stop,
-            None => false,
-        }
-    }
-}
-
-/// MSB-first bit writer.
-#[derive(Default, Clone)]
-pub struct BitWriter {
-    buf: Vec<u8>,
-    acc: u64,
-    nbits: u32,
-}
-
-impl BitWriter {
-    pub fn new() -> Self {
-        Self::default()
-    }
-    pub fn write_bits(&mut self, value: u32, n: u32) {
-        debug_assert!(n <= 32);
-        if n == 0 {
-            return;
-        }
-        let v = (value as u64) & ((1u64 << n) - 1);
-        self.acc = (self.acc << n) | v;
-        self.nbits += n;
-        while self.nbits >= 8 {
-            self.nbits -= 8;
-            self.buf.push((self.acc >> self.nbits) as u8);
-        }
-        self.acc &= (1u64 << self.nbits) - 1;
-    }
-    pub fn write_bit(&mut self, b: bool) {
-        self.write_bits(b as u32, 1);
-    }
-    pub fn write_ue(&mut self, v: u32) {
-        self.write_code_num(u64::from(v));
-    }
-    /// Exp-Golomb codeNum up to 2^32 (the code of `se(v)` -2^31).
-    fn write_code_num(&mut self, v: u64) {
-        let x = v + 1;
-        let len = 64 - x.leading_zeros();
-        let zeros = len - 1;
-        for _ in 0..zeros {
-            self.write_bit(false);
-        }
-        if len > 32 {
-            self.write_bits((x >> 32) as u32, len - 32);
-            self.write_bits(x as u32, 32);
-        } else {
-            self.write_bits(x as u32, len);
-        }
-    }
-    pub fn write_se(&mut self, v: i32) {
-        let m = u64::from(v.unsigned_abs()) * 2;
-        self.write_code_num(if v > 0 { m - 1 } else { m });
-    }
-    pub fn bit_len(&self) -> usize {
-        self.buf.len() * 8 + self.nbits as usize
-    }
-    pub fn is_byte_aligned(&self) -> bool {
-        self.nbits == 0
-    }
-    /// Pad with zero bits to a byte boundary.
-    pub fn align_zero(&mut self) {
-        if self.nbits > 0 {
-            self.write_bits(0, 8 - self.nbits);
-        }
-    }
-    /// `rbsp_trailing_bits()`: a one bit then zeros to alignment.
-    pub fn rbsp_trailing(&mut self) {
-        self.write_bit(true);
-        self.align_zero();
-    }
-    pub fn write_bytes(&mut self, bytes: &[u8]) {
-        if self.nbits == 0 {
-            self.buf.extend_from_slice(bytes);
-        } else {
-            for &b in bytes {
-                self.write_bits(b as u32, 8);
-            }
-        }
-    }
-    pub fn finish(mut self) -> Vec<u8> {
-        self.align_zero();
-        self.buf
-    }
-    pub fn bytes(&self) -> &[u8] {
-        &self.buf
-    }
-}
-
-/// Remove emulation-prevention bytes (`00 00 03` → `00 00`) from a NAL payload.
-pub fn unescape_rbsp(data: &[u8]) -> Vec<u8> {
-    let mut out = Vec::with_capacity(data.len());
-    let mut zeros = 0;
-    for &b in data {
-        if zeros >= 2 && b == 3 {
-            zeros = 0;
-            continue;
-        }
-        out.push(b);
-        zeros = if b == 0 { zeros + 1 } else { 0 };
-    }
-    out
-}
-
-/// Insert emulation-prevention bytes so no `00 00 0x` (x ≤ 3) sequence appears.
-pub fn escape_rbsp(data: &[u8]) -> Vec<u8> {
-    let mut out = Vec::with_capacity(data.len() + data.len() / 64);
-    let mut zeros = 0;
-    for &b in data {
-        if zeros >= 2 && b <= 3 {
-            out.push(3);
-            zeros = 0;
-        }
-        out.push(b);
-        zeros = if b == 0 { zeros + 1 } else { 0 };
-    }
-    out
-}
-
-/// Split an Annex-B byte stream (start codes `00 00 01` / `00 00 00 01`) into NAL units (escaped payloads).
-pub fn annexb_nals(data: &[u8]) -> Vec<&[u8]> {
-    let mut starts = Vec::new();
-    let mut i = 0;
-    while i + 3 <= data.len() {
-        if data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1 {
-            starts.push(i + 3);
-            i += 3;
-        } else {
-            i += 1;
-        }
-    }
-    let mut out = Vec::with_capacity(starts.len());
-    for (k, &s) in starts.iter().enumerate() {
-        let mut e = if k + 1 < starts.len() { starts[k + 1] - 3 } else { data.len() };
-        // trim trailing zero bytes (part of a 4-byte start code or trailing_zero_8bits)
-        while e > s && data[e - 1] == 0 {
-            e -= 1;
-        }
-        if e > s {
-            out.push(&data[s..e]);
-        }
-    }
-    out
-}
-
-/// Split a length-prefixed sample (AVCC/HVCC, `length_size` 1/2/4 bytes) into NAL units.
-pub fn length_prefixed_nals(data: &[u8], length_size: usize) -> Result<Vec<&[u8]>> {
-    let mut out = Vec::new();
-    let mut i = 0;
-    while i < data.len() {
-        if i + length_size > data.len() {
-            return Err(BitError::Eof);
-        }
-        let mut len = 0usize;
-        for k in 0..length_size {
-            len = (len << 8) | data[i + k] as usize;
-        }
-        i += length_size;
-        if i + len > data.len() {
-            return Err(BitError::Eof);
-        }
-        out.push(&data[i..i + len]);
-        i += len;
-    }
-    Ok(out)
-}
-
-/// CRC-32 (IEEE, reflected) — used by containers (e.g. Matroska CRC-32 elements, PNG).
-pub fn crc32(data: &[u8]) -> u32 {
-    let mut crc = 0xFFFF_FFFFu32;
-    for &b in data {
-        crc ^= b as u32;
-        for _ in 0..8 {
-            crc = if crc & 1 != 0 { (crc >> 1) ^ 0xEDB8_8320 } else { crc >> 1 };
-        }
-    }
-    !crc
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use proptest::prelude::*;
-
-    #[test]
-    fn reads_bits() {
-        let d = [0b1010_1100, 0b0101_0011];
-        let mut r = BitReader::new(&d);
-        assert_eq!(r.read_bits(1).unwrap(), 1);
-        assert_eq!(r.read_bits(3).unwrap(), 0b010);
-        assert_eq!(r.read_bits(8).unwrap(), 0b1100_0101);
-        assert_eq!(r.bits_left(), 4);
-        assert_eq!(r.read_bits(5), Err(BitError::Eof));
-    }
-
-    #[test]
-    fn exp_golomb_known() {
-        // 1 | 010 | 011 | 00100 | 00101 -> 0,1,2,3,4
-        let mut w = BitWriter::new();
-        for v in 0..5 {
-            w.write_ue(v);
-        }
-        let b = w.finish();
-        let mut r = BitReader::new(&b);
-        for v in 0..5 {
-            assert_eq!(r.read_ue().unwrap(), v);
-        }
-        let mut w = BitWriter::new();
-        for v in [0, 1, -1, 2, -2, 1000, -1000] {
-            w.write_se(v);
-        }
-        let b = w.finish();
-        let mut r = BitReader::new(&b);
-        for v in [0, 1, -1, 2, -2, 1000, -1000] {
-            assert_eq!(r.read_se().unwrap(), v);
-        }
-    }
-
-    #[test]
-    fn signed_exp_golomb_extremes_roundtrip() {
-        let vals = [0, 1, -1, i32::MAX, i32::MIN];
-        let mut w = BitWriter::new();
-        for v in vals {
-            w.write_se(v);
-        }
-        let b = w.finish();
-        let mut r = BitReader::new(&b);
-        for v in vals {
-            assert_eq!(r.read_se(), Ok(v));
-        }
-    }
-
-    #[test]
-    fn signed_exp_golomb_reads_minimum_from_spec_bits() {
-        // 32 zero bits, 1, then the 32-bit suffix 1: codeNum = 2^32 -> -2^31.
-        let bytes = [0, 0, 0, 0, 0x80, 0, 0, 0, 0x80];
-        assert_eq!(BitReader::new(&bytes).read_se(), Ok(i32::MIN));
-    }
-
-    #[test]
-    fn signed_exp_golomb_rejects_positive_overflow() {
-        // 32 zero bits, 1, then 32 zero bits: codeNum = 2^32 - 1 -> +2^31, not an i32.
-        let bytes = [0, 0, 0, 0, 0x80, 0, 0, 0, 0];
-        assert_eq!(BitReader::new(&bytes).read_se(), Err(BitError::InvalidExpGolomb));
-    }
-
-    #[test]
-    fn unsigned_exp_golomb_keeps_u32_range() {
-        // codeNum = 2^32 is a valid se(v) code but does not fit ue(v)'s u32.
-        let bytes = [0, 0, 0, 0, 0x80, 0, 0, 0, 0x80];
-        assert_eq!(BitReader::new(&bytes).read_ue(), Err(BitError::InvalidExpGolomb));
-    }
-
-    #[test]
-    fn emulation_prevention() {
-        let raw = [0, 0, 1, 0, 0, 0, 5, 0, 0, 3];
-        let esc = escape_rbsp(&raw);
-        assert_eq!(esc, vec![0, 0, 3, 1, 0, 0, 3, 0, 5, 0, 0, 3, 3]);
-        assert_eq!(unescape_rbsp(&esc), raw);
-    }
-
-    #[test]
-    fn annexb_split() {
-        let s = [0, 0, 0, 1, 0x67, 1, 2, 0, 0, 1, 0x68, 3, 0, 0, 0, 1, 0x65, 9, 9];
-        let n = annexb_nals(&s);
-        assert_eq!(n, vec![&[0x67, 1, 2][..], &[0x68, 3][..], &[0x65, 9, 9][..]]);
-        let l = [0, 0, 0, 2, 0x67, 1, 0, 0, 0, 1, 0x68];
-        assert_eq!(length_prefixed_nals(&l, 4).unwrap(), vec![&[0x67, 1][..], &[0x68][..]]);
-    }
-
-    #[test]
-    fn more_rbsp() {
-        let d = [0b1100_0000];
-        let mut r = BitReader::new(&d);
-        assert!(r.more_rbsp_data());
-        r.read_bit().unwrap();
-        assert!(!r.more_rbsp_data());
-    }
-
-    #[test]
-    fn crc() {
-        assert_eq!(crc32(b"123456789"), 0xCBF4_3926);
-    }
-
-    proptest! {
-        #[test]
-        fn roundtrip(vals in proptest::collection::vec((0u32..u32::MAX, 1u32..=32), 0..200), ues in proptest::collection::vec(0u32..u32::MAX - 1, 0..50)) {
-            let mut w = BitWriter::new();
-            for &(v, n) in &vals { w.write_bits(v, n); }
-            for &u in &ues { w.write_ue(u); }
-            let b = w.finish();
-            let mut r = BitReader::new(&b);
-            for &(v, n) in &vals {
-                let mask = if n == 32 { u32::MAX } else { (1 << n) - 1 };
-                prop_assert_eq!(r.read_bits(n).unwrap(), v & mask);
-            }
-            for &u in &ues { prop_assert_eq!(r.read_ue().unwrap(), u); }
-        }
-
-        #[test]
-        fn escape_roundtrip(data in proptest::collection::vec(0u8..4, 0..300)) {
-            let e = escape_rbsp(&data);
-            prop_assert_eq!(unescape_rbsp(&e), data);
-            for w in e.windows(3) { prop_assert!(!(w[0] == 0 && w[1] == 0 && w[2] < 3)); }
-        }
-    }
-}
+pub use craft_media::bitstream::*;
diff --git a/crates/captions/README.md b/crates/captions/README.md
index 04183352c..661d8fb82 100644
--- a/crates/captions/README.md
+++ b/crates/captions/README.md
@@ -14,7 +14,7 @@ and writes caption files, converts them to and from caption tracks, and draws ca
 | SubRip `.srt` | yes | yes | BOM, UTF-16, Windows-1252 fallback, CRLF/CR, missing or wrong indexes, `,` or `.` milliseconds, 1–9 fraction digits, missing hours, SSA coordinates, cues not separated by blank lines. Inline tags are kept as text. |
 | WebVTT `.vtt` | yes | yes | Cue identifiers, cue settings (verbatim), a leading `<v Speaker>` voice span (as the caption's speaker) and STYLE / REGION / NOTE blocks are kept. A missing `WEBVTT` signature is tolerated. |
 | Scenarist SCC `.scc` | yes | yes | CEA-608 at 29.97 fps, drop-frame or not. Reads pop-on, roll-up and paint-on (channel 1); writes pop-on. |
-| MacCaption MCC `.mcc` | yes | yes | One SMPTE ST 334-2 caption distribution packet (CDP) per frame in MacCaption's hex text with letter abbreviations. Writes 29.97 fps (`30DF` / `30`) with CEA-608 field 1 (the SCC schedule) **and** CEA-708 service 1 (two-window pop-on emulation). Reads CEA-608 field 1 when present, else CEA-708 service 1; time code rates 30DF, 30, 60DF, 60, 25, 24, 50. |
+| MacCaption MCC `.mcc` | yes | yes | One SMPTE ST 334-2 caption distribution packet (CDP) per frame carrying caption data, omitting empty frames, in MacCaption's hex text with letter abbreviations. Writes 29.97 fps (`30DF` / `30`) with CEA-608 field 1 (the SCC schedule) **and** CEA-708 service 1 (two-window pop-on emulation). Reads CEA-608 field 1 when present, else CEA-708 service 1; time code rates 30DF, 30, 60DF, 60, 25, 24, 50. |
 | EBU STL `.stl` | yes | yes | EBU Tech 3264-E: GSI block + 128-byte TTI blocks, `STL25.01` (25 fps) or `STL30.01` (read/written as 29.97 fps, non-drop labels), ISO/IEC 6937 Latin text (accents as diacritic + letter), italics / underline codes as `<i>` / `<u>`, extension blocks for long subtitles, start-of-programme (TCP) subtracted. |
 | TTML `.ttml` (IMSC1) | yes | yes | Writes the IMSC1 Text profile (TTML2 namespaces): `<p>` per cue, `<br/>`, styled `<span>`s for `<i>` / `<b>` / `<u>`, `ttm:agent` speakers, exact frame times (`123f`) at the sequence rate. Reads any TTML (TTML1, TTML2, the 2006 `ttaf1` drafts): clock / frame / offset / tick times, `dur`, nested time containers (`body` / `div` begins offset and ends clip their contents; `seq` containers are read as `par` with a warning), timed spans, referenced styles. |
 | DFXP `.dfxp` | yes | yes | TTML1 with the DFXP presentation profile; clock times in milliseconds (frame-exact after `snap_to_frames`). |
@@ -64,6 +64,22 @@ Text is wrapped at 32 columns, bottom-aligned (last row 15) and centred. Charact
 character, as the standard requires); others are dropped. If there is no room to load a caption
 before its in point (for example a caption at 00:00:00:00), it appears as soon as it is loaded.
 
+### MCC writer
+
+The writer merges the scheduled CEA-608 and CEA-708 frames in timestamp order. Frames without
+caption data are omitted, including during a displayed caption; its explicit erase/hide command
+still lands at its out point. CDP sequence counters advance per emitted packet, wrapping at 16 bits.
+Export work and output size therefore follow the scheduled caption data, not the time between
+cues or their duration (#2811). Empty-frame insertion is an optional MCC export behavior; see
+[EZTitles' MCC export documentation, "Write empty frames"](https://eztitles.com/Webhelp/EZTitles/export_subtitles_cc_mcc.htm).
+FilmCraft does not offer continuous padding for consumers that require a packet on every video frame.
+
+Regression tests cover sparse output, both caption streams individually and together, drop-frame
+and non-drop timecodes, exact cue round trips, and timestamps near the tick storage limit.
+An external FFmpeg 9.0.2 decode of the two-cue regression fixture preserved text and all four
+timestamps (2.002–4.004 s and 120.120–122.122 s); the combined-stream export has 29 data lines,
+down from 3,614. No media fixtures are committed.
+
 ## Burn-in
 
 `burn::render_caption` lays out a caption with the track style (font size relative to a 1080-line
@@ -85,7 +101,7 @@ implementation's code was consulted.
 
 - Unit tests per module (timestamps, decoding, sloppy SRT, WebVTT blocks and voices, CEA-608
   tables, PAC round trips, known SCC pop-on and roll-up streams, layout).
-- `tests/roundtrip.rs`: property tests — SRT (also with BOM + CRLF), WebVTT (ids, speakers,
+- `tests/it/roundtrip.rs`: property tests — SRT (also with BOM + CRLF), WebVTT (ids, speakers,
   settings, STYLE blocks), SCC and MCC (drop-frame and non-drop, gaps and back-to-back captions;
   MCC also through CEA-708 alone), EBU STL (25 and 29.97 fps, accents, extension blocks), TTML
   (23.976 / 25 / 29.97 / 59.94, ids, speakers) round-trip frame-exactly; DFXP round-trips after
diff --git a/crates/captions/src/burn.rs b/crates/captions/src/burn.rs
index 463e9737b..e29c3a5c3 100644
--- a/crates/captions/src/burn.rs
+++ b/crates/captions/src/burn.rs
@@ -12,6 +12,12 @@ use filmcraft_time::Tick;
 
 use filmcraft_text::{ParagraphStyle, TextStyle, layout, render};
 
+/// Caption overlays are transient render resources, not source images. Keep one cue from
+/// materialising an unbounded mask or RGBA buffer.
+const MAX_OVERLAY_PIXELS: usize = 16 << 20;
+const MAX_CAPTION_SIZE_1080: f32 = 256.0;
+const MAX_OUTLINE_RADIUS: f32 = 64.0;
+
 /// A rendered caption: premultiplied linear-light RGBA f32 pixels at `(x, y)` in the frame.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Overlay {
@@ -110,7 +116,7 @@ pub fn render_caption(c: &Caption, style: &CaptionStyle, w: usize, h: usize) ->
         return None;
     }
     let scale = h as f32 / 1080.0;
-    let px = (style.size * scale).max(4.0);
+    let px = (style.size.clamp(4.0, MAX_CAPTION_SIZE_1080) * scale).clamp(4.0, h as f32);
     let max_w = w as f32 * 0.9;
     let ts = caption_style(&style.font, px);
     let mut lines: Vec<String> = Vec::new();
@@ -124,7 +130,7 @@ pub fn render_caption(c: &Caption, style: &CaptionStyle, w: usize, h: usize) ->
     }
     let vm = filmcraft_text::fonts::face(filmcraft_text::resolve(&ts.family, &ts.style).face).metrics(px);
     let (asc, desc) = (vm.ascent, vm.descent);
-    let lh = px * style.line_spacing.max(0.8);
+    let lh = px * style.line_spacing.clamp(0.8, 4.0);
     let pad_x = (px * 0.3).round();
     let block_h = lh * lines.len() as f32;
     let (line_override, align_override) = vtt_overrides(&c.settings);
@@ -148,15 +154,24 @@ pub fn render_caption(c: &Caption, style: &CaptionStyle, w: usize, h: usize) ->
             CaptionAlign::Center => (w as f32 - lw) / 2.0,
         })
         .collect();
-    let outline = (style.outline * scale).max(0.0);
+    let outline = (style.outline * scale).clamp(0.0, MAX_OUTLINE_RADIUS);
     let grow = outline.ceil() + 1.0;
     let bx0 = xs.iter().zip(&widths).map(|(x, _)| x - pad_x - grow).fold(f32::MAX, f32::min).floor();
     let bx1 = xs.iter().zip(&widths).map(|(x, lw)| x + lw + pad_x + grow).fold(f32::MIN, f32::max).ceil();
     let by0 = (top - grow).floor();
     let by1 = (top + block_h + grow).ceil();
-    let (ox, oy) = (bx0 as i32, by0 as i32);
-    let ow = (bx1 - bx0).max(1.0) as usize;
-    let oh = (by1 - by0).max(1.0) as usize;
+    // Text can be wider than the frame (an unbroken imported WebVTT word, for example). Raster
+    // only the visible intersection; `draw` receives the original coordinates and clips into it.
+    let (left, top) = (bx0.clamp(0.0, w as f32), by0.clamp(0.0, h as f32));
+    let (right, bottom) = (bx1.clamp(0.0, w as f32), by1.clamp(0.0, h as f32));
+    if right <= left || bottom <= top {
+        return None;
+    }
+    let (ox, oy) = (left as i32, top as i32);
+    let (ow, oh) = ((right - left) as usize, (bottom - top) as usize);
+    if ow.checked_mul(oh).is_none_or(|pixels| pixels > MAX_OVERLAY_PIXELS) {
+        return None;
+    }
     let mut cover = vec![0.0f32; ow * oh];
     let mut bg = vec![0.0f32; ow * oh];
     for (i, line) in lines.iter().enumerate() {
@@ -319,6 +334,21 @@ mod tests {
         assert!(canvas.chunks(4).any(|p| p[0] > 0.9));
     }
 
+    #[test]
+    fn overlay_is_clipped_to_the_frame_for_an_unbroken_word() {
+        let o = render_caption(&cap(&"W".repeat(10_000)), &CaptionStyle::default(), 640, 360).unwrap();
+        assert!(o.x >= 0 && o.y >= 0);
+        assert!(o.w <= 640 && o.h <= 360, "{}x{}", o.w, o.h);
+        assert!(o.w.checked_mul(o.h).unwrap() <= MAX_OVERLAY_PIXELS);
+    }
+
+    #[test]
+    fn hostile_outline_is_bounded() {
+        let st = CaptionStyle { outline: 1_000_000.0, ..Default::default() };
+        let o = render_caption(&cap("Safe"), &st, 640, 360).unwrap();
+        assert!(o.w <= 640 && o.h <= 360, "{}x{}", o.w, o.h);
+    }
+
     #[test]
     fn outline_draws_around_text() {
         let st = CaptionStyle { background: false, outline: 4.0, outline_color: [255, 0, 0, 255], ..Default::default() };
diff --git a/crates/captions/src/mcc.rs b/crates/captions/src/mcc.rs
index 3004872bb..b5ecb243c 100644
--- a/crates/captions/src/mcc.rs
+++ b/crates/captions/src/mcc.rs
@@ -1,4 +1,4 @@
-//! MacCaption MCC (`.mcc`): closed-caption data as text, one line per video frame, each line a
+//! MacCaption MCC (`.mcc`): closed-caption data as text, one line per frame carrying data, each line a
 //! SMPTE ST 334-2 caption distribution packet (CDP) carrying CEA-608 byte pairs and CEA-708
 //! (DTVCC) packets, written in hexadecimal with MacCaption's letter abbreviations.
 //!
@@ -19,8 +19,8 @@
 //!   bytes)), optional time code / service info sections, footer `74`, the counter again and a
 //!   checksum that makes the packet's byte sum 0 mod 256. The ancillary packet then ends with one ST 291 checksum byte
 //!   (low 8 bits of DID + SDID + data count + CDP bytes).
-//! - **Writing** (29.97 fps, `30DF` or `30` timecode labels): every frame from the first caption
-//!   data to one frame after the last carries a CDP with 20 cc_data triplets: field 1 CEA-608
+//! - **Writing** (29.97 fps, `30DF` or `30` timecode labels): each scheduled caption-data frame
+//!   carries a CDP with 20 cc_data triplets; empty frames are omitted. Each CDP contains field 1 CEA-608
 //!   pop-on data (the same schedule as [SCC](crate::scc)), a null field-2 pair, CEA-708
 //!   service 1 data and padding. The CEA-708 captions emulate pop-on with two windows: each
 //!   caption is defined (hidden) and loaded into one window while the other shows, then a
@@ -344,6 +344,8 @@ struct Win {
     defined: bool,
     visible: bool,
     rows: Vec<String>,
+    max_rows: usize,
+    max_cols: usize,
 }
 
 struct Dec708 {
@@ -416,8 +418,9 @@ impl Dec708 {
     fn put(&mut self, c: char) {
         let w = self.w();
         match w.rows.last_mut() {
-            Some(row) => row.push(c),
-            None => w.rows.push(c.to_string()),
+            Some(row) if row.chars().count() < w.max_cols => row.push(c),
+            None if w.max_rows > 0 && w.max_cols > 0 => w.rows.push(c.to_string()),
+            _ => {}
         }
     }
     fn bitmap(&mut self, m: u8, f: impl Fn(&mut Win)) {
@@ -441,7 +444,8 @@ impl Dec708 {
                     }
                 }
                 0x0c => self.w().rows = vec![String::new()],
-                0x0d => self.w().rows.push(String::new()),
+                0x0d if self.w().rows.len() < self.w().max_rows => self.w().rows.push(String::new()),
+                0x0d => {}
                 0x0e => {
                     if let Some(r) = self.w().rows.last_mut() {
                         r.clear();
@@ -500,11 +504,24 @@ impl Dec708 {
                 0x98..=0x9f => {
                     let n = (c - 0x98) as usize;
                     let vis = arg(i) & 0x20 != 0;
+                    let max_rows = (arg(i + 3) & 0x0f) as usize + 1;
+                    let max_cols = (arg(i + 4) & 0x3f) as usize + 1;
                     let w = &mut self.win[n];
                     if !w.defined {
-                        *w = Win { defined: true, visible: vis, rows: vec![String::new()] };
+                        *w = Win { defined: true, visible: vis, rows: vec![String::new()], max_rows, max_cols };
                     } else {
                         w.visible = vis;
+                        w.max_rows = max_rows;
+                        w.max_cols = max_cols;
+                        w.rows.truncate(max_rows);
+                        for row in &mut w.rows {
+                            if let Some((at, _)) = row.char_indices().nth(max_cols) {
+                                row.truncate(at);
+                            }
+                        }
+                        if w.rows.is_empty() {
+                            w.rows.push(String::new());
+                        }
                     }
                     self.cur = n;
                     i += 6;
@@ -525,14 +542,19 @@ pub fn write(doc: &Document, drop_frame: bool) -> String {
     write_with(doc, drop_frame, true, true)
 }
 
-/// [`write`] choosing which caption streams to include.
+/// Write MCC with independently selected CEA-608 field 1 and CEA-708 service 1 streams.
+///
+/// Emit only scheduled data frames, preserving their timestamps and explicit erase/hide
+/// commands. Empty time spans add no packets; CDP counters advance per emitted packet and
+/// wrap at 16 bits. `drop_frame` selects 30DF rather than 30 timecode labels at 29.97 fps.
+/// An empty document or two disabled streams produces a header with no data lines.
 pub fn write_with(doc: &Document, drop_frame: bool, cea608: bool, cea708: bool) -> String {
     let f1 = if cea608 { scc::schedule(doc) } else { BTreeMap::new() };
     let dtv = if cea708 { schedule_708(doc) } else { BTreeMap::new() };
     let mut out = String::from("File Format=MacCaption_MCC V1.0\n\n");
     out.push_str("///////////////////////////////////////////////////////////////////////////////////\n");
     out.push_str("// Closed captions written by FilmCraft: SMPTE ST 334-2 caption distribution packets\n");
-    out.push_str("// carrying CEA-608 field 1 and CEA-708 service 1 data, one packet per frame.\n");
+    out.push_str("// carrying CEA-608 field 1 and CEA-708 service 1 data; empty frames omitted.\n");
     out.push_str("///////////////////////////////////////////////////////////////////////////////////\n\n");
     let n = doc.cues.len() as u64;
     let h = doc.cues.iter().fold(0xcbf2_9ce4_8422_2325u64 ^ n, |h, c| (h ^ c.start.0 as u64 ^ (c.end.0 as u64).rotate_left(17)).wrapping_mul(0x100_0000_01b3));
@@ -546,15 +568,20 @@ pub fn write_with(doc: &Document, drop_frame: bool, cea608: bool, cea708: bool)
     ));
     out.push_str("Creation Program=FilmCraft\n");
     out.push_str(&format!("Time Code Rate={}\n\n", if drop_frame { "30DF" } else { "30" }));
-    let first = f1.keys().next().copied().into_iter().chain(dtv.keys().next().copied()).min();
-    let last = f1.keys().next_back().copied().into_iter().chain(dtv.keys().next_back().copied()).max();
-    if let (Some(a), Some(b)) = (first, last) {
-        for (seq, f) in (a..=b + 1).enumerate() {
-            let data = FrameData { f1: f1.get(&f).copied(), dtvcc: dtv.get(&f).cloned().unwrap_or_default() };
-            let (_, hh, mm, ss, ff) = frames_to_fields(f, RATE, drop_frame);
-            let sep = if drop_frame { ';' } else { ':' };
-            out.push_str(&format!("{hh:02}:{mm:02}:{ss:02}{sep}{ff:02}\t{}\n", compress(&build_cdp(seq as u16, &data))));
-        }
+    // Merge the sparse schedules without walking (or allocating for) input-derived time gaps.
+    // Erase/hide commands are scheduled data too, so omitting padding preserves cue end times.
+    let mut f1 = f1.into_iter().peekable();
+    let mut dtv = dtv.into_iter().peekable();
+    let mut seq = 0u16;
+    while let Some(f) = f1.peek().map(|(f, _)| *f).into_iter().chain(dtv.peek().map(|(f, _)| *f)).min() {
+        let data = FrameData {
+            f1: f1.next_if(|(frame, _)| *frame == f).map(|(_, pair)| pair),
+            dtvcc: dtv.next_if(|(frame, _)| *frame == f).map(|(_, pairs)| pairs).unwrap_or_default(),
+        };
+        let (_, hh, mm, ss, ff) = frames_to_fields(f, RATE, drop_frame);
+        let sep = if drop_frame { ';' } else { ':' };
+        out.push_str(&format!("{hh:02}:{mm:02}:{ss:02}{sep}{ff:02}\t{}\n", compress(&build_cdp(seq, &data))));
+        seq = seq.wrapping_add(1);
     }
     out
 }
@@ -647,10 +674,12 @@ pub fn parse(text: &str) -> Result<Document> {
 mod tests {
     use super::*;
 
+    /// Build a caption fixture from start/end frame indices on the MCC 29.97 fps grid.
     fn cue(s: i64, e: i64, text: &str) -> Cue {
         Cue { start: RATE.tick_of(s), end: RATE.tick_of(e), text: text.into(), ..Default::default() }
     }
 
+    /// Check that MCC abbreviations round-trip bytes and reject an incomplete hex pair.
     #[test]
     fn abbreviations_round_trip() {
         let b = [0x61, 0x01, 0x49, 0x96, 0x69, 0xfa, 0, 0, 0xfa, 0, 0, 0xfc, 0x80, 0x80, 0x00, 0x12, 0xe1, 0, 0, 0, 0xfb, 0x80, 0x80, 0xfd, 0x80, 0x80];
@@ -660,6 +689,7 @@ mod tests {
         assert_eq!(expand("T52S5"), None);
     }
 
+    /// Verify CDP framing, caption triplets, sequence fields, and both packet checksums.
     #[test]
     fn cdp_structure_and_checksum() {
         let d = FrameData { f1: Some((0x14, 0x20)), dtvcc: vec![(true, 0x02, 0x21), (false, 0x89, 0x01)] };
@@ -680,6 +710,7 @@ mod tests {
         assert_eq!(t[19], [0xfa, 0, 0]);
     }
 
+    /// Preserve caption text and timing through combined-stream and CEA-708-only exports.
     #[test]
     fn writes_and_reads_608_and_708() {
         let doc = Document {
@@ -699,4 +730,61 @@ mod tests {
         assert_eq!(got, vec![(60, 120, "Hello, world!"), (120, 200, "Second caption\nwith two lines"), (260, 300, "Café “q” ♪")]);
         assert!(parse("garbage").is_err());
     }
+
+    /// Keep separated short captions compact while preserving cues and valid CDP packets.
+    /// Exercise each stream combination with both drop-frame and non-drop timecode labels.
+    #[test]
+    fn export_size_depends_on_caption_data_not_empty_frames() {
+        // A small reproducer: the old writer emits thousands of padding-only lines.
+        let doc = Document { cues: vec![cue(60, 120, "First"), cue(3_600, 3_660, "Last")], ..Default::default() };
+        for drop_frame in [false, true] {
+            for (cea608, cea708) in [(true, true), (true, false), (false, true)] {
+                let text = std::panic::catch_unwind(|| write_with(&doc, drop_frame, cea608, cea708)).unwrap();
+                let lines: Vec<_> = text.lines().filter_map(|line| line.split_once('\t')).collect();
+                assert!(lines.len() < 100, "{} lines for two short captions", lines.len());
+                assert!(text.len() < 16_384);
+                assert_eq!(parse(&text).unwrap().cues, doc.cues);
+                for (seq, (_, data)) in lines.iter().enumerate() {
+                    let bytes = expand(data).unwrap();
+                    assert_eq!(u16::from_be_bytes([bytes[8], bytes[9]]), seq as u16);
+                    assert_eq!(bytes[3..76].iter().map(|&b| b as u32).sum::<u32>() % 256, 0);
+                    let trips = cc_triplets(&bytes).unwrap();
+                    assert!(trips.iter().any(|&[m, a, b]| m & 4 != 0 && (m & 3 >= 2 || a & 0x7f != 0 || b & 0x7f != 0)));
+                }
+            }
+        }
+    }
+
+    /// Bound output for distant or long cues near the tick limit without changing their timing.
+    #[test]
+    fn distant_and_long_cues_round_trip_near_tick_limit() {
+        let last = RATE.frame_at(crate::Tick(i64::MAX)) - 10;
+        for cues in [vec![cue(60, 120, "First"), cue(last - 60, last, "Last")], vec![cue(60, last, "Long")]] {
+            let doc = Document { cues, ..Default::default() };
+            for drop_frame in [false, true] {
+                for (cea608, cea708) in [(true, true), (true, false), (false, true)] {
+                    let text = std::panic::catch_unwind(|| write_with(&doc, drop_frame, cea608, cea708)).unwrap();
+                    assert!(text.len() < 16_384);
+                    assert_eq!(parse(&text).unwrap().cues, doc.cues);
+                }
+            }
+        }
+    }
+
+    /// Emit only the MCC header when the document is empty or both streams are disabled.
+    #[test]
+    fn empty_schedules_have_no_data_lines() {
+        let doc = Document { cues: vec![cue(60, 120, "Caption")], ..Default::default() };
+        assert!(!write_with(&doc, true, false, false).contains('\t'));
+        assert!(!write(&Document::default(), true).contains('\t'));
+    }
+
+    /// Prevent CEA-708 text and line breaks from overflowing a window's declared dimensions.
+    #[test]
+    fn decoder_keeps_708_text_within_declared_window_dimensions() {
+        let mut decoder = Dec708::new();
+        // Define window 0 with one row and one column, then try to overflow both.
+        decoder.service_data(&[0x98, 0, 0, 0, 0, 0, 0, b'A', b'B', 0x0d, b'C']);
+        assert_eq!(decoder.win[0].rows, ["A"]);
+    }
 }
diff --git a/crates/captions/src/scc.rs b/crates/captions/src/scc.rs
index 1d2fafbfd..e894e17cf 100644
--- a/crates/captions/src/scc.rs
+++ b/crates/captions/src/scc.rs
@@ -34,7 +34,7 @@ pub fn parse_timecode(s: &str) -> Option<i64> {
     let df = s.contains([';', '.', ',']);
     let parts: Vec<&str> = s.split([':', ';', '.', ',']).collect();
     let [h, m, sec, f] = parts.as_slice() else { return None };
-    let n = |p: &str| if (1..=3).contains(&p.len()) { p.parse::<i64>().ok() } else { None };
+    let n = |p: &str| if (1..=3).contains(&p.len()) && p.bytes().all(|b| b.is_ascii_digit()) { p.parse::<i64>().ok() } else { None };
     Some(fields_to_frames(n(h)?, n(m)?, n(sec)?, n(f)?, RATE, df))
 }
 
@@ -304,7 +304,12 @@ pub fn wrap_rows(text: &str) -> Vec<String> {
     for line in text.lines() {
         let mut cur = String::new();
         for word in line.split_whitespace() {
-            let mut word = word.to_string();
+            if rows.len() == 15 {
+                return rows;
+            }
+            // SCC can emit at most 15 32-column rows.  Do not repeatedly copy an unbounded word
+            // only to discard all but that small prefix below.
+            let mut word: String = word.chars().take(COLS * (15 - rows.len())).collect();
             loop {
                 let need = if cur.is_empty() { word.chars().count() } else { cur.chars().count() + 1 + word.chars().count() };
                 if need <= COLS {
@@ -316,11 +321,17 @@ pub fn wrap_rows(text: &str) -> Vec<String> {
                 }
                 if !cur.is_empty() {
                     rows.push(std::mem::take(&mut cur));
+                    if rows.len() == 15 {
+                        return rows;
+                    }
                     continue;
                 }
                 let head: String = word.chars().take(COLS).collect();
                 word = word.chars().skip(COLS).collect();
                 rows.push(head);
+                if rows.len() == 15 {
+                    return rows;
+                }
                 if word.is_empty() {
                     break;
                 }
@@ -484,6 +495,14 @@ mod tests {
         Cue { start: RATE.tick_of(s), end: RATE.tick_of(e), text: text.into(), ..Default::default() }
     }
 
+    #[test]
+    fn timecode_rejects_signed_fields() {
+        assert_eq!(parse_timecode("00:00:-5:00"), None);
+        assert_eq!(parse_timecode("00:+1:00:00"), None);
+        assert_eq!(parse_timecode("00:00:00:"), None);
+        assert_eq!(parse_timecode("00:00:01:00"), Some(30));
+    }
+
     #[test]
     fn timecodes() {
         assert_eq!(parse_timecode("00:01:00;02"), Some(1800));
@@ -533,6 +552,13 @@ mod tests {
         assert_eq!(rows.join(" "), "the quick brown fox jumps over the lazy dog and keeps running far away");
     }
 
+    #[test]
+    fn wrapping_discards_an_unrepresentable_word_without_quadratic_copying() {
+        let rows = wrap_rows(&"x".repeat(100_000));
+        assert_eq!(rows.len(), 15);
+        assert!(rows.iter().all(|row| row.len() == COLS));
+    }
+
     #[test]
     fn cue_at_zero_is_delayed_not_lost() {
         let doc = Document { cues: vec![cue(0, 60, "Start")], ..Default::default() };
diff --git a/crates/captions/src/stl.rs b/crates/captions/src/stl.rs
index da49f3b10..5b0e9eeff 100644
--- a/crates/captions/src/stl.rs
+++ b/crates/captions/src/stl.rs
@@ -212,9 +212,13 @@ fn encode_text(text: &str) -> Vec<u8> {
     let mut out = Vec::new();
     let mut rest = text;
     while let Some(ch) = rest.chars().next() {
-        if ch == '<'
-            && let Some(end) = rest.find('>')
-        {
+        let is_tag_start = ch == '<'
+            && rest
+                .get(1..)
+                .and_then(|tail| tail.strip_prefix('/').or(Some(tail)))
+                .and_then(|name| name.as_bytes().first())
+                .is_some_and(u8::is_ascii_alphabetic);
+        if is_tag_start && let Some(end) = rest.find('>') {
             let tag = &rest[1..end];
             // Only a syntactically plausible tag is markup. Comparisons such as
             // "2 < 3 > 1" and "x < y > z" must not lose their middle text.
@@ -232,6 +236,18 @@ fn encode_text(text: &str) -> Vec<u8> {
                 continue;
             }
         }
+        if is_tag_start && !rest.contains('>') {
+            // This cannot become markup later.  Encode the remaining literal text in one pass
+            // instead of searching the shrinking suffix after every opening bracket.
+            for ch in rest.chars() {
+                if ch == '\n' {
+                    out.push(0x8a);
+                } else {
+                    out.extend(encode_6937(ch).unwrap_or_else(|| vec![b'?']));
+                }
+            }
+            break;
+        }
         if ch == '\n' {
             out.push(0x8a);
         } else {
@@ -474,6 +490,14 @@ mod tests {
         assert_eq!(encode_text("<i >Hi</i >"), vec![0x80, b'H', b'i', 0x81]);
     }
 
+    #[test]
+    fn unterminated_markup_is_encoded_in_one_pass() {
+        let text = format!("<i{}", "<".repeat(10_000));
+        let encoded = encode_text(&text);
+        assert_eq!(encoded.len(), text.len());
+        assert_eq!(encoded[0], b'<');
+    }
+
     #[test]
     fn programme_start_is_subtracted() {
         let doc = Document {
diff --git a/crates/captions/src/ttml.rs b/crates/captions/src/ttml.rs
index bf6b2f65b..4067a6a8f 100644
--- a/crates/captions/src/ttml.rs
+++ b/crates/captions/src/ttml.rs
@@ -18,7 +18,7 @@ use std::collections::{HashMap, HashSet};
 
 use filmcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
 
-use crate::{Cue, Document, Error, Result, TICKS_PER_MS};
+use crate::{Cue, Document, Error, Result};
 
 /// Which TTML flavour to write.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -39,6 +39,67 @@ const NS_XML: &str = "http://www.w3.org/XML/1998/namespace";
 const IMSC1_TEXT: &str = "http://www.w3.org/ns/ttml/profile/imsc1/text";
 const DFXP_PROFILE: &str = "http://www.w3.org/ns/ttml/profile/dfxp-presentation";
 
+/// TTML is normally only a few containers deep. Keep the XML parser and our recursive content
+/// walkers safely below a native-stack-sized nesting level for untrusted caption files.
+const MAX_XML_DEPTH: usize = 128;
+
+/// Count XML element nesting without constructing an XML tree. This deliberately only decides
+/// where markup ends (respecting quoted attributes, comments, CDATA and processing instructions);
+/// `roxmltree` remains responsible for XML syntax and matching tags.
+fn check_xml_depth(text: &str) -> Result<()> {
+    let bytes = text.as_bytes();
+    let mut i = 0;
+    let mut depth = 0usize;
+    while let Some(relative) = text[i..].find('<') {
+        let start = i + relative;
+        let rest = &text[start..];
+        if rest.starts_with("<!--") {
+            let Some(end) = text[start + 4..].find("-->") else { return Ok(()) };
+            i = start + 4 + end + 3;
+            continue;
+        }
+        if rest.starts_with("<![CDATA[") {
+            let Some(end) = text[start + 9..].find("]]>") else { return Ok(()) };
+            i = start + 9 + end + 3;
+            continue;
+        }
+        if rest.starts_with("<?") {
+            let Some(end) = text[start + 2..].find("?>") else { return Ok(()) };
+            i = start + 2 + end + 2;
+            continue;
+        }
+
+        let mut j = start + 1;
+        let mut quote = None;
+        while j < bytes.len() {
+            match (bytes[j], quote) {
+                (b'\'' | b'\"', None) => quote = Some(bytes[j]),
+                (b, Some(q)) if b == q => quote = None,
+                (b'>', None) => break,
+                _ => {}
+            }
+            j += 1;
+        }
+        if j == bytes.len() {
+            return Ok(());
+        }
+
+        if rest.starts_with("</") {
+            depth = depth.checked_sub(1).ok_or_else(|| Error::Syntax { line: 1, msg: "unexpected XML closing tag".into() })?;
+        } else if !rest.starts_with("<!") {
+            let self_closing = bytes[start + 1..j].iter().rev().find(|b| !b.is_ascii_whitespace()) == Some(&b'/');
+            if !self_closing {
+                depth += 1;
+                if depth > MAX_XML_DEPTH {
+                    return Err(Error::Syntax { line: 1, msg: format!("TTML XML nesting exceeds {MAX_XML_DEPTH} elements") });
+                }
+            }
+        }
+        i = j + 1;
+    }
+    Ok(())
+}
+
 fn esc(s: &str) -> String {
     let mut o = String::with_capacity(s.len());
     for c in s.chars() {
@@ -55,8 +116,7 @@ fn esc(s: &str) -> String {
 }
 
 fn clock(t: Tick) -> String {
-    let ms = (t.0.max(0) + TICKS_PER_MS / 2) / TICKS_PER_MS;
-    format!("{:02}:{:02}:{:02}.{:03}", ms / 3_600_000, (ms / 60_000) % 60, (ms / 1000) % 60, ms % 1000)
+    crate::format_clock(t, '.')
 }
 
 /// Time expression for `t`: frames at `rate` when it is on a frame boundary, else clock time.
@@ -70,7 +130,23 @@ fn time_expr(t: Tick, rate: Option<FrameRate>) -> String {
 /// Caption text (`\n` lines, `<i>`/`<b>`/`<u>` tags) → TTML inline content.
 fn inline(text: &str) -> String {
     let mut out = String::new();
-    let mut open: Vec<&str> = Vec::new();
+    // Keep the logical style state separate from what has been written. There are only three
+    // supported styles, so duplicate or crossing input tags cannot grow an unbounded span stack.
+    let mut active: Vec<&'static str> = Vec::new();
+    let mut emitted: Vec<&'static str> = Vec::new();
+    let sync = |out: &mut String, active: &[&'static str], emitted: &mut Vec<&'static str>| {
+        if *emitted != active {
+            for _ in emitted.drain(..) {
+                out.push_str("</span>");
+            }
+            for attr in active {
+                out.push_str("<span ");
+                out.push_str(attr);
+                out.push('>');
+                emitted.push(attr);
+            }
+        }
+    };
     let mut rest = text;
     while !rest.is_empty() {
         if let Some(after) = rest.strip_prefix('<')
@@ -89,26 +165,16 @@ fn inline(text: &str) -> String {
             };
             if let Some(a) = attr {
                 if closing {
-                    if let Some(pos) = open.iter().rposition(|x| *x == a) {
-                        // close spans opened after it, then it, then reopen the inner ones
-                        let inner: Vec<&str> = open.drain(pos..).skip(1).collect();
-                        for _ in 0..=inner.len() {
-                            out.push_str("</span>");
-                        }
-                        for x in inner {
-                            out.push_str(&format!("<span {x}>"));
-                            open.push(x);
-                        }
-                    }
-                } else {
-                    out.push_str(&format!("<span {a}>"));
-                    open.push(a);
+                    active.retain(|style| *style != a);
+                } else if !active.contains(&a) {
+                    active.push(a);
                 }
             }
             rest = &after[end + 1..];
             continue;
         }
         let Some(ch) = rest.chars().next() else { break };
+        sync(&mut out, &active, &mut emitted);
         if ch == '\n' {
             out.push_str("<br/>");
         } else {
@@ -116,7 +182,7 @@ fn inline(text: &str) -> String {
         }
         rest = &rest[ch.len_utf8()..];
     }
-    for _ in open {
+    for _ in emitted {
         out.push_str("</span>");
     }
     out
@@ -277,8 +343,42 @@ fn speaker_names(root: roxmltree::Node) -> HashMap<String, String> {
 fn speaker(n: roxmltree::Node, names: &HashMap<String, String>) -> Option<String> {
     let refs = n.attributes().find(|a| a.name() == "agent" && metadata_namespace(a.namespace())).map(|a| a.value()).or_else(|| n.attribute("agent"));
     refs.map(|refs| {
-        // The project stores one speaker label; multiple agents become an ordered display label.
-        refs.split_whitespace().map(|id| names.get(id).cloned().unwrap_or_else(|| id.trim_start_matches('_').replace('_', " "))).collect::<Vec<_>>().join(", ")
+        // The project stores one speaker label. Keep document-defined long names and repeated
+        // references from multiplying into an unbounded per-cue allocation.
+        const MAX_REFS: usize = 64;
+        const MAX_LABEL_BYTES: usize = 4096;
+        let mut out = String::new();
+        for id in refs.split_whitespace().take(MAX_REFS) {
+            if !out.is_empty() {
+                if out.len() + 2 > MAX_LABEL_BYTES {
+                    break;
+                }
+                out.push_str(", ");
+            }
+            let name = names.get(id).map(String::as_str).unwrap_or(id);
+            if names.contains_key(id) {
+                let room = MAX_LABEL_BYTES.saturating_sub(out.len());
+                let mut end = 0;
+                for (i, ch) in name.char_indices() {
+                    if i + ch.len_utf8() > room {
+                        break;
+                    }
+                    end = i + ch.len_utf8();
+                }
+                out.push_str(&name[..end]);
+            } else {
+                for ch in id.trim_start_matches('_').chars() {
+                    if out.len() + ch.len_utf8() > MAX_LABEL_BYTES {
+                        break;
+                    }
+                    out.push(if ch == '_' { ' ' } else { ch });
+                }
+            }
+            if out.len() == MAX_LABEL_BYTES {
+                break;
+            }
+        }
+        out
     })
 }
 
@@ -356,7 +456,7 @@ fn parse_time(s: &str, tm: Timing) -> Option<Tick> {
     let unit_start = s.find(|c: char| c.is_ascii_alphabetic())?;
     let (v, unit) = s.split_at(unit_start);
     let (vi, vf) = v.split_once('.').unwrap_or((v, ""));
-    if !vi.bytes().all(|b| b.is_ascii_digit()) || vi.len() > 15 {
+    if vi.is_empty() || !vi.bytes().all(|b| b.is_ascii_digit()) || vi.len() > 15 {
         return None;
     }
     let t = match unit {
@@ -482,6 +582,7 @@ fn clean(s: &str) -> String {
 }
 
 pub fn parse(text: &str) -> Result<Document> {
+    check_xml_depth(text)?;
     let xml = roxmltree::Document::parse(text).map_err(|_| Error::NotFormat("TTML"))?;
     let root = xml.root_element();
     if root.tag_name().name() != "tt" {
@@ -649,6 +750,12 @@ mod tests {
         }
     }
 
+    #[test]
+    fn deeply_nested_ttml_is_rejected_before_xml_parsing() {
+        let xml = format!("<tt>{}<p begin=\"0s\" end=\"1s\">caption</p>{}</tt>", "<div>".repeat(MAX_XML_DEPTH), "</div>".repeat(MAX_XML_DEPTH));
+        assert!(matches!(parse(&xml), Err(Error::Syntax { msg, .. }) if msg.contains("nesting exceeds")));
+    }
+
     #[test]
     fn missing_timing_parameters_keep_defaults() {
         for (params, begin, end) in [
@@ -758,6 +865,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn offset_time_without_integer_digits_is_rejected() {
+        let t = tm(FrameRate::FPS_25);
+        for expr in ["s", "ms", "h", "m", "t", "f", ".5s", ".5ms", ".s"] {
+            assert_eq!(parse_time(expr, t), None, "{expr}");
+        }
+        assert_eq!(parse_time("0s", t), Some(Tick(0)));
+        assert_eq!(parse_time("0.5s", t), Some(Tick(TICKS_PER_SECOND / 2)));
+        assert_eq!(parse_time("1ms", t), Some(Tick(TICKS_PER_SECOND / 1000)));
+    }
+
     #[test]
     fn reads_styles_spans_and_nesting() {
         let x = r#"<?xml version="1.0"?>
@@ -805,4 +923,11 @@ mod tests {
         let d = write(&doc, Flavor::Dfxp, Some(r), "en");
         assert!(d.contains(DFXP_PROFILE) && d.contains("begin=\"00:00:01.001\""), "{d}");
     }
+
+    #[test]
+    fn duplicate_and_crossing_spans_have_bounded_output() {
+        let text = format!("{}x{}", "<i>".repeat(1_000), "</i>".repeat(1_000));
+        let out = inline(&text);
+        assert_eq!(out, "<span tts:fontStyle=\"italic\">x</span>");
+    }
 }
diff --git a/crates/captions/src/vtt.rs b/crates/captions/src/vtt.rs
index a1afb2445..0ad76615e 100644
--- a/crates/captions/src/vtt.rs
+++ b/crates/captions/src/vtt.rs
@@ -79,11 +79,11 @@ pub fn parse(text: &str) -> Result<Document> {
     let mut seen_cue = false;
     for b in blocks {
         let first = b[0].trim();
-        if !first.contains("-->") && (first == "NOTE" || first.starts_with("NOTE ") || first.starts_with("NOTE\t")) {
+        if !b.iter().any(|l| l.contains("-->")) && (first == "NOTE" || first.starts_with("NOTE ") || first.starts_with("NOTE\t")) {
             doc.blocks.push(b.join("\n"));
             continue;
         }
-        if !seen_cue && !first.contains("-->") && (first == "STYLE" || first == "REGION") {
+        if !seen_cue && !b.iter().any(|l| l.contains("-->")) && (first == "STYLE" || first == "REGION") {
             doc.blocks.push(b.join("\n"));
             continue;
         }
@@ -152,6 +152,15 @@ mod tests {
 
     const SAMPLE: &str = "WEBVTT - with header\nKind: captions\n\nSTYLE\n::cue { color: yellow }\n\nNOTE a comment\nspanning lines\n\nintro\n00:01.000 --> 00:00:03.500 line:90% align:start\n<v.loud Ann Smith>Hello there\nsecond line\n\n00:00:04.000 --> 00:00:05.000\n<i>plain</i> &amp; tags\n";
 
+    #[test]
+    fn style_region_identifier_cue_is_kept() {
+        for id in ["STYLE", "REGION"] {
+            let d = parse(&format!("WEBVTT\n\n{id}\n00:00:01.000 --> 00:00:02.000\nHi\n")).unwrap();
+            assert_eq!(d.cues.len(), 1, "{id}");
+            assert!(d.blocks.is_empty(), "{id}");
+        }
+    }
+
     #[test]
     fn parse_sample() {
         let d = parse(SAMPLE).unwrap();
@@ -190,6 +199,14 @@ mod tests {
         assert_eq!(split_voice(closed), (None, closed.to_string()));
     }
 
+    #[test]
+    fn note_prefixed_cue_id_is_a_cue() {
+        let d = parse("WEBVTT\n\nNOTE 1\n00:00:01.000 --> 00:00:02.000\nhello\n").unwrap();
+        assert_eq!(d.cues.len(), 1);
+        assert_eq!(d.cues[0].id.as_deref(), Some("NOTE 1"));
+        assert!(d.blocks.is_empty());
+    }
+
     #[test]
     fn without_signature() {
         let d = parse("00:00:01.000 --> 00:00:02.000\nx\n").unwrap();
diff --git a/crates/captions/tests/it/main.rs b/crates/captions/tests/it/main.rs
new file mode 100644
index 000000000..538c5cebf
--- /dev/null
+++ b/crates/captions/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod roundtrip;
+mod ttml_body_timing;
+mod ttml_clock_overflow;
+mod ttml_speakers;
diff --git a/crates/captions/tests/roundtrip.rs b/crates/captions/tests/it/roundtrip.rs
similarity index 100%
rename from crates/captions/tests/roundtrip.rs
rename to crates/captions/tests/it/roundtrip.rs
diff --git a/crates/captions/tests/ttml_body_timing.rs b/crates/captions/tests/it/ttml_body_timing.rs
similarity index 100%
rename from crates/captions/tests/ttml_body_timing.rs
rename to crates/captions/tests/it/ttml_body_timing.rs
diff --git a/crates/captions/tests/it/ttml_clock_overflow.rs b/crates/captions/tests/it/ttml_clock_overflow.rs
new file mode 100644
index 000000000..23a3870ad
--- /dev/null
+++ b/crates/captions/tests/it/ttml_clock_overflow.rs
@@ -0,0 +1,18 @@
+//! TTML / DFXP export must not overflow for cue times near `i64::MAX` (e.g. from an MCC with a
+//! huge timecode).
+
+use filmcraft_captions::{Cue, Document, Format, WriteOptions, write};
+use filmcraft_time::Tick;
+
+fn doc(end: Tick) -> Document {
+    Document { cues: vec![Cue { start: Tick(0), end, text: "x".into(), ..Cue::default() }], ..Document::default() }
+}
+
+#[test]
+fn ttml_and_dfxp_write_survive_tick_max() {
+    for format in [Format::Ttml, Format::Dfxp] {
+        let out = write(&doc(Tick(i64::MAX)), format, WriteOptions::default());
+        let s = String::from_utf8(out).unwrap();
+        assert!(s.contains("end=\""), "{format:?}: {s}");
+    }
+}
diff --git a/crates/captions/tests/ttml_speakers.rs b/crates/captions/tests/it/ttml_speakers.rs
similarity index 100%
rename from crates/captions/tests/ttml_speakers.rs
rename to crates/captions/tests/it/ttml_speakers.rs
diff --git a/crates/codecs/src/audio_timing_tests.rs b/crates/codecs/src/audio_timing_tests.rs
index 62f25cb10..e712f7052 100644
--- a/crates/codecs/src/audio_timing_tests.rs
+++ b/crates/codecs/src/audio_timing_tests.rs
@@ -50,6 +50,8 @@ fn mkv(asc: &[u8], rate: u32, units: &[Vec<u8>], lacing: LacingMode, gap: usize,
     let mut spec = TrackSpec::new(TrackKind::Audio, "A_AAC");
     spec.codec_private = asc.to_vec();
     spec.audio = Some((rate as f64, 2, None));
+    // an access unit's duration, rounded to the nanosecond; without it the writer laces nothing
+    spec.default_duration_ns = Some((1024 * 1_000_000_000 + u64::from(rate) / 2) / u64::from(rate));
     let opts = MuxOptions { lacing, ..MuxOptions::default() };
     assert_eq!(opts.timestamp_scale, 1_000_000, "1 ms timestamps");
     let mut w = MkvWriter::new(Cursor::new(Vec::new()), vec![spec], opts).unwrap();
@@ -116,6 +118,8 @@ fn matroska_millisecond_stamps_play_back_to_back() {
         let frames = units.len().saturating_sub(1) * 1024;
         for lacing in [LacingMode::None, LacingMode::Xiph] {
             let bytes = mkv(&asc, rate, &units, lacing, usize::MAX, 0);
+            let laced = filmcraft_matroska::open(&bytes[..]).unwrap().tracks.iter().any(|t| t.samples.iter().any(|s| s.lace > 0));
+            assert_eq!(laced, !matches!(lacing, LacingMode::None), "{rate} Hz, {lacing:?}: laced blocks");
             let src = MkvSource::open("tone.mkv", bytes.clone()).unwrap();
             let got = played(&src, rate, frames);
             let (n, first) = mismatches(&got, &want, 0);
diff --git a/crates/codecs/src/avi.rs b/crates/codecs/src/avi.rs
index 659524427..8855c3a65 100644
--- a/crates/codecs/src/avi.rs
+++ b/crates/codecs/src/avi.rs
@@ -154,6 +154,8 @@ fn random_access(data: &[u8], hevc: bool) -> bool {
 
 /// The packets of a framed audio stream: every frame header found in the stream of chunks, and
 /// the samples each frame decodes to. Bytes that start no frame are skipped (resynchronisation).
+const MAX_FRAMED_AUDIO_SCAN_BYTES: u64 = 256 << 20;
+
 fn split_frames(
     file: &AviFile,
     bytes: &crate::Src,
@@ -161,12 +163,18 @@ fn split_frames(
     ts: &filmcraft_mpegts::Codec,
 ) -> (Vec<Piece>, Vec<usize>, Vec<u32>, Option<filmcraft_mpegts::FrameInfo>) {
     let Some(st) = file.streams.get(s) else { return Default::default() };
+    // AVI indexes can reference the same physical chunk repeatedly. Keep header scanning bounded
+    // by both the source itself and a practical absolute limit before issuing those repeated reads.
+    let budget = bytes.0.len().saturating_mul(4).min(MAX_FRAMED_AUDIO_SCAN_BYTES);
     // chunk start positions in the concatenated stream
     let mut at = Vec::with_capacity(st.chunks.len());
     let mut total = 0usize;
     for c in &st.chunks {
         at.push(total);
         total = total.saturating_add(c.size as usize);
+        if total as u64 > budget {
+            return Default::default();
+        }
     }
     let locate = |pos: usize| -> Option<(usize, usize)> {
         let k = at.partition_point(|&a| a <= pos).checked_sub(1)?;
@@ -329,10 +337,12 @@ impl AviSource {
         let mut audio_streams = Vec::new();
         for &s in &astreams {
             let Some(st) = file.streams.get(s) else { continue };
-            let w = st.audio.clone().unwrap_or_default();
+            let mut w = st.audio.clone().unwrap_or_default();
+            let Ok((sample_rate, channels)) = filmcraft_media::bounded_audio_dimensions(w.sample_rate, u32::from(w.channels)) else { continue };
+            w.sample_rate = sample_rate;
+            w.channels = u16::try_from(channels).unwrap_or(u16::MAX);
             let (codec, label) = audio_codec(&w);
-            let mut sample_rate = w.sample_rate.max(1);
-            let mut channels = u32::from(w.channels.max(1));
+            let (mut sample_rate, mut channels) = (sample_rate, channels);
             let (pieces, first, starts) = match &codec {
                 ACodec::Pcm(cfg) => {
                     let block = usize::from(w.block_align.max(1)).max((usize::from(cfg.bits).div_ceil(8)) * channels as usize);
@@ -529,14 +539,18 @@ impl MediaSource for AviSource {
             return Err(MediaError::Unsupported(format!("{name} audio")));
         }
         let ch = ainfo.channels.max(1) as usize;
-        let ratio = f64::from(ainfo.sample_rate) / f64::from(sample_rate.max(1));
+        let source_frames = filmcraft_media::resample_source_frames(frames, ainfo.sample_rate, sample_rate)?;
+        let need = source_frames.checked_add(2).ok_or_else(|| MediaError::Decode("audio source window overflows".into()))?;
+        filmcraft_media::validate_audio_buffer_shape(ch, need)?;
+        filmcraft_media::validate_audio_buffer_shape(ch, frames)?;
+        let ratio = f64::from(ainfo.sample_rate) / f64::from(sample_rate);
         let s0 = (start as f64 * ratio).floor() as i64;
-        let need = (frames as f64 * ratio).ceil() as i64 + 2;
-        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need.max(0) as usize]; ch];
+        let need_i64 = i64::try_from(need).unwrap_or(i64::MAX);
+        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need]; ch];
         let mut st = a.state.lock().unwrap_or_else(|e| e.into_inner());
         let mut i = a.starts.partition_point(|&x| x <= s0).saturating_sub(1);
         while let Some(&pk_start) = a.starts.get(i) {
-            if pk_start >= s0 + need {
+            if pk_start >= s0.saturating_add(need_i64) {
                 break;
             }
             let pk = self.audio_packet(a, &mut st, ainfo, i)?;
diff --git a/crates/codecs/src/gop.rs b/crates/codecs/src/gop.rs
index 522b46b43..240aeb5db 100644
--- a/crates/codecs/src/gop.rs
+++ b/crates/codecs/src/gop.rs
@@ -123,6 +123,20 @@ pub trait VideoSamples: Sync {
     fn make_decoder(&self) -> crate::Result<Box<dyn VideoDecoder>>;
 }
 
+/// A container's sync sample for `i` when leading pictures need the GOP before: `sync` is the
+/// index's own sync sample, `leads(i, key)` says `i` is shown before `key`. One step per GOP, so a
+/// loop: a crafted index can chain tens of thousands of GOPs (#2803). A `sync` past `i` stops the
+/// walk instead of looping on it.
+pub(crate) fn open_gop_sync(mut i: usize, sync: impl Fn(usize) -> usize, leads: impl Fn(usize, usize) -> bool) -> usize {
+    loop {
+        let key = sync(i);
+        if key == 0 || key > i || !leads(i, key) {
+            return key;
+        }
+        i = key - 1;
+    }
+}
+
 /// The sync sample to start decoding at for sample `i`: its sync sample, or an earlier one when
 /// `i` is a leading picture of an open GOP (stored after its random-access picture, shown before
 /// it, like the RASL pictures after every HEVC CRA of iPhone video). Those are predicted from the
@@ -432,11 +446,13 @@ pub struct GopCache {
     budget: usize,
 }
 
-/// The cache always has room for this many frames, whatever their size: a frame-threaded decoder
-/// runs up to ~2x its thread count ahead of the frame it returns, and playback prefetches ahead
-/// of the playhead, so a byte budget alone would evict 4K frames before they are shown and force
-/// a re-decode from the keyframe.
+/// The cache reserves room for this many small frames: a frame-threaded decoder runs up to ~2x
+/// its thread count ahead of the frame it returns, and playback prefetches ahead of the playhead.
 const MIN_FRAMES: usize = 64;
+/// A source cache never retains more decoded pixels than this, regardless of frame dimensions.
+/// In particular, untrusted VP9 `show_existing_frame` samples must not turn the small-frame
+/// reserve above into an unbounded number of full-resolution copies.
+const FRAME_CACHE_CEILING: usize = 384 << 20;
 
 /// A running decoder up to this many samples before the wanted sample's sync sample keeps going
 /// rather than restarting at the sync sample.
@@ -447,7 +463,7 @@ const CONTINUE_THROUGH: usize = 48;
 fn decode_pool() -> Option<&'static rayon::ThreadPool> {
     static POOL: std::sync::OnceLock<Option<rayon::ThreadPool>> = std::sync::OnceLock::new();
     POOL.get_or_init(|| {
-        let n = std::thread::available_parallelism().map(|n| n.get()).unwrap_or(1);
+        let n = std::thread::available_parallelism().map(std::num::NonZeroUsize::get).unwrap_or(1);
         rayon::ThreadPoolBuilder::new().num_threads(n).thread_name(|i| format!("decode-{i}")).build().ok()
     })
     .as_ref()
@@ -478,7 +494,7 @@ fn isolated<T: Send>(f: impl FnOnce() -> crate::Result<T> + Send) -> crate::Resu
                 let job = slot.lock().unwrap_or_else(PoisonError::into_inner).take();
                 job.map(|job| pool.install(job))
             });
-            spawned.map(|h| h.join())
+            spawned.map(std::thread::ScopedJoinHandle::join)
         });
         return match waited {
             Ok(Ok(Some(r))) => r,
@@ -519,7 +535,7 @@ impl GopCache {
             pool: pool.clone(),
         });
         pool.register(&shared);
-        Self { shared, explicit_color, rotation: 0, crop: None, budget: 384 << 20 }
+        Self { shared, explicit_color, rotation: 0, crop: None, budget: FRAME_CACHE_CEILING }
     }
 
     /// Turn every decoded frame clockwise by `quarter_turns` × 90° (the container's display
@@ -554,6 +570,12 @@ impl GopCache {
         self.store_finished(st, pts, self.finish(f), draft);
     }
 
+    /// The small-frame reserve may use the configured cache budget, but may never enlarge it.
+    fn cache_budget(&self, frame_bytes: usize) -> usize {
+        let reserve = MIN_FRAMES.saturating_mul(frame_bytes).min(FRAME_CACHE_CEILING);
+        self.budget.min(FRAME_CACHE_CEILING).max(reserve)
+    }
+
     /// Cache a frame [`Self::finish`] has been applied to.
     fn store_finished(&self, st: &mut State, pts: i64, f: VideoFrame, draft: bool) {
         st.last_used = Instant::now();
@@ -563,7 +585,7 @@ impl GopCache {
         } else {
             st.drafts.remove(&pts);
         }
-        let budget = self.budget.max(MIN_FRAMES * f.byte_size());
+        let budget = self.cache_budget(f.byte_size());
         let before = st.bytes;
         st.bytes += f.byte_size();
         if let Some(old) = st.frames.insert(pts, Arc::new(f)) {
@@ -650,7 +672,7 @@ impl GopCache {
         // after the guard on every return path: dropping a decoder can block (a hardware session
         // waits for its frames in flight) and must not hold this cache's lock.
         let mut released: Vec<Box<dyn VideoDecoder>> = Vec::new();
-        let mut st = self.shared.state.lock().unwrap_or_else(|e| e.into_inner());
+        let mut st = self.shared.state.lock().unwrap_or_else(PoisonError::into_inner);
         let _decoding = DecodingGuard::enter(me);
         st.last_used = Instant::now();
         st.pin = want_pts;
@@ -853,7 +875,7 @@ impl GopCache {
             count_frames(&out);
             out.into_iter().map(|d| (d.pts, self.finish(d.frame), d.draft)).collect::<Vec<_>>()
         });
-        let mut st = self.shared.state.lock().unwrap_or_else(|e| e.into_inner());
+        let mut st = self.shared.state.lock().unwrap_or_else(PoisonError::into_inner);
         if st.spare.len() < 16 {
             st.spare.push(dec);
         }
@@ -866,6 +888,19 @@ impl GopCache {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn open_gop_sync_walks_a_long_chain_of_leading_pictures_without_recursing() {
+        // Every GOP of 3 starts at a key whose leading picture is shown before it (#2803).
+        let gops = 200_000usize;
+        let sync = |i: usize| i - i % 3;
+        let leads = |i: usize, key: usize| i == key + 2;
+        assert_eq!(super::open_gop_sync(gops * 3 - 1, sync, leads), 0);
+        // A picture that is not a leading one keeps its own key.
+        assert_eq!(super::open_gop_sync(7, sync, |_, _| false), 6);
+        // An index whose sync sample lies past `i` ends the walk instead of looping.
+        assert_eq!(super::open_gop_sync(5, |_| 9, |_, _| true), 9);
+    }
+
     use super::*;
     use crate::video::DecodedFrame;
     use std::collections::VecDeque;
@@ -1047,6 +1082,8 @@ mod tests {
         use rayon::prelude::*;
         let s = Arc::new(ParSamples(samples(240, 30, 4, false)));
         let (tx, rx) = std::sync::mpsc::channel();
+        let done = Arc::new(AtomicUsize::new(0));
+        let counted = done.clone();
         std::thread::spawn(move || {
             for round in 0..40usize {
                 // export-like: many frame workers, frames of several GOPs of a fresh source at once
@@ -1054,11 +1091,25 @@ mod tests {
                 (0..96usize).into_par_iter().with_max_len(1).for_each(|k| {
                     let i = (k * 37 + round * 53) % 240;
                     assert_eq!(index_of(&c.frame(&*s, i as i64 * 1000).expect("frame")), i);
+                    counted.fetch_add(1, Ordering::Relaxed);
                 });
             }
             let _ = tx.send(());
         });
-        assert!(rx.recv_timeout(Duration::from_secs(120)).is_ok(), "frame requests deadlocked");
+        // A deadlock stops every request of a round for good. On a loaded machine the 3,840
+        // requests can take minutes, so the limit applies to the time between two answered ones.
+        let mut answered = 0;
+        loop {
+            match rx.recv_timeout(Duration::from_secs(120)) {
+                Ok(()) => break,
+                Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                    let now = done.load(Ordering::Relaxed);
+                    assert!(now > answered, "frame requests deadlocked after {now} frames");
+                    answered = now;
+                }
+                Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => panic!("a frame request failed"),
+            }
+        }
     }
 
     #[test]
@@ -1422,6 +1473,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn large_frames_cannot_enlarge_the_gop_cache_ceiling() {
+        let mut c = GopCache::new(None);
+        c.budget = usize::MAX;
+        assert_eq!(c.cache_budget(1), FRAME_CACHE_CEILING);
+        assert_eq!(c.cache_budget(FRAME_CACHE_CEILING), FRAME_CACHE_CEILING);
+        c.budget = 0;
+        assert_eq!(c.cache_budget(4), MIN_FRAMES * 4, "small frames retain the playback reserve");
+        assert_eq!(c.cache_budget(FRAME_CACHE_CEILING), FRAME_CACHE_CEILING, "large frames are capped instead of reserving 64 copies");
+    }
+
     #[test]
     fn evicted_frames_are_decoded_into_again() {
         let s = Big(200);
diff --git a/crates/codecs/src/hw.rs b/crates/codecs/src/hw.rs
index d14545bb2..0ad34e5e5 100644
--- a/crates/codecs/src/hw.rs
+++ b/crates/codecs/src/hw.rs
@@ -8,6 +8,7 @@
 //! decode, and a hardware decoder that fails mid-stream switches to
 //! [`crate::software_video_decoder`], so registering one never makes a file undecodable.
 
+use std::collections::HashSet;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 
 use filmcraft_isobmff::{CodecConfig, SampleEntry};
@@ -175,10 +176,14 @@ impl StreamInfo {
     /// with (parameter sets, a sequence header, a key frame of another format).
     pub fn parameters_changed(&self, sample: &[u8]) -> bool {
         match self {
-            Self::Nal(i) => i.nals(sample).into_iter().any(|n| {
-                n.first().is_some_and(|&h| i.is_parameter_set(i.nal_type(h)))
-                    && !i.parameter_sets.iter().any(|p| without_trailing_zeros(p) == without_trailing_zeros(n))
-            }),
+            Self::Nal(i) => {
+                let configured: HashSet<&[u8]> = i.parameter_sets.iter().map(|p| without_trailing_zeros(p)).collect();
+                let mut checked = HashSet::new();
+                i.nals(sample).into_iter().any(|n| {
+                    let n = without_trailing_zeros(n);
+                    n.first().is_some_and(|&h| i.is_parameter_set(i.nal_type(h))) && checked.insert(n) && !configured.contains(n)
+                })
+            }
             Self::Frame(i) => i.parameters_changed(sample),
         }
     }
@@ -456,4 +461,16 @@ mod tests {
         assert!(info.parameters_changed(&sample(&hvcc_pps[..6])), "a missing byte that is not zero is a change");
         assert!(info.parameters_changed(&sample(&[0x44, 0x01, 0xe0, 0xf7, 0xc0, 0x4c, 0x91])), "another PPS is a change");
     }
+
+    #[test]
+    fn repeated_parameter_sets_are_checked_once_per_distinct_nal() {
+        let pps = vec![0x44, 0x01, 0xe0, 0xf7, 0xc0, 0x4c, 0x90];
+        let info = StreamInfo::Nal(hevc_info(std::iter::repeat_n(pps.clone(), 256).collect()));
+        let mut sample = Vec::new();
+        for _ in 0..256 {
+            sample.extend_from_slice(&(pps.len() as u32).to_be_bytes());
+            sample.extend_from_slice(&pps);
+        }
+        assert!(!info.parameters_changed(&sample));
+    }
 }
diff --git a/crates/codecs/src/lib.rs b/crates/codecs/src/lib.rs
index 9a8bebdbf..f3ae47b72 100644
--- a/crates/codecs/src/lib.rs
+++ b/crates/codecs/src/lib.rs
@@ -77,7 +77,7 @@ impl From<CodecError> for filmcraft_media::MediaError {
 }
 
 /// Our own (pure-Rust) decoders, in the order they are tried.
-const BUILTIN_FACTORIES: [VideoDecoderFactory; 10] = [
+const BUILTIN_FACTORIES: [VideoDecoderFactory; 11] = [
     video::h264_factory,
     video::hevc_factory,
     video::vp8_factory,
@@ -88,6 +88,7 @@ const BUILTIN_FACTORIES: [VideoDecoderFactory; 10] = [
     video::dnx_factory,
     video::mjpeg_factory,
     video::mpeg2_factory,
+    video::raw_factory,
 ];
 
 fn factories() -> &'static RwLock<Vec<VideoDecoderFactory>> {
diff --git a/crates/codecs/src/mkv.rs b/crates/codecs/src/mkv.rs
index 2f51258a8..bdc8dc4fe 100644
--- a/crates/codecs/src/mkv.rs
+++ b/crates/codecs/src/mkv.rs
@@ -142,6 +142,20 @@ fn codec_delay_ticks(t: &filmcraft_matroska::Track) -> i64 {
     i64::try_from((t.codec_delay_ns as i128 + scale_ns / 2) / scale_ns).unwrap_or(i64::MAX)
 }
 
+/// The stream description of an audio track, `None` when its advertised sample rate or channel
+/// count is out of range (see [`filmcraft_media::bounded_audio_dimensions`]).
+fn audio_info(t: &filmcraft_matroska::Track) -> Option<AudioStreamInfo> {
+    let a = t.audio.clone().unwrap_or_default();
+    let mut rate = a.output_sampling_frequency.unwrap_or(a.sampling_frequency).round().max(1.0) as u32;
+    let mut channels = (a.channels as u32).max(1);
+    if let Some(h) = opus_head(&t.codec) {
+        rate = crate::audio::OPUS_RATE;
+        channels = h.channels as u32;
+    }
+    let (rate, channels) = filmcraft_media::bounded_audio_dimensions(rate, channels).ok()?;
+    Some(AudioStreamInfo { sample_rate: rate, channels, codec: codec_label(&t.codec), bits_per_sample: a.bit_depth.map(|b| b as u32) })
+}
+
 /// The track timestamp that media time zero stands for (#715): the earliest start among the
 /// playable tracks. Block timestamps count from the start of the Segment, and a remux that keeps
 /// its source's timestamps (`ffmpeg -copyts`, a cut from a recording) starts its first picture
@@ -231,7 +245,7 @@ fn vp9_config(private: &[u8], v: Option<&filmcraft_matroska::VideoInfo>) -> VpcC
         }
         p += 2 + len;
     }
-    if let Some(col) = v.and_then(|v| v.colour.as_ref()) {
+    if let Some(col) = v.and_then(|v| v.color.as_ref()) {
         if let Some(t) = col.transfer_characteristics {
             c.transfer_characteristics = t as u8;
         }
@@ -265,7 +279,7 @@ fn sample_entry(c: &Codec, private: &[u8], v: Option<&filmcraft_matroska::VideoI
 }
 
 /// HDR static metadata from the Matroska `Colour` element.
-fn hdr_metadata(c: &filmcraft_matroska::Colour) -> Option<filmcraft_color::HdrMetadata> {
+fn hdr_metadata(c: &filmcraft_matroska::Color) -> Option<filmcraft_color::HdrMetadata> {
     if c.mastering.is_none() && c.max_cll.is_none() && c.max_fall.is_none() {
         return None;
     }
@@ -285,7 +299,7 @@ fn hdr_metadata(c: &filmcraft_matroska::Colour) -> Option<filmcraft_color::HdrMe
 fn color_of(v: &filmcraft_matroska::VideoInfo, w: u32, h: u32, stream: Option<ColorCodes>) -> (ColorInfo, bool) {
     // H.273 code points; `Range`: 1 broadcast (limited), 2 full, 0 / 3 not signalled here
     let code = |c: Option<u64>| c.unwrap_or(2);
-    let container = v.colour.as_ref().map(|col| {
+    let container = v.color.as_ref().map(|col| {
         let range = match col.range {
             Some(1) => Some(false),
             Some(2) => Some(true),
@@ -339,7 +353,9 @@ impl MkvSource {
             .tracks
             .iter()
             .enumerate()
-            .filter(|(_, t)| t.kind == TrackKind::Audio && !t.samples.is_empty())
+            // A track whose advertised dimensions are refused is no stream at all, so `atracks[k]` and
+            // `info.audio_streams[k]` stay the same track.
+            .filter(|(_, t)| t.kind == TrackKind::Audio && !t.samples.is_empty() && audio_info(t).is_some())
             .map(|(i, _)| i)
             .take(filmcraft_media::MAX_AUDIO_STREAMS)
             .collect();
@@ -404,23 +420,10 @@ impl MkvSource {
                 color,
                 has_alpha: v.alpha_mode != 0,
                 bitrate,
-                hdr: v.colour.as_ref().and_then(hdr_metadata),
+                hdr: v.color.as_ref().and_then(hdr_metadata),
             }
         });
-        let audio_streams: Vec<AudioStreamInfo> = atracks
-            .iter()
-            .filter_map(|&i| file.tracks.get(i))
-            .map(|t| {
-                let a = t.audio.clone().unwrap_or_default();
-                let mut rate = a.output_sampling_frequency.unwrap_or(a.sampling_frequency).round().max(1.0) as u32;
-                let mut channels = (a.channels as u32).max(1);
-                if let Some(h) = opus_head(&t.codec) {
-                    rate = crate::audio::OPUS_RATE;
-                    channels = h.channels as u32;
-                }
-                AudioStreamInfo { sample_rate: rate, channels, codec: codec_label(&t.codec), bits_per_sample: a.bit_depth.map(|b| b as u32) }
-            })
-            .collect();
+        let audio_streams: Vec<AudioStreamInfo> = atracks.iter().filter_map(|&i| file.tracks.get(i)).filter_map(audio_info).collect();
         let info = MediaInfo {
             name: name.to_string(),
             kind: if video.is_some() { MediaKind::Movie } else { MediaKind::AudioOnly },
@@ -628,15 +631,19 @@ impl MediaSource for MkvSource {
         let ainfo = self.info.audio_streams.get(stream).ok_or(MediaError::NoStream("audio"))?;
         let src_rate = ainfo.sample_rate;
         let ch = ainfo.channels.max(1) as usize;
+        let source_frames = filmcraft_media::resample_source_frames(frames, src_rate, sample_rate)?;
+        let need = source_frames.checked_add(2).ok_or_else(|| MediaError::Decode("audio source window overflows".into()))?;
+        filmcraft_media::validate_audio_buffer_shape(ch, need)?;
+        filmcraft_media::validate_audio_buffer_shape(ch, frames)?;
         let ratio = src_rate as f64 / sample_rate as f64;
         let s0 = (start as f64 * ratio).floor() as i64;
-        let need = (frames as f64 * ratio).ceil() as i64 + 2;
-        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need.max(0) as usize]; ch];
+        let need_i64 = i64::try_from(need).unwrap_or(i64::MAX);
+        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need]; ch];
         let mut st = a.state.lock().unwrap_or_else(|e| e.into_inner());
         let mut i = a.starts.partition_point(|&x| x <= s0).saturating_sub(1);
         while i < n_packets {
             let Some(&pk_start) = a.starts.get(i) else { break };
-            if pk_start >= s0 + need {
+            if pk_start >= s0.saturating_add(need_i64) {
                 break;
             }
             let pk = self.audio_packet(a, ainfo, &mut st, i)?;
diff --git a/crates/codecs/src/mp4.rs b/crates/codecs/src/mp4.rs
index 6e33c027e..de2beb7d1 100644
--- a/crates/codecs/src/mp4.rs
+++ b/crates/codecs/src/mp4.rs
@@ -21,10 +21,15 @@ use crate::{CodecError, make_video_decoder};
 /// Most bytes read from one AAC access unit when probing for HE-AAC at open (8 channels × 6144 bits).
 const MAX_AAC_PROBE_UNIT: usize = 8 * 6144 / 8;
 
+struct DecodedAudioPacket {
+    samples: Vec<Vec<f32>>,
+    failed: bool,
+}
+
 struct AudioState {
     decoder: Option<PacketDecoder>,
     /// Decoded packets by sample index.
-    packets: HashMap<usize, Arc<Vec<Vec<f32>>>>,
+    packets: HashMap<usize, Arc<DecodedAudioPacket>>,
     order: Vec<usize>,
     last_decoded: Option<usize>,
 }
@@ -92,6 +97,20 @@ fn audio_starts(file: &Mp4File, bytes: &crate::Src, ti: usize, rate: u32) -> Vec
     contiguous_starts(packets, (frame / 2).max(unit.saturating_mul(2).saturating_add(1)))
 }
 
+/// Return source-rate buffer indices overlapped by a failed packet's concealment span.
+/// Packet positions are audio frames, but duration is raw track-timescale ticks
+/// treated as a frame count here; the span is clipped to the request.
+fn failed_audio_span(packet_start: i64, request_start: i64, duration: u32, request_len: usize) -> std::ops::Range<usize> {
+    let begin = usize::try_from(packet_start.saturating_sub(request_start).max(0)).unwrap_or(usize::MAX).min(request_len);
+    let end = if duration == 0 {
+        begin
+    } else {
+        let last = packet_start.saturating_add(i64::from(duration) - 1).saturating_sub(request_start);
+        usize::try_from((i128::from(last) + 1).max(0)).unwrap_or(usize::MAX).min(request_len)
+    };
+    begin..end
+}
+
 /// HDR static metadata from the sample entry's `mdcv` / `clli` boxes (0 = unknown).
 fn hdr_metadata(md: Option<&filmcraft_isobmff::MasteringDisplay>, cll: Option<(u16, u16)>) -> Option<filmcraft_color::HdrMetadata> {
     if md.is_none() && cll.is_none() {
@@ -366,18 +385,18 @@ impl Mp4Source {
     }
 
     /// Decoded packet `i` of audio stream `a` (`ainfo` is its `AudioStreamInfo`; `st` its decoder state).
-    fn audio_packet(&self, a: &Mp4Audio, ainfo: &AudioStreamInfo, st: &mut AudioState, i: usize) -> crate::Result<Arc<Vec<Vec<f32>>>> {
+    fn audio_packet(&self, a: &Mp4Audio, ainfo: &AudioStreamInfo, st: &mut AudioState, i: usize) -> crate::Result<Arc<DecodedAudioPacket>> {
         if let Some(p) = st.packets.get(&i) {
             return Ok(p.clone());
         }
         let ti = a.track;
         let track = self.file.tracks.get(ti).ok_or_else(|| CodecError::Unsupported("no audio track".into()))?;
         let entry = track.entries.first().ok_or_else(|| CodecError::Container("audio track without a sample description".into()))?;
-        let sample = track.samples.get(i).ok_or_else(|| CodecError::Container("audio packet out of range".into()))?;
+        track.samples.get(i).ok_or_else(|| CodecError::Container("audio packet out of range".into()))?;
         let pk_start = a.starts.get(i).copied().unwrap_or(0);
         let data = self.read(ti, i)?;
-        let decoded = match &entry.codec {
-            CodecConfig::Pcm(p) => decode_pcm(&data, p),
+        let (samples, failed) = match &entry.codec {
+            CodecConfig::Pcm(p) => (decode_pcm(&data, p), false),
             c => {
                 if st.decoder.is_none() {
                     st.decoder = Some(PacketDecoder::for_isobmff(c, ainfo.sample_rate)?);
@@ -398,15 +417,15 @@ impl Mp4Source {
                         }
                     }
                 }
-                let r = st.decoder.as_mut().ok_or_else(|| CodecError::Decode("no audio decoder".into()))?.decode(&data, pk_start.max(0) as u64);
+                let result = st.decoder.as_mut().ok_or_else(|| CodecError::Decode("no audio decoder".into()))?.decode(&data, pk_start.max(0) as u64);
                 st.last_decoded = Some(i);
-                match r {
-                    Ok(v) => v,
-                    Err(_) => vec![vec![0.0; sample.duration as usize]; ainfo.channels.max(1) as usize],
+                match result {
+                    Ok(samples) => (samples, false),
+                    Err(_) => (Vec::new(), true),
                 }
             }
         };
-        let p = Arc::new(decoded);
+        let p = Arc::new(DecodedAudioPacket { samples, failed });
         st.packets.insert(i, p.clone());
         st.order.push(i);
         if st.order.len() > 4096 {
@@ -465,25 +484,39 @@ impl MediaSource for Mp4Source {
         let ainfo = self.info.audio_streams.get(stream).ok_or(MediaError::NoStream("audio"))?;
         let src_rate = ainfo.sample_rate;
         let ch = ainfo.channels.max(1) as usize;
+        let source_frames = filmcraft_media::resample_source_frames(frames, src_rate, sample_rate)?;
+        let need = source_frames.checked_add(2).ok_or_else(|| MediaError::Decode("audio source window overflows".into()))?;
+        filmcraft_media::validate_audio_buffer_shape(ch, need)?;
+        filmcraft_media::validate_audio_buffer_shape(ch, frames)?;
         // Map the requested window to source samples (edit list offset applied: presentation = pts + edit_offset).
         let ratio = src_rate as f64 / sample_rate as f64;
         let p0 = (start as f64 * ratio).floor() as i64;
         // (in i128: a hostile edit list can make the offset large enough to overflow i64)
         let offset = i128::from(a.offset) * i128::from(src_rate) / i128::from(track.timescale.max(1));
         let s0 = i64::try_from(i128::from(p0) - offset).unwrap_or(if offset > 0 { i64::MIN } else { i64::MAX });
-        let need = (frames as f64 * ratio).ceil() as i64 + 2;
-        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need.max(0) as usize]; ch];
+        let need_i64 = i64::try_from(need).unwrap_or(i64::MAX);
+        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need]; ch];
         let mut st = a.state.lock().unwrap_or_else(|e| e.into_inner());
         let first = a.starts.partition_point(|&x| x <= s0.max(0)).saturating_sub(1);
         let mut i = first;
-        while i < track.samples.len() {
+        while let Some(sample) = track.samples.get(i) {
             let Some(&pk_start) = a.starts.get(i) else { break };
-            if pk_start >= s0.saturating_add(need) {
+            if pk_start >= s0.saturating_add(need_i64) {
                 break;
             }
             let pk = self.audio_packet(a, ainfo, &mut st, i)?;
+            if pk.failed {
+                let range = failed_audio_span(pk_start, s0, sample.duration, src.first().map_or(0, Vec::len));
+                for dst in &mut src {
+                    if let Some(span) = dst.get_mut(range.clone()) {
+                        span.fill(0.0);
+                    }
+                }
+                i += 1;
+                continue;
+            }
             for (c, dst) in src.iter_mut().enumerate() {
-                let Some(chan) = pk.get(c.min(pk.len().saturating_sub(1))) else { continue };
+                let Some(chan) = pk.samples.get(c.min(pk.samples.len().saturating_sub(1))) else { continue };
                 for (k, v) in chan.iter().enumerate() {
                     let pos = pk_start.saturating_add(k as i64).saturating_sub(s0);
                     if pos >= 0 && (pos as usize) < dst.len() {
@@ -560,7 +593,8 @@ fn audio_stream_info(t: &filmcraft_isobmff::Track, bytes: &crate::Src) -> Option
         }
         c => codec_label(c),
     };
-    Some(AudioStreamInfo { sample_rate: rate.max(1), channels: ch.max(1), codec, bits_per_sample: bits })
+    let (rate, ch) = filmcraft_media::bounded_audio_dimensions(rate, ch).ok()?;
+    Some(AudioStreamInfo { sample_rate: rate, channels: ch, codec, bits_per_sample: bits })
 }
 
 fn codec_label(c: &CodecConfig) -> String {
@@ -580,6 +614,9 @@ fn codec_label(c: &CodecConfig) -> String {
         CodecConfig::Hevc(_) => "HEVC".into(),
         CodecConfig::Vp9(c) => format!("VP9 (Profile {})", c.profile),
         CodecConfig::Unknown { fourcc, .. } if fourcc.0 == *b"vp08" => "VP8".into(),
+        CodecConfig::Unknown { fourcc, .. } if fourcc.0 == *b"raw " => "Uncompressed RGB".into(),
+        CodecConfig::Unknown { fourcc, .. } if fourcc.0 == *b"2vuy" => "Uncompressed YUV 4:2:2".into(),
+        CodecConfig::Unknown { fourcc, .. } if fourcc.0 == *b"v210" => "Uncompressed YUV 4:2:2 10-bit".into(),
         CodecConfig::Av1(c) => format!("AV1 ({} Profile)", ["Main", "High", "Professional"].get(c.seq_profile as usize).unwrap_or(&"Main")),
         CodecConfig::Apv(a) => match filmcraft_apv::Profile::from_idc(a.profile_idc) {
             Some(p) => p.name().into(),
@@ -1318,3 +1355,81 @@ mod he_aac_tests {
         }
     }
 }
+
+#[cfg(test)]
+mod corrupt_audio_tests {
+    use filmcraft_isobmff::{Brand, Mp4Writer, SampleEntry, TrackConfig, WriteSample, WriterOptions};
+    use filmcraft_media::MediaSource;
+
+    #[test]
+    fn failed_packet_span_matches_per_sample_silence_at_extreme_timestamps() {
+        let min = i64::MIN;
+        let max = i64::MAX;
+        for start in [min, min + 1, min + 2, -10, -1, 0, 1, 10, max - 2, max - 1, max] {
+            for request in [min, min + 1, min + 2, -10, -1, 0, 1, 10, max - 2, max - 1, max] {
+                for duration in [0, 1, 2, 5, 128] {
+                    let old: Vec<_> = (0..duration)
+                        .map(|k| start.saturating_add(i64::from(k)).saturating_sub(request))
+                        .filter(|&position| (0..8).contains(&position))
+                        .map(|position| position as usize)
+                        .collect();
+                    let range = super::failed_audio_span(start, request, duration, 8);
+                    let actual: Vec<_> = (0..8).filter(|position| range.contains(position)).collect();
+                    let expected: Vec<_> = old.into_iter().collect::<std::collections::BTreeSet<_>>().into_iter().collect();
+                    assert_eq!(actual, expected, "start={start}, request={request}, duration={duration}");
+                }
+            }
+        }
+        assert_eq!(super::failed_audio_span(0, 0, u32::MAX, 128), 0..128);
+    }
+
+    #[test]
+    fn failed_aac_packet_does_not_materialize_its_hostile_duration() {
+        // AAC-LC, 48 kHz stereo. The empty access unit cannot decode.
+        let asc = vec![0x11, 0x90];
+        let mut mux = Mp4Writer::new(std::io::Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4)).unwrap();
+        let track = mux.add_track(TrackConfig::new(SampleEntry::aac(asc, 2, 48_000), 48_000)).unwrap();
+        mux.write_sample(track, WriteSample { data: &[], duration: 1_000_000, composition_offset: 0, is_sync: true }).unwrap();
+        let source = super::Mp4Source::open("damaged.m4a", mux.finish().unwrap().into_inner().into()).unwrap();
+        let audio = &source.audios[0];
+        let info = &source.info.audio_streams[0];
+        let mut state = audio.state.lock().unwrap();
+        let packet = source.audio_packet(audio, info, &mut state, 0).unwrap();
+        assert!(packet.failed);
+        assert!(packet.samples.is_empty(), "failed packet must not allocate from its untrusted duration");
+        drop(state);
+
+        let window = source.audio(0, 128, 48_000).unwrap();
+        assert_eq!(window.channels.len(), 2);
+        assert!(window.channels.iter().all(|ch| ch.len() == 128 && ch.iter().all(|&v| v == 0.0)));
+    }
+
+    #[test]
+    fn failed_aac_packet_silences_overlap_independent_of_request_boundary() {
+        let rate = 48_000u32;
+        let tone: Vec<f32> = (0..8192).map(|i| 0.3 * (i as f32 * 0.13).sin()).collect();
+        let mut encoder = filmcraft_aac::Encoder::new(filmcraft_aac::EncoderConfig::cbr(rate, 1, 64_000)).unwrap();
+        let mut units = encoder.encode(&[&tone]);
+        units.extend(encoder.flush());
+        assert!(units.len() >= 2);
+        let mut mux = Mp4Writer::new(std::io::Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4)).unwrap();
+        let track = mux.add_track(TrackConfig::new(SampleEntry::aac(vec![0x11, 0x88], 1, rate), rate)).unwrap();
+        mux.write_sample(track, WriteSample { data: &units[0], duration: 1024, composition_offset: 0, is_sync: true }).unwrap();
+        mux.write_sample(track, WriteSample { data: &units[1], duration: 400, composition_offset: 0, is_sync: true }).unwrap();
+        mux.write_sample(track, WriteSample { data: &[], duration: 1024, composition_offset: 0, is_sync: true }).unwrap();
+        let source = super::Mp4Source::open("overlap.m4a", mux.finish().unwrap().into_inner().into()).unwrap();
+        // The failed packet starts at 1024 + 400 = 1424, after 124 frames of the crossing read.
+        let crossing = source.audio(1300, 256, rate).unwrap();
+        let isolated = source.audio(1424, 132, rate).unwrap();
+        let prior_packet_len = {
+            let audio = &source.audios[0];
+            let info = &source.info.audio_streams[0];
+            let mut state = audio.state.lock().unwrap();
+            source.audio_packet(audio, info, &mut state, 1).unwrap().samples.first().map_or(0, Vec::len)
+        };
+        assert!(prior_packet_len > 400, "valid packet must overlap the failed packet");
+        assert!(crossing.channels[0][..124].iter().any(|v| v.abs() > 0.001));
+        assert!(isolated.channels[0].iter().all(|&v| v == 0.0));
+        assert_eq!(&crossing.channels[0][124..], &isolated.channels[0]);
+    }
+}
diff --git a/crates/codecs/src/mpeg.rs b/crates/codecs/src/mpeg.rs
index e2cd09ba1..040ca9092 100644
--- a/crates/codecs/src/mpeg.rs
+++ b/crates/codecs/src/mpeg.rs
@@ -369,15 +369,7 @@ impl MpegSource {
         let raw: Vec<Option<i64>> = v.order.iter().map(|&i| units[v.units[i]].pts).collect();
         let rate = self.info.frame_rate();
         let dur = |k: i64| (k as i128 * 90_000 * rate.den as i128 / rate.num.max(1) as i128) as i64;
-        let known: Vec<usize> = (0..raw.len()).filter(|&i| raw[i].is_some()).collect();
-        (0..raw.len())
-            .map(|i| {
-                raw[i].or_else(|| {
-                    let j = known.iter().rev().find(|&&j| j < i).or_else(|| known.iter().find(|&&j| j > i))?;
-                    Some(raw[*j]? + dur(i as i64 - *j as i64))
-                })
-            })
-            .collect()
+        interpolate_pts(&raw, dur)
     }
 
     fn read_unit(&self, v: &VideoTrack, i: usize) -> crate::Result<Vec<u8>> {
@@ -690,6 +682,23 @@ impl MpegSource {
     }
 }
 
+/// Fill missing timestamps from their closest preceding timestamp, or the next one when there is
+/// no predecessor.  The known positions are sorted, so binary search avoids rescanning them for
+/// every missing frame.
+fn interpolate_pts(raw: &[Option<i64>], dur: impl Fn(i64) -> i64) -> Vec<Option<i64>> {
+    let known: Vec<usize> = (0..raw.len()).filter(|&i| raw[i].is_some()).collect();
+    raw.iter()
+        .enumerate()
+        .map(|(i, &pts)| {
+            pts.or_else(|| {
+                let next = known.partition_point(|&j| j < i);
+                let j = next.checked_sub(1).or_else(|| known.get(next).map(|_| next))?;
+                Some(raw[known[j]]? + dur(i as i64 - known[j] as i64))
+            })
+        })
+        .collect()
+}
+
 fn chroma_name(c: filmcraft_frame::Chroma) -> &'static str {
     match c {
         filmcraft_frame::Chroma::C420 => "4:2:0",
@@ -760,10 +769,15 @@ impl VideoSamples for MpegVideo<'_> {
     }
     fn sync_before(&self, i: usize) -> usize {
         let i = i.min(self.v.keys.len().saturating_sub(1));
-        let key = (0..=i).rev().find(|&k| self.v.keys[k]).unwrap_or(0);
+        let keys = &self.v.keys;
+        let pts = &self.v.pts;
         // a leading picture of an open GOP (shown before its random-access picture) needs the
         // previous GOP's pictures as references
-        if key > 0 && self.v.pts[i] < self.v.pts[key] { self.sync_before(key - 1) } else { key }
+        crate::gop::open_gop_sync(
+            i,
+            |i| (0..=i).rev().find(|&k| keys.get(k) == Some(&true)).unwrap_or(0),
+            |i, key| matches!((pts.get(i), pts.get(key)), (Some(a), Some(b)) if a < b),
+        )
     }
     fn sample_at(&self, t: i64) -> Option<usize> {
         usize::try_from(t).ok().and_then(|t| self.v.order.get(t).copied())
@@ -1015,4 +1029,16 @@ mod tests {
         assert_eq!(order, vec![0, 4, 5, 3]);
         assert_eq!(pts, vec![0, -2, -3, 3, 1, 2]);
     }
+
+    #[test]
+    fn timestamp_interpolation_handles_long_missing_runs_without_rescanning() {
+        let mut raw = vec![None; 10_000];
+        raw[4_000] = Some(40_000);
+        raw[9_999] = Some(99_990);
+        let pts = interpolate_pts(&raw, |frames| frames * 10);
+        assert_eq!(pts[0], Some(0));
+        assert_eq!(pts[3_999], Some(39_990));
+        assert_eq!(pts[4_001], Some(40_010));
+        assert_eq!(pts[9_998], Some(99_980));
+    }
 }
diff --git a/crates/codecs/src/mxf.rs b/crates/codecs/src/mxf.rs
index 1b230a8dc..e94aeaa32 100644
--- a/crates/codecs/src/mxf.rs
+++ b/crates/codecs/src/mxf.rs
@@ -330,7 +330,7 @@ impl MxfSource {
         if let Some(&a0) = atracks.first() {
             let si0 = file.tracks[a0].sound.clone().unwrap_or_default();
             let rate = si0.sample_rate;
-            let mut channels = 0;
+            let mut channels: u32 = 0;
             for &ai in &atracks {
                 let t = &file.tracks[ai];
                 let Some(si) = t.sound.as_ref() else { continue };
@@ -342,11 +342,18 @@ impl MxfSource {
                 let stored = t.stored_sample_frames().saturating_sub(first);
                 let presented = t.duration.map_or(stored, |du| ((du as i128 * n as i128 / d.max(1) as i128) as u64).min(stored));
                 aframes = aframes.min(presented);
-                channels += si.channels.max(1);
+                let next =
+                    channels.checked_add(si.channels.max(1)).ok_or_else(|| CodecError::Unsupported("MXF: combined audio channel count overflows".into()))?;
+                if next > filmcraft_media::MAX_AUDIO_CHANNELS {
+                    return Err(CodecError::Unsupported(format!("MXF: combined audio exceeds {} channels", filmcraft_media::MAX_AUDIO_CHANNELS)));
+                }
+                channels = next;
                 combined.push((ai, first));
             }
             let sr = if rate.is_valid() { (rate.num as f64 / rate.den as f64).round() as u32 } else { 48_000 };
-            audio = Some(AudioStreamInfo { sample_rate: sr.max(1), channels, codec: file.tracks[a0].codec.name().into(), bits_per_sample: Some(si0.bits) });
+            if let Ok((sr, channels)) = filmcraft_media::bounded_audio_dimensions(sr, channels) {
+                audio = Some(AudioStreamInfo { sample_rate: sr, channels, codec: file.tracks[a0].codec.name().into(), bits_per_sample: Some(si0.bits) });
+            }
         }
         if aframes == u64::MAX {
             aframes = 0;
@@ -408,10 +415,11 @@ impl VideoSamples for MxfVideo<'_> {
         self.src.vpts[i]
     }
     fn sync_before(&self, i: usize) -> usize {
-        let key = self.src.file.tracks[self.track].sync_before(i);
         // a leading picture of an open GOP (stored after its random-access picture, shown
         // before it) is predicted from the previous GOP too
-        if key > 0 && i < self.src.vpts.len() && self.src.vpts[i] < self.src.vpts[key] { self.sync_before(key - 1) } else { key }
+        let track = &self.src.file.tracks[self.track];
+        let pts = &self.src.vpts;
+        crate::gop::open_gop_sync(i, |i| track.sync_before(i), |i, key| matches!((pts.get(i), pts.get(key)), (Some(a), Some(b)) if a < b))
     }
     fn sample_at(&self, t: i64) -> Option<usize> {
         usize::try_from(t).ok().and_then(|t| self.src.vorder.get(t).copied())
@@ -460,15 +468,20 @@ impl MediaSource for MxfSource {
         let ainfo = self.info.audio().ok_or(MediaError::NoStream("audio"))?;
         let src_rate = ainfo.sample_rate;
         let ch = ainfo.channels.max(1) as usize;
+        let exact = src_rate == sample_rate;
+        let source_frames = if exact { frames } else { filmcraft_media::resample_source_frames(frames, src_rate, sample_rate)? };
+        let need =
+            if exact { source_frames } else { source_frames.checked_add(2).ok_or_else(|| MediaError::Decode("audio source window overflows".into()))? };
+        filmcraft_media::validate_audio_buffer_shape(ch, need)?;
+        filmcraft_media::validate_audio_buffer_shape(ch, frames)?;
         let mut out = AudioBuffer::silence(sample_rate, ch, frames);
         let ratio = src_rate as f64 / sample_rate as f64;
-        let exact = src_rate == sample_rate;
         let s0 = if exact { start } else { (start as f64 * ratio).floor() as i64 };
-        let need = if exact { frames as i64 } else { (frames as f64 * ratio).ceil() as i64 + 2 };
+        let need_i64 = i64::try_from(need).unwrap_or(i64::MAX);
         // clip the request to the presented range [0, aframes)
         let a = s0.max(0);
-        let b = (s0 + need).min(self.aframes as i64);
-        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need.max(0) as usize]; ch];
+        let b = s0.saturating_add(need_i64).min(self.aframes as i64);
+        let mut src: Vec<Vec<f32>> = vec![vec![0.0; need]; ch];
         if b > a {
             let mut c0 = 0;
             for &(ti, first) in &self.atracks {
diff --git a/crates/codecs/src/tests.rs b/crates/codecs/src/tests.rs
index 52af0574c..9c8ea8c19 100644
--- a/crates/codecs/src/tests.rs
+++ b/crates/codecs/src/tests.rs
@@ -236,6 +236,33 @@ fn mp4_flac_audio() {
     assert!(peak > 0.05 && peak < 1.0, "audio peak {peak}");
 }
 
+/// #2340: uncompressed QuickTime video (`raw ` 24-bit RGB, `2vuy`, `v210`) decodes, with fl32
+/// audio, instead of being reported unreadable.
+#[test]
+fn quicktime_uncompressed_video() {
+    let src = ["-f", "lavfi", "-i", "color=c=0x3060C0:s=64x36:r=24:d=0.5", "-f", "lavfi", "-i", "sine=frequency=1000:sample_rate=48000:d=0.5"];
+    for (name, vcodec) in [
+        ("raw_rgb24.mov", ["-c:v", "rawvideo", "-pix_fmt", "rgb24"]),
+        ("raw_2vuy.mov", ["-c:v", "rawvideo", "-pix_fmt", "uyvy422"]),
+        ("raw_v210.mov", ["-c:v", "v210", "-pix_fmt", "yuv422p10le"]),
+    ] {
+        let args: Vec<&str> = src.iter().copied().chain(vcodec).chain(["-c:a", "pcm_f32be", "-shortest"]).collect();
+        let Some(b) = fixture(name, &args) else { return };
+        let src = crate::open_bytes(name, b).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let f = src.video_frame(FrameRequest { time: Tick(TICKS_PER_SECOND / 4), scale: 1.0 }).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!((f.width, f.height), (64, 36), "{name}");
+        assert!(src.info().video.as_ref().is_some_and(|v| v.codec.starts_with("Uncompressed")), "{name}: {:?}", src.info().video);
+        let rgba = f.to_rgba8();
+        let px = &rgba[(18 * 64 + 32) * 4..][..3];
+        for (got, want) in px.iter().zip([0x30u8, 0x60, 0xc0]) {
+            assert!((*got as i32 - want as i32).abs() <= 6, "{name}: {px:?}");
+        }
+        let a = src.audio(12_000, 4800, 48_000).expect("fl32 audio");
+        let peak = a.channels[0].iter().fold(0f32, |m, s| m.max(s.abs()));
+        assert!(peak > 0.05 && peak < 1.0, "{name}: audio peak {peak}");
+    }
+}
+
 #[test]
 fn matroska_prores_pcm() {
     check_mkv("blue_prores_pcm.mkv", &["-c:v", "prores_ks", "-profile:v", "2"], &["-c:a", "pcm_s16le"]);
diff --git a/crates/codecs/src/video.rs b/crates/codecs/src/video.rs
index 28b3f4c66..7a4a2ef55 100644
--- a/crates/codecs/src/video.rs
+++ b/crates/codecs/src/video.rs
@@ -1094,6 +1094,13 @@ fn esds_object_type(raw: &[u8]) -> Option<u8> {
     raw.get(p).copied()
 }
 
+/// Uncompressed QuickTime / MP4 video (`raw ` 24-bit RGB, `2vuy`, `v210`, #2340).
+pub fn raw_factory(e: &SampleEntry) -> Option<Result<Box<dyn VideoDecoder>>> {
+    let v = e.video.as_ref()?;
+    let format = RawFormat::from_mov(e.format.0, v.depth)?;
+    Some(RawVideoDecoder::new(format, u32::from(v.width), u32::from(v.height), false).map(|d| Box::new(d) as Box<dyn VideoDecoder>))
+}
+
 pub fn mpeg2_factory(e: &SampleEntry) -> Option<Result<Box<dyn VideoDecoder>>> {
     match &e.codec {
         CodecConfig::Unknown { fourcc, raw } if is_mpeg2_entry(&fourcc.0, raw) => {
@@ -1168,6 +1175,11 @@ pub enum RawFormat {
     Nv12,
     /// Luma only (`Y800`, `GREY`, `Y8  `).
     Gray8,
+    /// 24-bit R, G, B; rows unpadded (QuickTime `raw ` at depth 24).
+    Rgb24,
+    /// 10-bit 4:2:2 Y'CbCr, six pixels in four little-endian words, rows padded to 128 bytes
+    /// (QuickTime `v210`); shown at 8 bits.
+    V210,
 }
 
 impl RawFormat {
@@ -1193,13 +1205,24 @@ impl RawFormat {
         })
     }
 
+    /// The layout of a QuickTime / MP4 video sample entry (`raw ` RGB at depth 24, `2vuy`, `v210`).
+    pub fn from_mov(fourcc: [u8; 4], depth: u16) -> Option<RawFormat> {
+        match (&fourcc, depth) {
+            (b"raw ", 24) => Some(RawFormat::Rgb24),
+            (b"2vuy", _) => Some(RawFormat::Uyvy),
+            (b"v210", _) => Some(RawFormat::V210),
+            _ => None,
+        }
+    }
+
     pub fn label(self) -> &'static str {
         match self {
-            RawFormat::Bgr24 => "Uncompressed RGB 24-bit",
+            RawFormat::Bgr24 | RawFormat::Rgb24 => "Uncompressed RGB 24-bit",
             RawFormat::Bgrx32 => "Uncompressed RGB 32-bit",
             RawFormat::Yuy2 | RawFormat::Uyvy => "Uncompressed YUV 4:2:2",
             RawFormat::I420 | RawFormat::Yv12 | RawFormat::Nv12 => "Uncompressed YUV 4:2:0",
             RawFormat::Gray8 => "Uncompressed greyscale",
+            RawFormat::V210 => "Uncompressed YUV 4:2:2 10-bit",
         }
     }
 }
@@ -1254,6 +1277,42 @@ impl RawVideoDecoder {
                 }
                 VideoFrame::rgba8(self.width, self.height, rgba)
             }
+            RawFormat::Rgb24 => {
+                let stride = w * 3;
+                if s.len() < stride * h {
+                    return Err(short());
+                }
+                let mut rgba = Vec::with_capacity(w * h * 4);
+                for px in s.get(..stride * h).unwrap_or_default().as_chunks::<3>().0 {
+                    rgba.extend_from_slice(&[px[0], px[1], px[2], 255]);
+                }
+                VideoFrame::rgba8(self.width, self.height, rgba)
+            }
+            RawFormat::V210 => {
+                // 6 pixels per 16 bytes; each row padded to a multiple of 128 bytes (48 pixels)
+                let stride = w.div_ceil(48) * 128;
+                if s.len() < stride * h {
+                    return Err(short());
+                }
+                let (mut y, mut u, mut v) = (Vec::with_capacity(w * h), Vec::with_capacity(cw * h), Vec::with_capacity(cw * h));
+                for row in s.chunks_exact(stride).take(h) {
+                    // the row's 10-bit samples in order: Cb Y Cr Y Cb Y Cr Y …, kept at 8 bits
+                    let mut comps = row.as_chunks::<4>().0.iter().flat_map(|b| {
+                        let word = u32::from_le_bytes(*b);
+                        [word & 0x3ff, (word >> 10) & 0x3ff, (word >> 20) & 0x3ff].map(|c| (c >> 2) as u8)
+                    });
+                    for x in 0..cw {
+                        let (Some(cb), Some(y0), Some(cr), Some(y1)) = (comps.next(), comps.next(), comps.next(), comps.next()) else { break };
+                        u.push(cb);
+                        v.push(cr);
+                        y.push(y0);
+                        if 2 * x + 1 < w {
+                            y.push(y1);
+                        }
+                    }
+                }
+                self.yuv([y, u, v], filmcraft_frame::Chroma::C422)
+            }
             RawFormat::Yuy2 | RawFormat::Uyvy => {
                 let stride = cw * 4;
                 if s.len() < stride * h {
diff --git a/crates/codecs/tests/aac_channels_oracle.rs b/crates/codecs/tests/it/aac_channels_oracle.rs
similarity index 99%
rename from crates/codecs/tests/aac_channels_oracle.rs
rename to crates/codecs/tests/it/aac_channels_oracle.rs
index 5f850ac3e..43bcf6a65 100644
--- a/crates/codecs/tests/aac_channels_oracle.rs
+++ b/crates/codecs/tests/it/aac_channels_oracle.rs
@@ -3,7 +3,7 @@
 //! both 7.1 (eight channels) and 11 is 6.1 (seven). Each channel carries its own tone, so a
 //! dropped or swapped channel shows up against ffmpeg's decode.
 
-mod common;
+use crate::common;
 
 use std::io::Cursor;
 
diff --git a/crates/codecs/tests/adts_file.rs b/crates/codecs/tests/it/adts_file.rs
similarity index 100%
rename from crates/codecs/tests/adts_file.rs
rename to crates/codecs/tests/it/adts_file.rs
diff --git a/crates/codecs/tests/common/mod.rs b/crates/codecs/tests/it/common/mod.rs
similarity index 100%
rename from crates/codecs/tests/common/mod.rs
rename to crates/codecs/tests/it/common/mod.rs
diff --git a/crates/codecs/tests/draft_decoders.rs b/crates/codecs/tests/it/draft_decoders.rs
similarity index 97%
rename from crates/codecs/tests/draft_decoders.rs
rename to crates/codecs/tests/it/draft_decoders.rs
index bec6476f9..2397ad225 100644
--- a/crates/codecs/tests/draft_decoders.rs
+++ b/crates/codecs/tests/it/draft_decoders.rs
@@ -1,8 +1,8 @@
-//! Draft decoding of VP9, HEVC and AV1 through the media stack (as `h264_draft.rs` for H.264):
+//! Draft decoding of H.264, VP9, HEVC and AV1 through the media stack:
 //! off by default, approximate frames only reach draft requests, and decoding for an export after
 //! draft playback (same source, same GOP cache) still matches ffmpeg bit for bit.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_media::FrameRequest;
@@ -50,6 +50,7 @@ fn check(name: &str, args: &[&str], w: usize, h: usize) {
 /// One test (the GOP cache statistics are process-wide, so the codecs run one after another).
 #[test]
 fn draft_playback_never_reaches_exports() {
+    crate::h264_draft::check();
     vp9();
     hevc();
     av1();
diff --git a/crates/codecs/tests/eac3_oracle.rs b/crates/codecs/tests/it/eac3_oracle.rs
similarity index 99%
rename from crates/codecs/tests/eac3_oracle.rs
rename to crates/codecs/tests/it/eac3_oracle.rs
index 7d875d49c..e75476db7 100644
--- a/crates/codecs/tests/eac3_oracle.rs
+++ b/crates/codecs/tests/it/eac3_oracle.rs
@@ -2,7 +2,7 @@
 //! and muxes the files and decodes them as the oracle. Zero-bit mantissas carry decoder-specific
 //! dither (A/52 §7.3.4), so the criterion is SNR against ffmpeg's decode, sample-aligned.
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/codecs/tests/frame_color_oracle.rs b/crates/codecs/tests/it/frame_color_oracle.rs
similarity index 99%
rename from crates/codecs/tests/frame_color_oracle.rs
rename to crates/codecs/tests/it/frame_color_oracle.rs
index 7da3baf09..15740fc3e 100644
--- a/crates/codecs/tests/frame_color_oracle.rs
+++ b/crates/codecs/tests/it/frame_color_oracle.rs
@@ -2,7 +2,7 @@
 //! MP4 without a `colr` box unless asked, so for most files the bitstream is the only place the
 //! primaries are described: stream info already read them, the decoded frames reported BT.709.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_color::{ColorInfo, ColorSpace, Matrix, Primaries, Range, Transfer};
diff --git a/crates/codecs/tests/h264_draft.rs b/crates/codecs/tests/it/h264_draft.rs
similarity index 93%
rename from crates/codecs/tests/h264_draft.rs
rename to crates/codecs/tests/it/h264_draft.rs
index 81e8c3bb8..1061f17ab 100644
--- a/crates/codecs/tests/h264_draft.rs
+++ b/crates/codecs/tests/it/h264_draft.rs
@@ -2,14 +2,15 @@
 //! by default, its approximate frames only ever reach draft requests, and decoding for an export
 //! after draft playback (same source, same GOP cache) still matches ffmpeg bit for bit.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_media::FrameRequest;
 use filmcraft_media::cancel::with_draft;
 
-#[test]
-fn draft_playback_never_reaches_exports() {
+/// Verify H.264 default, draft and export decoding against ffmpeg.
+/// Called by the shared draft-codec test because GOP statistics are process-wide.
+pub(super) fn check() {
     let ff = filmcraft_testkit::require_ffmpeg!();
     // B-pyramid: references and non-reference B pictures (the ones draft mode leaves unfiltered)
     let Some(file) = fixture(
diff --git a/crates/codecs/tests/it/main.rs b/crates/codecs/tests/it/main.rs
new file mode 100644
index 000000000..679dcaa6b
--- /dev/null
+++ b/crates/codecs/tests/it/main.rs
@@ -0,0 +1,17 @@
+mod aac_channels_oracle;
+mod adts_file;
+mod common;
+mod draft_decoders;
+mod eac3_oracle;
+mod frame_color_oracle;
+mod h264_draft;
+mod matroska_audio_oracle;
+mod media_oracle;
+mod mkv_mp1_oracle;
+mod mp4_oracle;
+mod mp4_rtmd;
+mod mpeg_oracle;
+mod mxf_oracle;
+mod ogg_oracle;
+mod rf64_metadata;
+mod y4m_file;
diff --git a/crates/codecs/tests/matroska_audio_oracle.rs b/crates/codecs/tests/it/matroska_audio_oracle.rs
similarity index 99%
rename from crates/codecs/tests/matroska_audio_oracle.rs
rename to crates/codecs/tests/it/matroska_audio_oracle.rs
index 3ded7af07..c2cfbd45e 100644
--- a/crates/codecs/tests/matroska_audio_oracle.rs
+++ b/crates/codecs/tests/it/matroska_audio_oracle.rs
@@ -4,7 +4,7 @@
 //! reads it, a tone must stay as smooth as ffmpeg's decode of it: no holes or overlaps between
 //! packets.
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/codecs/tests/media_oracle.rs b/crates/codecs/tests/it/media_oracle.rs
similarity index 99%
rename from crates/codecs/tests/media_oracle.rs
rename to crates/codecs/tests/it/media_oracle.rs
index da95c5eb6..5091c1dc3 100644
--- a/crates/codecs/tests/media_oracle.rs
+++ b/crates/codecs/tests/it/media_oracle.rs
@@ -4,7 +4,7 @@
 //! exactly, JPEG within a few levels, high bit depths within one 8-bit step), and the BWF
 //! TimeReference must give the start timecode.
 
-mod common;
+use crate::common;
 
 use std::path::Path;
 use std::sync::Arc;
diff --git a/crates/codecs/tests/mkv_mp1_oracle.rs b/crates/codecs/tests/it/mkv_mp1_oracle.rs
similarity index 99%
rename from crates/codecs/tests/mkv_mp1_oracle.rs
rename to crates/codecs/tests/it/mkv_mp1_oracle.rs
index 05d9810fb..aa142457c 100644
--- a/crates/codecs/tests/mkv_mp1_oracle.rs
+++ b/crates/codecs/tests/it/mkv_mp1_oracle.rs
@@ -2,7 +2,7 @@
 //! installed encoder writes Layer I, so the frames are synthetic (valid random Layer I frames,
 //! as in `crates/mpa/tests/oracle.rs`) and ffmpeg only remuxes them into Matroska and decodes.
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/codecs/tests/mp4_oracle.rs b/crates/codecs/tests/it/mp4_oracle.rs
similarity index 99%
rename from crates/codecs/tests/mp4_oracle.rs
rename to crates/codecs/tests/it/mp4_oracle.rs
index cbb71ba0e..892598daf 100644
--- a/crates/codecs/tests/mp4_oracle.rs
+++ b/crates/codecs/tests/it/mp4_oracle.rs
@@ -2,7 +2,7 @@
 //! priming), and reads at another sample rate must land on the same source samples as the native
 //! decode, however the requests are cut.
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/codecs/tests/mp4_rtmd.rs b/crates/codecs/tests/it/mp4_rtmd.rs
similarity index 100%
rename from crates/codecs/tests/mp4_rtmd.rs
rename to crates/codecs/tests/it/mp4_rtmd.rs
diff --git a/crates/codecs/tests/mpeg_oracle.rs b/crates/codecs/tests/it/mpeg_oracle.rs
similarity index 99%
rename from crates/codecs/tests/mpeg_oracle.rs
rename to crates/codecs/tests/it/mpeg_oracle.rs
index e6d5a39dd..bf58294e8 100644
--- a/crates/codecs/tests/mpeg_oracle.rs
+++ b/crates/codecs/tests/it/mpeg_oracle.rs
@@ -4,7 +4,7 @@
 //! random seeks give the frames of the sequential decode. Audio: LPCM sample-exact, MPEG audio
 //! and AAC within a float-decoder tolerance, starting at the same sample.
 
-mod common;
+use crate::common;
 
 use std::path::{Path, PathBuf};
 
diff --git a/crates/codecs/tests/mxf_oracle.rs b/crates/codecs/tests/it/mxf_oracle.rs
similarity index 99%
rename from crates/codecs/tests/mxf_oracle.rs
rename to crates/codecs/tests/it/mxf_oracle.rs
index 5a965b814..23d882755 100644
--- a/crates/codecs/tests/mxf_oracle.rs
+++ b/crates/codecs/tests/it/mxf_oracle.rs
@@ -2,7 +2,7 @@
 //! oracle. Our decode must match frame for frame (H.264 bit-exact, VC-3 ±2, ProRes ±1 LSB), seek
 //! to random frames exactly, and give sample-exact PCM.
 
-mod common;
+use crate::common;
 
 use std::path::{Path, PathBuf};
 
diff --git a/crates/codecs/tests/ogg_oracle.rs b/crates/codecs/tests/it/ogg_oracle.rs
similarity index 99%
rename from crates/codecs/tests/ogg_oracle.rs
rename to crates/codecs/tests/it/ogg_oracle.rs
index 939407756..be02870ed 100644
--- a/crates/codecs/tests/ogg_oracle.rs
+++ b/crates/codecs/tests/it/ogg_oracle.rs
@@ -4,7 +4,7 @@
 //! `filmcraft-opus`'s own oracle; Vorbis: SNR ≥ 60 dB), and any random window must equal the
 //! continuous decode (granule-position seeking with pre-roll).
 
-mod common;
+use crate::common;
 
 use std::path::{Path, PathBuf};
 
diff --git a/crates/codecs/tests/rf64_metadata.rs b/crates/codecs/tests/it/rf64_metadata.rs
similarity index 100%
rename from crates/codecs/tests/rf64_metadata.rs
rename to crates/codecs/tests/it/rf64_metadata.rs
diff --git a/crates/codecs/tests/y4m_file.rs b/crates/codecs/tests/it/y4m_file.rs
similarity index 100%
rename from crates/codecs/tests/y4m_file.rs
rename to crates/codecs/tests/it/y4m_file.rs
diff --git a/crates/codecs/tests/pool_bitexact.rs b/crates/codecs/tests/pool_bitexact.rs
index a90ec658e..1261e9a2b 100644
--- a/crates/codecs/tests/pool_bitexact.rs
+++ b/crates/codecs/tests/pool_bitexact.rs
@@ -3,6 +3,7 @@
 //! primed with buffers full of 0xAA before decoding, and every frame must still match ffmpeg bit
 //! for bit. (Its own process: the pool is global.)
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use std::sync::Arc;
diff --git a/crates/color/README.md b/crates/color/README.md
index 32c3edee8..e78774322 100644
--- a/crates/color/README.md
+++ b/crates/color/README.md
@@ -38,6 +38,8 @@ for limited- and full-range files.
 | ARRI LogC4 | ARRI Wide Gamut 4 | ARRI, *ARRI LogC4 Logarithmic Color Space — Specification* (2022) | CV | a = (2¹⁸ − 16)/117.45, b = 928/1023, c = 95/1023, s = 7·ln2·2^(7 − 14c/b)/(a·b), t = (2^(6 − 14c/b) − 64)/a; y ≥ 0: x = (2^(14(y − c)/b + 6) − 64)/a; else x = y·s + t |
 | Apple Log | BT.2020 | Apple, *Apple Log Profile* white paper (2023) | IRE | R0 = −0.05641088, Rt = 0.01, c = 47.28711236, β = 0.00964052, γ = 0.08550479, δ = 0.69336945; P ≥ c(Rt − R0)²: x = 2^((P − δ)/γ) − β; else x = √(P/c) + R0 |
 | DJI D-Log | D-Gamut | DJI, *White Paper on D-Log and D-Gamut of DJI Cinema Color System* (2017) | CV | y ≤ 0.14: x = (y − 0.0929)/6.025; else x = (10^(3.89616y − 2.27752) − 0.0108)/0.9892 |
+| Fujifilm F-Log | F-Gamut (= BT.2020 primaries) | Fujifilm, *GFX ETERNA Technical Guide – White Paper* v1.01 (2026), F-Log conversion formula (same as the F-Log data sheet) | CV | y ≥ cut2: x = 10^((y − d)/c)/a − b/a; else x = (y − f)/e; a 0.555556, b 0.009468, c 0.344676, d 0.790453, e 8.735631, f 0.092864, cut1 0.00089, cut2 0.100537775223865 |
+| Fujifilm F-Log2 / F-Log2 C | F-Gamut / F-Gamut C (R 0.7347, 0.2653; G 0.0263, 0.9737; B 0.1173, −0.0224) | same document, F-Log2 C / F-Log2 conversion formula | CV | same form; a 5.555556, b 0.064829, c 0.245281, d 0.384316, e 8.799461, f 0.092864, cut1 0.000889, cut2 0.100686685370811 |
 
 The encoders are the exact inverses given in the same documents. DJI **D-Log M** is not
 implemented: DJI has not published its formula (only conversion LUTs), and we do not derive curves
diff --git a/crates/color/src/lib.rs b/crates/color/src/lib.rs
index ce3340162..0c271a3a8 100644
--- a/crates/color/src/lib.rs
+++ b/crates/color/src/lib.rs
@@ -296,7 +296,11 @@ pub fn hsl_to_rgb(h: f32, s: f32, l: f32) -> [f32; 3] {
 
 /// Parse `#rrggbb` / `#rrggbbaa` into 0..1 floats.
 pub fn parse_hex(s: &str) -> Option<[f32; 4]> {
-    let s = s.trim().trim_start_matches('#');
+    let s = s.trim();
+    let s = s.strip_prefix('#').unwrap_or(s);
+    if !s.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
     let b = |i: usize| u8::from_str_radix(s.get(i..i + 2)?, 16).ok().map(|v| v as f32 / 255.0);
     match s.len() {
         6 => Some([b(0)?, b(2)?, b(4)?, 1.0]),
@@ -318,6 +322,16 @@ pub fn to_hex(c: [f32; 4]) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn parse_hex_rejects_signs() {
+        assert_eq!(parse_hex("#+f+f+f"), None);
+        assert_eq!(parse_hex("#-f-f-f"), None);
+        assert_eq!(parse_hex("##0f0f0f"), None);
+        assert_eq!(parse_hex("#0f0f0"), None);
+        assert!(parse_hex("#0f0f0f").is_some());
+        assert!(parse_hex("0f0f0f80").is_some());
+    }
+
     #[test]
     fn ycbcr_roundtrip() {
         for m in [Matrix::Bt601, Matrix::Bt709, Matrix::Bt2020Ncl] {
diff --git a/crates/color/src/log.rs b/crates/color/src/log.rs
index 7fd23afa8..ec5967518 100644
--- a/crates/color/src/log.rs
+++ b/crates/color/src/log.rs
@@ -42,11 +42,25 @@ pub enum LogCurve {
     AppleLog,
     /// DJI D-Log.
     DLog,
+    /// Fujifilm F-Log.
+    FLog,
+    /// Fujifilm F-Log2 (also the curve of F-Log2 C).
+    FLog2,
 }
 
 impl LogCurve {
-    pub const ALL: [LogCurve; 8] =
-        [LogCurve::SLog3, LogCurve::VLog, LogCurve::CLog2, LogCurve::CLog3, LogCurve::LogC3, LogCurve::LogC4, LogCurve::AppleLog, LogCurve::DLog];
+    pub const ALL: [LogCurve; 10] = [
+        LogCurve::SLog3,
+        LogCurve::VLog,
+        LogCurve::CLog2,
+        LogCurve::CLog3,
+        LogCurve::LogC3,
+        LogCurve::LogC4,
+        LogCurve::AppleLog,
+        LogCurve::DLog,
+        LogCurve::FLog,
+        LogCurve::FLog2,
+    ];
 
     pub fn domain(self) -> Domain {
         match self {
@@ -65,6 +79,8 @@ impl LogCurve {
             LogCurve::LogC4 => "ARRI LogC4",
             LogCurve::AppleLog => "Apple Log",
             LogCurve::DLog => "DJI D-Log",
+            LogCurve::FLog => "Fujifilm F-Log",
+            LogCurve::FLog2 => "Fujifilm F-Log2",
         }
     }
 
@@ -79,6 +95,8 @@ impl LogCurve {
             LogCurve::LogC4 => logc4_encode(x),
             LogCurve::AppleLog => apple_log_encode(x),
             LogCurve::DLog => dlog_encode(x),
+            LogCurve::FLog => fujifilm_encode(&FLOG, x),
+            LogCurve::FLog2 => fujifilm_encode(&FLOG2, x),
         }
     }
 
@@ -93,6 +111,8 @@ impl LogCurve {
             LogCurve::LogC4 => logc4_decode(y),
             LogCurve::AppleLog => apple_log_decode(y),
             LogCurve::DLog => dlog_decode(y),
+            LogCurve::FLog => fujifilm_decode(&FLOG, y),
+            LogCurve::FLog2 => fujifilm_decode(&FLOG2, y),
         }
     }
 
@@ -262,6 +282,35 @@ pub fn dlog_decode(y: f64) -> f64 {
     if y <= 0.14 { (y - 0.0929) / 6.025 } else { (10f64.powf(3.896_16 * y - 2.277_52) - 0.0108) / 0.9892 }
 }
 
+// ---------------------------------------------------------------- Fujifilm F-Log / F-Log2
+// Fujifilm, "GFX ETERNA Technical Guide - White Paper" v1.01 (2026), F-Log / F-Log2 C / F-Log2
+// conversion formulas (the same as the F-Log and F-Log2 data sheets). `in` is scene-linear
+// reflection, `out` 10-bit code value / 1023: 0 % → 95, 18 % → 470 (F-Log) / 400 (F-Log2).
+
+/// a, b, c, d, e, f, cut1 (encoding: scene-linear), cut2 (decoding: signal).
+struct Fujifilm {
+    a: f64,
+    b: f64,
+    c: f64,
+    d: f64,
+    e: f64,
+    f: f64,
+    cut1: f64,
+    cut2: f64,
+}
+
+const FLOG: Fujifilm =
+    Fujifilm { a: 0.555_556, b: 0.009_468, c: 0.344_676, d: 0.790_453, e: 8.735_631, f: 0.092_864, cut1: 0.000_89, cut2: 0.100_537_775_223_865 };
+const FLOG2: Fujifilm =
+    Fujifilm { a: 5.555_556, b: 0.064_829, c: 0.245_281, d: 0.384_316, e: 8.799_461, f: 0.092_864, cut1: 0.000_889, cut2: 0.100_686_685_370_811 };
+
+fn fujifilm_encode(k: &Fujifilm, x: f64) -> f64 {
+    if x >= k.cut1 { k.c * (k.a * x + k.b).log10() + k.d } else { k.e * x + k.f }
+}
+fn fujifilm_decode(k: &Fujifilm, y: f64) -> f64 {
+    if y >= k.cut2 { 10f64.powf((y - k.d) / k.c) / k.a - k.b / k.a } else { (y - k.f) / k.e }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -317,6 +366,16 @@ mod tests {
         // DJI D-Log: 0 → 0.0929, 18 % → 0.398 (white paper).
         close(LogCurve::DLog.encode(0.0), 0.0929, 1e-9, "D-Log 0");
         close(LogCurve::DLog.encode(0.18), 0.398, 0.002, "D-Log 18%");
+        // Fujifilm (white paper code-value table): 0 % → 95, 18 % → 470 / 400, 90 % → 705 / 570.
+        close(cv(LogCurve::FLog, 0.0), 95.0, 0.5, "F-Log 0%");
+        close(cv(LogCurve::FLog, 0.18), 470.0, 0.5, "F-Log 18%");
+        close(cv(LogCurve::FLog, 0.9), 705.0, 0.6, "F-Log 90%");
+        close(cv(LogCurve::FLog2, 0.0), 95.0, 0.5, "F-Log2 0%");
+        close(cv(LogCurve::FLog2, 0.18), 400.0, 0.5, "F-Log2 18%");
+        close(cv(LogCurve::FLog2, 0.9), 570.0, 0.5, "F-Log2 90%");
+        // the decoding cut is where the encoding's two pieces meet (within the published rounding)
+        close(LogCurve::FLog.encode(0.000_89), 0.100_537_775_223_865, 2e-4, "F-Log cut");
+        close(LogCurve::FLog2.encode(0.000_889), 0.100_686_685_370_811, 2e-4, "F-Log2 cut");
     }
 
     #[test]
diff --git a/crates/color/src/lut.rs b/crates/color/src/lut.rs
index 67590eb12..d2d1d4e75 100644
--- a/crates/color/src/lut.rs
+++ b/crates/color/src/lut.rs
@@ -226,7 +226,14 @@ impl Lut {
                     return Err(err("keyword after table data"));
                 }
                 match key {
-                    "TITLE" => title = line[5..].trim().trim_matches('"').to_string(),
+                    "TITLE" => {
+                        // a '#' inside a quoted title is part of the title, not a comment
+                        let rest = raw.trim_start()[5..].trim_start();
+                        title = match rest.strip_prefix('"').and_then(|q| q.split_once('"')) {
+                            Some((t, _)) => t.to_string(),
+                            None => line[5..].trim().trim_matches('"').to_string(),
+                        };
+                    }
                     "LUT_1D_SIZE" => {
                         size1 = it.next().and_then(|v| v.parse().ok()).ok_or_else(|| err("bad LUT_1D_SIZE"))?;
                         if !(2..=65536).contains(&size1) {
@@ -308,7 +315,11 @@ impl Lut {
         if let Some(sh) = &self.shaper {
             let _ = writeln!(s, "LUT_1D_SIZE {}", sh.size());
             if both {
-                if sh.domain_min != [0.0; 3] || sh.domain_max != [1.0; 3] {
+                let uniform = sh.domain_min.iter().all(|v| *v == sh.domain_min[0]) && sh.domain_max.iter().all(|v| *v == sh.domain_max[0]);
+                if !uniform {
+                    // with both tables, DOMAIN_MIN/DOMAIN_MAX belong to the shaper
+                    write_domain(&mut s, sh.domain_min, sh.domain_max);
+                } else if sh.domain_min != [0.0; 3] || sh.domain_max != [1.0; 3] {
                     let _ = writeln!(s, "LUT_1D_INPUT_RANGE {} {}", sh.domain_min[0], sh.domain_max[0]);
                 }
             } else {
@@ -555,6 +566,15 @@ mod tests {
         }
     }
 
+    #[test]
+    fn cube_title_with_hash_roundtrips() {
+        let mut c = Lut3d::identity(2);
+        c.title = "Look #2".into();
+        assert_eq!(Lut3d::parse_cube(&c.to_cube()).unwrap().title, "Look #2");
+        let text = c.to_cube().replace("TITLE \"Look #2\"", "TITLE \"Look\" # note");
+        assert_eq!(Lut::parse_cube(&text).unwrap().title, "Look");
+    }
+
     #[test]
     fn cube_roundtrip_3d_1d_and_shaper() {
         let mut c = wild(17);
@@ -650,4 +670,16 @@ mod tests {
         let mesh257 = (0..257).map(|i| i.to_string()).collect::<Vec<_>>().join(" ") + "\n";
         assert!(Lut::parse_3dl(&mesh257).is_err());
     }
+
+    #[test]
+    fn cube_shaper_per_channel_domain_round_trips() {
+        let mut text = String::from("LUT_1D_SIZE 2\nLUT_3D_SIZE 2\nDOMAIN_MAX 1 2 3\n");
+        for _ in 0..10 {
+            text.push_str("0 0 0\n");
+        }
+        let a = Lut::parse_cube(&text).unwrap();
+        assert_eq!(a.shaper.as_ref().unwrap().domain_max, [1.0, 2.0, 3.0]);
+        let b = Lut::parse_cube(&a.to_cube()).unwrap();
+        assert_eq!(b.shaper.unwrap().domain_max, [1.0, 2.0, 3.0]);
+    }
 }
diff --git a/crates/color/src/spaces.rs b/crates/color/src/spaces.rs
index 0dd93f271..e4a994df1 100644
--- a/crates/color/src/spaces.rs
+++ b/crates/color/src/spaces.rs
@@ -34,6 +34,8 @@ pub enum Gamut {
     Awg4,
     /// DJI D-Gamut.
     DGamut,
+    /// Fujifilm F-Gamut C (F-Log2 C). F-Gamut itself has the BT.2020 primaries.
+    FGamutC,
 }
 
 impl Gamut {
@@ -51,6 +53,7 @@ impl Gamut {
             Gamut::Awg3 => [[0.6840, 0.3130], [0.2210, 0.8480], [0.0861, -0.1020]],
             Gamut::Awg4 => [[0.7347, 0.2653], [0.1424, 0.8576], [0.0991, -0.0308]],
             Gamut::DGamut => [[0.71, 0.31], [0.21, 0.88], [0.09, -0.08]],
+            Gamut::FGamutC => [[0.7347, 0.2653], [0.0263, 0.9737], [0.1173, -0.0224]],
         }
     }
 
@@ -165,12 +168,18 @@ pub enum ColorSpace {
     /// Apple Log (BT.2020 primaries).
     AppleLog,
     DLogDGamut,
+    /// Fujifilm F-Log / F-Gamut (BT.2020 primaries).
+    FLogFGamut,
+    /// Fujifilm F-Log2 / F-Gamut (BT.2020 primaries).
+    FLog2FGamut,
+    /// Fujifilm F-Log2 C / F-Gamut C.
+    FLog2CFGamutC,
     /// Linear light with BT.709 primaries (EXR-style float sources).
     Linear709,
 }
 
 impl ColorSpace {
-    pub const ALL: [ColorSpace; 16] = [
+    pub const ALL: [ColorSpace; 19] = [
         ColorSpace::Rec709,
         ColorSpace::Srgb,
         ColorSpace::Rec2020,
@@ -186,6 +195,9 @@ impl ColorSpace {
         ColorSpace::LogC4Awg4,
         ColorSpace::AppleLog,
         ColorSpace::DLogDGamut,
+        ColorSpace::FLogFGamut,
+        ColorSpace::FLog2FGamut,
+        ColorSpace::FLog2CFGamutC,
         ColorSpace::Linear709,
     ];
 
@@ -207,6 +219,9 @@ impl ColorSpace {
             ColorSpace::LogC4Awg4 => "logc4-awg4",
             ColorSpace::AppleLog => "applelog",
             ColorSpace::DLogDGamut => "dlog-dgamut",
+            ColorSpace::FLogFGamut => "flog-fgamut",
+            ColorSpace::FLog2FGamut => "flog2-fgamut",
+            ColorSpace::FLog2CFGamutC => "flog2c-fgamutc",
             ColorSpace::Linear709 => "linear709",
         }
     }
@@ -228,6 +243,9 @@ impl ColorSpace {
             ColorSpace::LogC4Awg4 => "ARRI LogC4 / ARRI Wide Gamut 4",
             ColorSpace::AppleLog => "Apple Log / Rec. 2020",
             ColorSpace::DLogDGamut => "DJI D-Log / D-Gamut",
+            ColorSpace::FLogFGamut => "Fujifilm F-Log / F-Gamut",
+            ColorSpace::FLog2FGamut => "Fujifilm F-Log2 / F-Gamut",
+            ColorSpace::FLog2CFGamutC => "Fujifilm F-Log2 C / F-Gamut C",
             ColorSpace::Linear709 => "Linear (Rec. 709 primaries)",
         }
     }
@@ -242,7 +260,9 @@ impl ColorSpace {
     pub fn gamut(self) -> Gamut {
         match self {
             ColorSpace::Rec709 | ColorSpace::Srgb | ColorSpace::Linear709 => Gamut::Bt709,
-            ColorSpace::Rec2020 | ColorSpace::Rec2100Pq | ColorSpace::Rec2100Hlg | ColorSpace::AppleLog => Gamut::Bt2020,
+            ColorSpace::Rec2020 | ColorSpace::Rec2100Pq | ColorSpace::Rec2100Hlg | ColorSpace::AppleLog | ColorSpace::FLogFGamut | ColorSpace::FLog2FGamut => {
+                Gamut::Bt2020
+            }
             ColorSpace::P3D65 => Gamut::P3D65,
             ColorSpace::SLog3SGamut3Cine => Gamut::SGamut3Cine,
             ColorSpace::SLog3SGamut3 => Gamut::SGamut3,
@@ -251,6 +271,7 @@ impl ColorSpace {
             ColorSpace::LogC3Awg3 => Gamut::Awg3,
             ColorSpace::LogC4Awg4 => Gamut::Awg4,
             ColorSpace::DLogDGamut => Gamut::DGamut,
+            ColorSpace::FLog2CFGamutC => Gamut::FGamutC,
         }
     }
 
@@ -269,6 +290,8 @@ impl ColorSpace {
             ColorSpace::LogC4Awg4 => Curve::Log(LogCurve::LogC4),
             ColorSpace::AppleLog => Curve::Log(LogCurve::AppleLog),
             ColorSpace::DLogDGamut => Curve::Log(LogCurve::DLog),
+            ColorSpace::FLogFGamut => Curve::Log(LogCurve::FLog),
+            ColorSpace::FLog2FGamut | ColorSpace::FLog2CFGamutC => Curve::Log(LogCurve::FLog2),
         }
     }
 
diff --git a/crates/dng/README.md b/crates/dng/README.md
index 4c2b1e7e9..c8678c1d3 100644
--- a/crates/dng/README.md
+++ b/crates/dng/README.md
@@ -73,14 +73,14 @@ restart intervals that split a line, and MXF-wrapped CinemaDNG.
 
 ## Tests
 
-- `tests/roundtrip.rs`: container parsing in both byte orders with and without a preview IFD;
+- `tests/it/roundtrip.rs`: container parsing in both byte orders with and without a preview IFD;
   uncompressed samples bit-exact at 8–16 bits, strips and tiles; lossless JPEG bit-exact for every
   predictor and component count, full-swing 16-bit data (every difference category, SSSS = 16),
   restarts and point transform; developed values against hand-computed ones (black / white,
   white balance, ForwardMatrix, BaselineExposure, ActiveArea, DefaultCrop, LinearRaw); CinemaDNG
   FrameRate / TimeCodes / ReelName; hostile files (every truncation, 12 000 mutations under
   `catch_unwind`, cyclic IFDs, huge sizes, bad offsets, zero denominators).
-- `tests/oracle_libraw.rs`: LibRaw's `unprocessed_raw` reads the same samples from our synthetic
+- `tests/it/oracle_libraw.rs`: LibRaw's `unprocessed_raw` reads the same samples from our synthetic
   files (uncompressed 8–16-bit in both byte orders, lossless JPEG predictors 1–7 with one and two
   components). Skipped when it is not installed.
 - Unit tests: matrix maths, the published sRGB matrix, McCamy temperatures, calibration
diff --git a/crates/dng/src/ljpeg.rs b/crates/dng/src/ljpeg.rs
index e76dbd707..31f357f48 100644
--- a/crates/dng/src/ljpeg.rs
+++ b/crates/dng/src/ljpeg.rs
@@ -311,7 +311,7 @@ pub fn decode(data: &[u8], max_samples: usize) -> Result<Decoded> {
                 }
                 let mut hufs = Vec::with_capacity(comps.len());
                 for c in &comps {
-                    hufs.push(tables.get(c.table).and_then(|t| t.as_ref()).ok_or(Error::Malformed("lossless JPEG: missing Huffman table"))?);
+                    hufs.push(tables.get(c.table).and_then(Option::as_ref).ok_or(Error::Malformed("lossless JPEG: missing Huffman table"))?);
                 }
                 let samples = scan(data, pos + len, &hufs, width, height, precision, predictor, pt, restart_interval)?;
                 return Ok(Decoded { width, height, components: comps.len(), precision, predictor, samples });
diff --git a/crates/dng/src/raw.rs b/crates/dng/src/raw.rs
index b1c448ffc..4e69e0944 100644
--- a/crates/dng/src/raw.rs
+++ b/crates/dng/src/raw.rs
@@ -1,14 +1,14 @@
 //! The raw image data of a DNG: finding the main raw IFD, and reading its strips or tiles
 //! (uncompressed or lossless JPEG) into one array of 16-bit samples.
 
-#[cfg(feature = "threads")]
-use rayon::prelude::*;
-
 use crate::tiff::{Ifd, Tiff, tags};
 use crate::{Error, Result, ljpeg};
 
 /// Largest raw image decoded, in samples (width × height × samples per pixel).
 pub const MAX_SAMPLES: usize = 1 << 27;
+/// Decoded tiles are padded to tile boundaries, so their aggregate can exceed the useful image.
+/// Keep that temporary work within the same bound as a complete decoded raw frame.
+const MAX_DECODED_TILE_SAMPLES: usize = MAX_SAMPLES;
 
 /// Photometric interpretations of DNG raw data.
 pub const PHOTOMETRIC_CFA: u64 = 32803;
@@ -225,23 +225,23 @@ pub fn read(t: &Tiff, ifd: &Ifd) -> Result<RawImage> {
     if total / 8 > coded {
         return Err(Error::Truncated);
     }
+    let mut decoded_samples = 0usize;
     for c in &chunks {
         let n = c.w.checked_mul(c.h).and_then(|v| v.checked_mul(spp)).ok_or(Error::TooLarge)?;
-        if n > MAX_SAMPLES {
+        decoded_samples = decoded_samples.checked_add(n).ok_or(Error::TooLarge)?;
+        if n > MAX_SAMPLES || decoded_samples > MAX_DECODED_TILE_SAMPLES {
             return Err(Error::TooLarge);
         }
         if n / 8 > c.bytes.len() {
             return Err(Error::Truncated);
         }
     }
-    #[cfg(feature = "threads")]
-    let decoded: Vec<Result<Vec<u16>>> = chunks.par_iter().map(|c| decode_chunk(c, &l, t.big_endian)).collect();
-    #[cfg(not(feature = "threads"))]
-    let decoded: Vec<Result<Vec<u16>>> = chunks.iter().map(|c| decode_chunk(c, &l, t.big_endian)).collect();
     let mut data = vec![0u16; total];
     let row_len = l.width * spp;
-    for (c, d) in chunks.iter().zip(decoded) {
-        let d = d?;
+    for c in &chunks {
+        // Copy each padded tile immediately. Retaining every decoded tile until assembly lets
+        // repeated ranges multiply memory beyond the final raw frame's bounded allocation.
+        let d = decode_chunk(c, &l, t.big_endian)?;
         let cw = c.w.min(l.width - c.x);
         let ch = c.h.min(l.height - c.y);
         for r in 0..ch {
diff --git a/crates/dng/src/tiff.rs b/crates/dng/src/tiff.rs
index ba479649c..1e8e79c42 100644
--- a/crates/dng/src/tiff.rs
+++ b/crates/dng/src/tiff.rs
@@ -5,12 +5,16 @@
 //! outside the file is an error when it is read, the walk visits at most [`MAX_IFDS`] directories,
 //! never the same one twice (cyclic chains end), and goes at most [`MAX_DEPTH`] SubIFD levels deep.
 
+use std::collections::HashSet;
+
 use crate::{Error, Result};
 
 /// Most IFDs one file may have (main chain and SubIFDs together).
 pub const MAX_IFDS: usize = 64;
 /// Deepest SubIFD nesting followed.
 pub const MAX_DEPTH: usize = 4;
+/// Invalid SubIFD edges count too: otherwise a file can make failed offset probes quadratic.
+const MAX_IFD_ATTEMPTS: usize = MAX_IFDS * 16;
 
 /// TIFF field types (TIFF 6.0 §2, plus type 13 IFD from TIFF Technical Note 1).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -156,18 +160,22 @@ impl<'a> Tiff<'a> {
     /// each. Bounded by [`MAX_IFDS`] and [`MAX_DEPTH`]; a directory reached twice ends that branch.
     pub fn all_ifds(&self, first: u64) -> Result<Vec<Ifd>> {
         let mut out: Vec<Ifd> = Vec::new();
-        let mut seen: Vec<u64> = Vec::new();
+        let mut seen = HashSet::new();
+        let mut attempts = 0usize;
         let mut stack: Vec<(u64, usize)> = vec![(first, 0)];
         while let Some((off, depth)) = stack.pop() {
             let mut next = off;
             while next != 0 {
-                if seen.contains(&next) {
+                if !seen.insert(next) {
                     break;
                 }
+                attempts += 1;
+                if attempts > MAX_IFD_ATTEMPTS {
+                    return Err(Error::Malformed("too many IFD offsets"));
+                }
                 if out.len() >= MAX_IFDS {
                     return Err(Error::Malformed("too many IFDs"));
                 }
-                seen.push(next);
                 let (ifd, after) = match self.read_ifd(next, depth) {
                     Ok(x) => x,
                     // a broken directory ends the chain; the first one must be readable
diff --git a/crates/dng/tests/it/main.rs b/crates/dng/tests/it/main.rs
new file mode 100644
index 000000000..fd498d961
--- /dev/null
+++ b/crates/dng/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod oracle_libraw;
+mod roundtrip;
diff --git a/crates/dng/tests/oracle_libraw.rs b/crates/dng/tests/it/oracle_libraw.rs
similarity index 100%
rename from crates/dng/tests/oracle_libraw.rs
rename to crates/dng/tests/it/oracle_libraw.rs
diff --git a/crates/dng/tests/roundtrip.rs b/crates/dng/tests/it/roundtrip.rs
similarity index 100%
rename from crates/dng/tests/roundtrip.rs
rename to crates/dng/tests/it/roundtrip.rs
diff --git a/crates/dnx/README.md b/crates/dnx/README.md
index 596ea9fa2..9f4656817 100644
--- a/crates/dnx/README.md
+++ b/crates/dnx/README.md
@@ -59,7 +59,7 @@ first frame header to label the stream.
   12-bit coefficient domain is ¼ of the orthonormal DCT, as Table 14's 13-bit IDCT input range
   for 12-bit samples implies) and 1 otherwise.
 - Robustness: every offset and size is validated, run lengths past coefficient 63 are rejected,
-  and corrupted or truncated streams return `Err` without panicking (`tests/roundtrip.rs`).
+  and corrupted or truncated streams return `Err` without panicking (`tests/it/roundtrip.rs`).
 
 ### Where we follow ffmpeg rather than the letter of the standard
 
@@ -100,7 +100,7 @@ the prose of §7.3.1.2; we follow the prose (normative text takes precedence).
 
 ## Accuracy (vs ffmpeg as an external oracle)
 
-`tests/oracle_decode.rs` decodes 22 fixtures made by ffmpeg's VC-3 encoder: CIDs 1235, 1237,
+`tests/it/oracle_decode.rs` decodes 22 fixtures made by ffmpeg's VC-3 encoder: CIDs 1235, 1237,
 1238, 1241, 1242, 1243, 1244, 1250, 1251, 1252, 1253, 1258, 1259 and DNxHR LB/SQ/HQ/HQX/444
 (Y′CbCr and RGB), with testsrc2, mandelbrot and heavy noise, at 1920×1080, 1280×720, 960×720,
 1440×1080 (thin raster, interlaced), 1000×562, 640×360, 256×120 and 3840×2160. Compared with
@@ -111,7 +111,7 @@ decoder evaluates the exact IDCT of equation 8.3, so decode is **not bit-exact,
 precision** of ffmpeg. (ffmpeg wraps rather than clips 10-bit reconstructions that overflow
 1023, so the noise fixtures keep their samples inside 24…231 before encoding.)
 
-`tests/oracle_encode.rs` encodes 1920×1080 frames with every profile and writes them into a
+`tests/it/oracle_encode.rs` encodes 1920×1080 frames with every profile and writes them into a
 minimal test-only MOV. ffmpeg decodes them with `-xerror`, without errors, and agrees with our
 decoder within ±2 (90–99% identical). Luma PSNR against the source: HQ 58.8 dB (mandelbrot) and
 66.3 dB (testsrc2), SQ 57.5 dB, LB 56.1 dB, HQX 10-bit 67.5 dB, HQX 12-bit 80.2 dB, 444 10-bit
@@ -119,7 +119,7 @@ decoder within ±2 (90–99% identical). Luma PSNR against the source: HQ 58.8 d
 
 ## Performance
 
-`cargo test --release -p filmcraft-dnx --test perf -- --ignored --nocapture` on an M4 Pro
+`cargo test --release -p filmcraft-dnx --test it perf:: -- --ignored --nocapture` on an M4 Pro
 (14 cores) while the machine was **heavily overloaded** by other jobs (load average ≈ 190).
 Under the same load `filmcraft-prores`' perf test measured 30 fps threaded / 11.8 fps single
 for a 1080p HQ frame, against 318 / 53 fps in its README on a less loaded machine, so these are
diff --git a/crates/dnx/src/decode.rs b/crates/dnx/src/decode.rs
index 22f9f542b..ede98b0b3 100644
--- a/crates/dnx/src/decode.rs
+++ b/crates/dnx/src/decode.rs
@@ -54,9 +54,11 @@ pub fn decode_frame_with(data: &[u8], opts: &DecodeOptions) -> Result<Frame> {
     } else {
         (decode_unit(&h1, &data[..off], opts), decode_unit(&h2, &data[off..], opts))
     };
+    let (top, bottom) = if h1.field == FieldCode::Field2 { (p2?, p1?) } else { (p1?, p2?) };
+    // Both field payloads must be valid before committing the full-frame
+    // allocation; a damaged header alone must not allocate an output picture.
     let mut f = Frame::new_like(&h1, h1.width, h1.lines * 2);
     f.interlace = Interlace::TopFieldFirst;
-    let (top, bottom) = if h1.field == FieldCode::Field2 { (p2?, p1?) } else { (p1?, p2?) };
     top.copy_into(&mut f, 0, 2);
     bottom.copy_into(&mut f, 1, 2);
     Ok(f)
diff --git a/crates/dnx/src/tables.rs b/crates/dnx/src/tables.rs
index c1fe24909..905d808f1 100644
--- a/crates/dnx/src/tables.rs
+++ b/crates/dnx/src/tables.rs
@@ -226,13 +226,13 @@ pub(crate) fn vlc(i: usize) -> &'static VlcSet {
 /// Orthonormal 1-D DCT-II basis: `BASIS[u][x] = C(u)/2 · cos((2x+1)uπ/16)`, `C(0) = 1/√2`.
 pub(crate) const BASIS: [[f32; 8]; 8] = [
     [0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39],
-    [0.490_392_64, 0.415_734_8, 0.277_785_12, 0.097_545_16, -0.097_545_16, -0.277_785_12, -0.415_734_8, -0.490_392_64],
+    [0.49039264, 0.415_734_8, 0.277_785_12, 0.097_545_16, -0.097_545_16, -0.277_785_12, -0.415_734_8, -0.49039264],
     [0.461_939_77, 0.191_341_72, -0.191_341_72, -0.461_939_77, -0.461_939_77, -0.191_341_72, 0.191_341_72, 0.461_939_77],
-    [0.415_734_8, -0.097_545_16, -0.490_392_64, -0.277_785_12, 0.277_785_12, 0.490_392_64, 0.097_545_16, -0.415_734_8],
+    [0.415_734_8, -0.097_545_16, -0.49039264, -0.277_785_12, 0.277_785_12, 0.49039264, 0.097_545_16, -0.415_734_8],
     [0.353_553_39, -0.353_553_39, -0.353_553_39, 0.353_553_39, 0.353_553_39, -0.353_553_39, -0.353_553_39, 0.353_553_39],
-    [0.277_785_12, -0.490_392_64, 0.097_545_16, 0.415_734_8, -0.415_734_8, -0.097_545_16, 0.490_392_64, -0.277_785_12],
+    [0.277_785_12, -0.49039264, 0.097_545_16, 0.415_734_8, -0.415_734_8, -0.097_545_16, 0.49039264, -0.277_785_12],
     [0.191_341_72, -0.461_939_77, 0.461_939_77, -0.191_341_72, -0.191_341_72, 0.461_939_77, -0.461_939_77, 0.191_341_72],
-    [0.097_545_16, -0.277_785_12, 0.415_734_8, -0.490_392_64, 0.490_392_64, -0.415_734_8, 0.277_785_12, -0.097_545_16],
+    [0.097_545_16, -0.277_785_12, 0.415_734_8, -0.49039264, 0.49039264, -0.415_734_8, 0.277_785_12, -0.097_545_16],
 ];
 
 #[cfg(test)]
diff --git a/crates/dnx/tests/common/mod.rs b/crates/dnx/tests/it/common/mod.rs
similarity index 100%
rename from crates/dnx/tests/common/mod.rs
rename to crates/dnx/tests/it/common/mod.rs
diff --git a/crates/dnx/tests/it/fuzz_hostile.rs b/crates/dnx/tests/it/fuzz_hostile.rs
new file mode 100644
index 000000000..a20e26a2b
--- /dev/null
+++ b/crates/dnx/tests/it/fuzz_hostile.rs
@@ -0,0 +1,183 @@
+//! Hostile-input robustness: every header byte set to extreme values, every bit flipped,
+//! truncation at (nearly) every length and random mutation of encoder-made frames must never
+//! panic or run away (errors are fine). No ffmpeg needed.
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use filmcraft_dnx::{ChromaFormat, DecodeOptions, Encoder, EncoderConfig, Frame, Profile, decode_frame_with, probe};
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+fn seeds() -> Vec<Vec<u8>> {
+    let mut v = Vec::new();
+    for (profile, depth, w, h) in
+        [(Profile::Lb, 8, 64u32, 48u32), (Profile::Hq, 8, 48, 32), (Profile::Hqx, 10, 64, 32), (Profile::Hqx, 12, 48, 32), (Profile::R444, 10, 48, 32)]
+    {
+        let mut cfg = EncoderConfig::new(profile, w, h);
+        cfg.bit_depth = depth;
+        let chroma = cfg.chroma();
+        let mut f = Frame::new(w, h, chroma, depth, false);
+        for (i, s) in f.y.iter_mut().enumerate() {
+            *s = ((16 + (i * 37) % 200) as u16) << (depth - 8);
+        }
+        if chroma != ChromaFormat::Yuv444 {
+            f.cb.fill(128 << (depth - 8));
+            f.cr.fill(100 << (depth - 8));
+        }
+        if let Ok(mut enc) = Encoder::with_config(cfg)
+            && let Ok(d) = enc.encode(&f)
+        {
+            v.push(d);
+        }
+    }
+    v
+}
+
+fn run(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        let _ = probe(d);
+        for opts in [DecodeOptions::default(), DecodeOptions { threads: true, spec_dequant: true }] {
+            let _ = decode_frame_with(d, &opts);
+        }
+    }));
+    assert!(res.is_ok(), "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+/// CI runs a rotating share of every part of the sweep; `FILMCRAFT_FUZZ_ITERS=1500` runs all of it (see [`Depth`]).
+#[test]
+fn hostile_frames_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let depth = Depth::from_env();
+    let seeds = seeds();
+    assert!(!seeds.is_empty());
+    for (si, seed) in seeds.iter().enumerate() {
+        for n in depth.truncations(seed.len()) {
+            run(&seed[..n], &format!("seed {si} truncate {n}"));
+        }
+        header_flips(&depth, seed, si);
+        big_fields(seed, si);
+        random_rounds(&depth, seed, si);
+    }
+}
+
+/// The header (and the start of the scan-line index): every byte to extreme values, every bit.
+fn header_flips(depth: &Depth, seed: &[u8], si: usize) {
+    for p in 0..seed.len().min(0x300) {
+        for (i, v) in VALUES.into_iter().enumerate() {
+            if !depth.value(p, i) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] = v;
+            run(&d, &format!("seed {si} byte {p:#x}={v:#x}"));
+        }
+        for b in 0..8 {
+            if !depth.bit(p, b) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] ^= 1 << b;
+            run(&d, &format!("seed {si} flip {p:#x}.{b}"));
+        }
+    }
+}
+
+/// Big dimension fields with the rest intact (lines 0x18, width 0x1A, macroblock rows 0x16C).
+fn big_fields(seed: &[u8], si: usize) {
+    for (off, v) in [(0x18usize, 0xffffu16), (0x1a, 0xffff), (0x18, 0x4000), (0x1a, 0x4000), (0x16c, 0xffff)] {
+        let mut d = seed.to_vec();
+        if let Some(s) = d.get_mut(off..off + 2) {
+            s.copy_from_slice(&v.to_be_bytes());
+        }
+        run(&d, &format!("seed {si} u16 {off:#x}={v:#x}"));
+    }
+}
+
+fn random_rounds(depth: &Depth, seed: &[u8], si: usize) {
+    let mut rng = Rng(0x9e3779b97f4a7c15 ^ si as u64);
+    // Skipped rounds still draw their mutations, so round i matches round i of a full run.
+    for i in 0..depth.rounds {
+        let mut d = seed.to_vec();
+        for _ in 0..1 + rng.below(8) {
+            let p = rng.below(d.len());
+            if rng.below(2) == 0 {
+                d[p] ^= 1 << rng.below(8);
+            } else {
+                d[p] = rng.next() as u8;
+            }
+        }
+        if depth.round(i) {
+            run(&d, &format!("seed {si} random {i}"));
+        }
+    }
+}
+
+const VALUES: [u8; 5] = [0, 0xff, 0x80, 0x01, 0x7f];
+
+/// How much of the sweep runs. `FILMCRAFT_FUZZ_ITERS=N` runs all of it (about 400 truncation
+/// points spread over each seed, every header byte, overwrite value and bit flip) plus N random
+/// rounds per seed: 1500 is the full depth, more hunts longer. Unset, CI runs a third of the
+/// truncation points and of the full depth's random rounds and, for each header byte, one value
+/// and two bits. A rotation offset shifts which share runs (`FILMCRAFT_FUZZ_SEED`, else the UTC
+/// day number), so every case of the full sweep runs within a few days, and a random round's
+/// mutations match the same round of a full run.
+struct Depth {
+    full: bool,
+    truncations: usize,
+    rounds: usize,
+    rotation: usize,
+}
+
+impl Depth {
+    fn from_env() -> Self {
+        match std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()) {
+            Some(rounds) => Depth { full: true, truncations: 400, rounds, rotation: 0 },
+            None => {
+                let rotation = rotation();
+                eprintln!("fuzz subset rotation {rotation} (FILMCRAFT_FUZZ_SEED={rotation} replays it; FILMCRAFT_FUZZ_ITERS=1500 runs everything)");
+                Depth { full: false, truncations: 400, rounds: 1500, rotation }
+            }
+        }
+    }
+    /// Truncation lengths for a `len`-byte input: every point of the full sweep, or every third one.
+    fn truncations(&self, len: usize) -> std::iter::StepBy<std::ops::Range<usize>> {
+        let stride = (len / self.truncations).max(1);
+        let (start, step) = if self.full { (0, stride) } else { ((self.rotation % 3) * stride, 3 * stride) };
+        (start..len).step_by(step)
+    }
+    fn value(&self, p: usize, i: usize) -> bool {
+        self.full || i == (p + self.rotation % VALUES.len()) % VALUES.len()
+    }
+    fn bit(&self, p: usize, b: usize) -> bool {
+        self.full || (b + p + self.rotation % 4).is_multiple_of(4)
+    }
+    fn round(&self, i: usize) -> bool {
+        self.full || i % 3 == self.rotation % 3
+    }
+}
+
+/// The default subset's rotation offset: `FILMCRAFT_FUZZ_SEED`, else days since the Unix epoch (UTC).
+fn rotation() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or_else(|| {
+        let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        usize::try_from(secs / 86_400).unwrap_or(0)
+    })
+}
diff --git a/crates/dnx/tests/it/main.rs b/crates/dnx/tests/it/main.rs
new file mode 100644
index 000000000..c12ebd099
--- /dev/null
+++ b/crates/dnx/tests/it/main.rs
@@ -0,0 +1,6 @@
+mod common;
+mod fuzz_hostile;
+mod oracle_decode;
+mod oracle_encode;
+mod perf;
+mod roundtrip;
diff --git a/crates/dnx/tests/oracle_decode.rs b/crates/dnx/tests/it/oracle_decode.rs
similarity index 99%
rename from crates/dnx/tests/oracle_decode.rs
rename to crates/dnx/tests/it/oracle_decode.rs
index 476ee68d1..a9da675c8 100644
--- a/crates/dnx/tests/oracle_decode.rs
+++ b/crates/dnx/tests/it/oracle_decode.rs
@@ -1,6 +1,6 @@
 //! Decode ffmpeg-made DNxHD / DNxHR fixtures and compare with ffmpeg's own decode.
 
-mod common;
+use crate::common;
 use common::*;
 use filmcraft_dnx::{DecodeOptions, decode_frame_with};
 
diff --git a/crates/dnx/tests/oracle_encode.rs b/crates/dnx/tests/it/oracle_encode.rs
similarity index 99%
rename from crates/dnx/tests/oracle_encode.rs
rename to crates/dnx/tests/it/oracle_encode.rs
index ca64941df..4d5702698 100644
--- a/crates/dnx/tests/oracle_encode.rs
+++ b/crates/dnx/tests/it/oracle_encode.rs
@@ -1,6 +1,6 @@
 //! Encode DNxHR with our encoder, decode with ffmpeg (`-xerror`) and with our decoder.
 
-mod common;
+use crate::common;
 use common::*;
 use filmcraft_dnx::{ChromaFormat, Encoder, EncoderConfig, Profile, decode_frame};
 
diff --git a/crates/dnx/tests/perf.rs b/crates/dnx/tests/it/perf.rs
similarity index 95%
rename from crates/dnx/tests/perf.rs
rename to crates/dnx/tests/it/perf.rs
index 255f1961c..befd20a48 100644
--- a/crates/dnx/tests/perf.rs
+++ b/crates/dnx/tests/it/perf.rs
@@ -1,4 +1,4 @@
-//! Throughput: `cargo test --release -p filmcraft-dnx --test perf -- --ignored --nocapture`.
+//! Throughput: `cargo test --release -p filmcraft-dnx --test it perf:: -- --ignored --nocapture`.
 
 use filmcraft_dnx::{ChromaFormat, DecodeOptions, Encoder, EncoderConfig, Frame, Profile, decode_frame_with};
 use std::time::Instant;
diff --git a/crates/dnx/tests/roundtrip.rs b/crates/dnx/tests/it/roundtrip.rs
similarity index 100%
rename from crates/dnx/tests/roundtrip.rs
rename to crates/dnx/tests/it/roundtrip.rs
diff --git a/crates/dnx/tools/extract_tables.py b/crates/dnx/tools/extract_tables.py
index 56d73a6e1..2e120cc93 100644
--- a/crates/dnx/tools/extract_tables.py
+++ b/crates/dnx/tools/extract_tables.py
@@ -14,8 +14,18 @@ prefix code.
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read()
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read()
 lines = text.split("\n")
 
 
diff --git a/crates/edit/src/captions.rs b/crates/edit/src/captions.rs
index a08d0ad7d..252c7e46e 100644
--- a/crates/edit/src/captions.rs
+++ b/crates/edit/src/captions.rs
@@ -215,6 +215,67 @@ pub fn move_captions(seq: &mut Sequence, ids: &[ClipId], delta: Tick) -> Result<
     Ok(d)
 }
 
+/// Place copies of `captions` on `track`, overwriting what lies under them (captions there are cut
+/// back, split or removed), as Paste and Option-drag do. The copies keep their text, speaker and
+/// settings at their own `start`/`duration`, and get new ids (returned in time order).
+pub fn overwrite_captions(seq: &mut Sequence, track: TrackId, captions: &[Caption], ctx: &mut EditCtx) -> Result<Vec<ClipId>> {
+    let min = ctx.min_duration;
+    let mut placed: Vec<Caption> = captions.iter().filter(|c| c.duration >= min).cloned().collect();
+    if placed.is_empty() {
+        return Err(EditError::Nothing);
+    }
+    placed.sort_by_key(|c| c.start);
+    if placed.first().is_some_and(|c| c.start < Tick::ZERO) {
+        return Err(EditError::Other("captions cannot start before the sequence".into()));
+    }
+    if placed.windows(2).any(|w| w[0].end() > w[1].start) {
+        return Err(EditError::Other("captions overlap".into()));
+    }
+    let tr = track_mut(seq, track)?;
+    for c in &mut placed {
+        c.id = ClipId(ctx.alloc());
+        c.cue_id = None;
+    }
+    for c in &placed {
+        clear_range(tr, c.start, c.end(), min, ctx);
+    }
+    let ids = placed.iter().map(|c| c.id).collect();
+    tr.captions.extend(placed);
+    tr.sort();
+    Ok(ids)
+}
+
+/// Clear `a..b` on a caption track without closing the gap: captions inside go, captions across an
+/// edge are cut back, a caption across the whole range is split. Pieces shorter than `min` go.
+fn clear_range(tr: &mut CaptionTrack, a: Tick, b: Tick, min: Tick, ctx: &mut EditCtx) {
+    let mut out = Vec::with_capacity(tr.captions.len() + 1);
+    for c in tr.captions.drain(..) {
+        let (s, e) = (c.start, c.end());
+        if e <= a || s >= b {
+            out.push(c);
+            continue;
+        }
+        let mut kept_left = false;
+        if s < a && a - s >= min {
+            let mut l = c.clone();
+            l.duration = a - s;
+            out.push(l);
+            kept_left = true;
+        }
+        if e > b && e - b >= min {
+            let mut r = c;
+            if kept_left {
+                r.id = ClipId(ctx.alloc());
+                r.cue_id = None;
+            }
+            r.start = b;
+            r.duration = e - b;
+            out.push(r);
+        }
+    }
+    tr.captions = out;
+}
+
 /// Delete captions. With `ripple`, later captions on the same track move left to close each gap.
 pub fn delete_captions(seq: &mut Sequence, ids: &[ClipId], ripple: bool) -> Result<usize> {
     let mut n = 0;
@@ -385,6 +446,40 @@ mod tests {
         assert_eq!(spans(&seq, tid), vec![(0, 40, "a".into()), (40, 80, "c".into())]);
     }
 
+    #[test]
+    fn overwrite_cuts_splits_and_removes_what_is_under() {
+        let (mut seq, tid) = seq_with(&[(0, 100, "a"), (100, 50, "b"), (200, 100, "c")]);
+        let mut n = 1;
+        let copy = |s: i64, d: i64, t: &str| Caption {
+            id: ClipId(1),
+            start: Tick(s),
+            duration: Tick(d),
+            text: t.into(),
+            speaker: None,
+            cue_id: Some("x".into()),
+            settings: String::new(),
+        };
+        // across a's tail and all of b; then inside c (c is split around it)
+        let ids = overwrite_captions(&mut seq, tid, &[copy(60, 95, "x"), copy(230, 40, "y")], &mut ctx(&mut n)).unwrap();
+        assert_eq!(ids.len(), 2);
+        assert_eq!(spans(&seq, tid), vec![(0, 60, "a".into()), (60, 155, "x".into()), (200, 230, "c".into()), (230, 270, "y".into()), (270, 300, "c".into())]);
+        let tr = seq.caption_track(tid).unwrap();
+        assert!(tr.captions.iter().all(|c| c.cue_id.is_none()));
+        let seen: std::collections::HashSet<u64> = tr.captions.iter().map(|c| c.id.0).collect();
+        assert_eq!(seen.len(), 5, "every piece has its own id");
+        assert!(seq.check().is_ok());
+        // a sliver under one frame is dropped, not kept
+        let (mut seq, tid) = seq_with(&[(0, 100, "a")]);
+        overwrite_captions(&mut seq, tid, &[copy(5, 90, "x")], &mut ctx(&mut n)).unwrap();
+        assert_eq!(spans(&seq, tid), vec![(5, 95, "x".into())]);
+        // hostile input: before zero, overlapping copies, nothing
+        assert!(overwrite_captions(&mut seq, tid, &[copy(-5, 50, "x")], &mut ctx(&mut n)).is_err());
+        assert!(overwrite_captions(&mut seq, tid, &[copy(0, 50, "x"), copy(40, 50, "y")], &mut ctx(&mut n)).is_err());
+        assert_eq!(overwrite_captions(&mut seq, tid, &[], &mut ctx(&mut n)), Err(EditError::Nothing));
+        seq.caption_track_mut(tid).unwrap().locked = true;
+        assert_eq!(overwrite_captions(&mut seq, tid, &[copy(0, 50, "x")], &mut ctx(&mut n)), Err(EditError::Locked));
+    }
+
     #[test]
     fn locked_refuses() {
         let (mut seq, tid) = seq_with(&[(0, 100, "a")]);
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 2f2588d6c..42c613ec7 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -26,7 +26,7 @@ pub mod transitions;
 
 use std::collections::HashMap;
 
-use filmcraft_project::{ClipId, ItemId, Sequence, Track, TrackId, TrackItem, Transition, TransitionId};
+use filmcraft_project::{ClipId, ItemId, Sequence, Track, TrackId, TrackItem, Transition, TransitionAlign, TransitionId};
 use filmcraft_time::{Tick, TimeRange};
 
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
@@ -196,24 +196,59 @@ fn transition_anchor(track: &Track, tr: &Transition) -> Option<Tick> {
 }
 
 /// Keep transitions on their edit points after an edit moved cuts (ripple trim, roll, slide, ripple
-/// speed change): each transition shifts by as much as its anchor clip edge moved.
+/// speed change): each transition shifts by as much as its anchor clip edge moved. A transition
+/// between two clips stays within them, whether its cut moved or one of the clips got shorter
+/// ([`keep_within_clips`]).
 fn transitions_follow_cuts(before: &Sequence, after: &mut Sequence) {
+    let frame = after.settings.frame_rate.frame_duration();
     for track in after.all_tracks_mut() {
         let Some(old) = before.track(track.id) else { continue };
-        let shifts: Vec<Tick> = track
+        let shifts: Vec<(Tick, Option<(Tick, Tick, Tick)>)> = track
             .transitions
             .iter()
-            .map(|tr| match (transition_anchor(old, tr), transition_anchor(track, tr)) {
-                (Some(a), Some(b)) => b - a,
-                _ => Tick::ZERO,
+            .map(|tr| {
+                let d = match (transition_anchor(old, tr), transition_anchor(track, tr)) {
+                    (Some(a), Some(b)) => b - a,
+                    _ => Tick::ZERO,
+                };
+                (d, clips_span(track, tr))
             })
             .collect();
-        for (tr, d) in track.transitions.iter_mut().zip(shifts) {
+        for (tr, (d, within)) in track.transitions.iter_mut().zip(shifts) {
             tr.start += d;
+            if let Some(span) = within {
+                keep_within_clips(tr, span, frame);
+            }
         }
     }
 }
 
+/// The two clips of a transition between clips as (first clip's start, cut, second clip's end),
+/// while they still overlap the cut's span.
+fn clips_span(track: &Track, tr: &Transition) -> Option<(Tick, Tick, Tick)> {
+    match (tr.from.and_then(|c| track.item(c)), tr.to.and_then(|c| track.item(c))) {
+        (Some(f), Some(t)) if f.start < t.end() => Some((f.start, t.start, t.end())),
+        _ => None,
+    }
+}
+
+/// Move a transition that reaches past its two clips (`span`, from [`clips_span`]) back inside
+/// them, shortened when the clips are now shorter than it. Its stored alignment follows where that
+/// leaves it on the cut, as `transitions::set_span` stores it (interchange): Custom Start has no
+/// variant.
+fn keep_within_clips(tr: &mut Transition, (lo, cut, hi): (Tick, Tick, Tick), frame: Tick) {
+    if tr.start >= lo && tr.end() <= hi {
+        return;
+    }
+    tr.duration = tr.duration.min(hi - lo);
+    tr.start = tr.start.clamp(lo, hi - tr.duration);
+    tr.align = match transitions::alignment(tr, cut, frame) {
+        transitions::Alignment::Start => TransitionAlign::StartAtCut,
+        transitions::Alignment::End => TransitionAlign::EndAtCut,
+        transitions::Alignment::Center | transitions::Alignment::Custom => TransitionAlign::CenterAtCut,
+    };
+}
+
 /// Keep a clip's one-sided transitions (a fade in from nothing, a fade out to nothing) on its edges
 /// after a regular trim moved them, no longer than the clip (#374). Transitions between two clips
 /// are left alone: a regular trim cannot move their cut.
@@ -234,6 +269,18 @@ fn fades_follow_edges(track: &mut Track, clip: ClipId) {
     }
 }
 
+/// Keep each transition between `clip` and its neighbor within the two clips after a regular trim
+/// or a non-ripple speed change made `clip` shorter ([`keep_within_clips`]).
+fn transitions_stay_within_clips(track: &mut Track, clip: ClipId, frame: Tick) {
+    let spans: Vec<Option<(Tick, Tick, Tick)>> =
+        track.transitions.iter().map(|tr| clips_span(track, tr).filter(|_| tr.from == Some(clip) || tr.to == Some(clip))).collect();
+    for (tr, span) in track.transitions.iter_mut().zip(spans) {
+        if let Some(span) = span {
+            keep_within_clips(tr, span, frame);
+        }
+    }
+}
+
 fn place(track: &mut Track, item: TrackItem) {
     let idx = track.items.partition_point(|i| i.start <= item.start);
     track.items.insert(idx, item);
@@ -509,6 +556,12 @@ pub fn close_gap(seq: &mut Sequence, track: TrackId, t: Tick) -> Result<()> {
 /// Move items by (track, time) offsets with overwrite (default drag) or insert (Cmd-drag) semantics.
 /// `moves`: (item, destination track, new start).
 pub fn move_items(seq: &mut Sequence, moves: &[(ClipId, TrackId, Tick)], insert_mode: bool, ctx: &mut EditCtx) -> Result<()> {
+    let mut seen = std::collections::HashSet::new();
+    for (clip, _, _) in moves {
+        if !seen.insert(*clip) {
+            return Err(EditError::Other(format!("clip {} is listed more than once in this move", clip.0)));
+        }
+    }
     let mut work = seq.clone();
     let mut placed = Vec::new();
     for (c, dest, start) in moves {
@@ -765,8 +818,12 @@ pub fn trim(seq: &mut Sequence, clip: ClipId, edge: Edge, mode: TrimMode, delta:
             }
         }
         transitions_follow_cuts(seq, &mut work);
-    } else if let Ok(track) = track_mut(&mut work, tid) {
-        fades_follow_edges(track, clip);
+    } else {
+        let frame = work.settings.frame_rate.frame_duration();
+        if let Ok(track) = track_mut(&mut work, tid) {
+            fades_follow_edges(track, clip);
+            transitions_stay_within_clips(track, clip, frame);
+        }
     }
     work.check().map_err(EditError::Other)?;
     *seq = work;
@@ -895,6 +952,10 @@ pub fn roll(seq: &mut Sequence, left: ClipId, right: ClipId, delta: Tick, ctx: &
     let mut d = delta;
     // left out-point limits
     d = d.max(-(l.duration - ctx.min_duration)).min(r.duration - ctx.min_duration);
+    // a transition on this cut moves with it and stays within the two clips
+    for x in seq.all_tracks().flat_map(|t| &t.transitions).filter(|x| x.from == Some(left) && x.to == Some(right)) {
+        d = d.max((l.start - x.start).min(Tick::ZERO)).min((r.end() - x.end()).max(Tick::ZERO));
+    }
     // a reversed clip consumes media from the opposite end, so its media limit is the other one
     if l.reverse {
         d = d.min(Tick((head(ctx, l).0 as f64 / l.speed.abs()).floor() as i64));
@@ -1130,7 +1191,12 @@ pub fn set_speed_group(seq: &mut Sequence, clips: &[ClipId], speed: f64, reverse
         it.speed = speed;
         it.reverse = reverse;
         it.duration = new_dur;
-        fades_follow_edges(work.track_mut(tid).ok_or(EditError::NoTrack(tid))?, *clip);
+        let frame = work.settings.frame_rate.frame_duration();
+        let track = work.track_mut(tid).ok_or(EditError::NoTrack(tid))?;
+        fades_follow_edges(track, *clip);
+        if !ripple {
+            transitions_stay_within_clips(track, *clip, frame);
+        }
         origins.push((tid, old_end, delta));
     }
     let main_from = origins.first().map(|o| o.1).unwrap_or_default();
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 9b42c106a..f12412e83 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -77,6 +77,21 @@ impl Fx {
     }
 }
 
+#[test]
+fn move_rejects_repeated_clip_ids_without_mutation() {
+    for insert_mode in [false, true] {
+        let mut fx = Fx::new();
+        let (v1, v2) = (fx.v(0), fx.v(1));
+        let c = fx.put(v1, 0, 10, 0);
+        let before = fx.seq.clone();
+        let mut n = fx.next;
+        let result = move_items(&mut fx.seq, &[(c, v1, f(20)), (c, v2, f(20))], insert_mode, &mut Fx::ctx(&mut n));
+        assert!(result.is_err(), "moving one identity to two tracks must be rejected: {result:?}");
+        assert_eq!(fx.seq, before);
+        assert_eq!(n, fx.next, "a rejected move consumes no ids");
+    }
+}
+
 #[test]
 fn overwrite_splits_underlying() {
     let mut fx = Fx::new();
@@ -527,6 +542,69 @@ fn fades_follow_a_non_ripple_speed_change() {
     fx.seq.check().unwrap();
 }
 
+/// A regular trim or a non-ripple speed change that shortens one of the two clips of a transition
+/// keeps the transition within them, and its stored alignment follows where it now sits on the cut.
+#[test]
+fn a_transition_stays_within_its_clips_after_a_regular_trim_or_speed_change() {
+    for (case, expected) in [("Out trim of the second clip", 7), ("In trim of the first clip", 9), ("speed change of the second clip", 7)] {
+        let mut fx = Fx::new();
+        let v1 = fx.v(0);
+        let a = fx.put(v1, 0, 10, 10);
+        let b = fx.put(v1, 10, 10, 10);
+        fx.seq.track_mut(v1).unwrap().transitions = vec![Transition {
+            id: TransitionId(1),
+            effect: filmcraft_project::find_effect("cross_dissolve").unwrap().instance(),
+            start: f(8),
+            duration: f(4),
+            from: Some(a),
+            to: Some(b),
+            align: filmcraft_project::TransitionAlign::EndAtCut,
+            reverse: false,
+        }];
+        let mut n = fx.next;
+        match case {
+            "Out trim of the second clip" => {
+                trim(&mut fx.seq, b, Edge::Out, TrimMode::Regular, -f(9), &mut Fx::ctx(&mut n)).unwrap();
+            }
+            "In trim of the first clip" => {
+                trim(&mut fx.seq, a, Edge::In, TrimMode::Regular, f(9), &mut Fx::ctx(&mut n)).unwrap();
+            }
+            _ => set_speed(&mut fx.seq, b, 10.0, false, false, &mut Fx::ctx(&mut n)).unwrap(),
+        }
+        let tr = &fx.seq.track(v1).unwrap().transitions[0];
+        assert_eq!((tr.start, tr.duration), (f(expected), f(4)), "{case}");
+        assert_eq!(tr.align, filmcraft_project::TransitionAlign::CenterAtCut, "{case}");
+        fx.seq.check().unwrap();
+    }
+}
+
+/// A regular trim that leaves the two clips of a transition shorter than it, together, shortens
+/// the transition to the clips.
+#[test]
+fn a_regular_trim_shortens_a_transition_longer_than_its_clips() {
+    let mut fx = Fx::new();
+    let v1 = fx.v(0);
+    let a = fx.put(v1, 0, 2, 10);
+    let b = fx.put(v1, 2, 10, 10);
+    fx.seq.track_mut(v1).unwrap().transitions = vec![Transition {
+        id: TransitionId(1),
+        effect: filmcraft_project::find_effect("cross_dissolve").unwrap().instance(),
+        start: f(0),
+        duration: f(4),
+        from: Some(a),
+        to: Some(b),
+        align: filmcraft_project::TransitionAlign::StartAtCut,
+        reverse: false,
+    }];
+    let mut n = fx.next;
+    trim(&mut fx.seq, b, Edge::Out, TrimMode::Regular, -f(9), &mut Fx::ctx(&mut n)).unwrap();
+    assert_eq!(fx.spans(v1), vec![(0, 2), (2, 1)]);
+    let tr = &fx.seq.track(v1).unwrap().transitions[0];
+    assert_eq!((tr.start, tr.duration), (f(0), f(3)), "the transition covers both clips and no more");
+    assert_eq!(tr.align, filmcraft_project::TransitionAlign::CenterAtCut);
+    fx.seq.check().unwrap();
+}
+
 #[test]
 fn transitions_travel_with_moved_clips() {
     // V1: a [0,10) fading in, b [10,20), c [20,30); b→c crossfade, c fading out
@@ -869,6 +947,102 @@ fn roll_reversed_clips_keeps_media_mapping() {
     assert_eq!((r.start, r.duration, r.source_in), (f(40), f(20), f(50)));
 }
 
+/// A rolling edit moves the transition on its cut with the cut, and stops where the transition
+/// would leave one of its two clips.
+#[test]
+fn roll_keeps_the_transition_on_its_clips() {
+    let mut fx = Fx::new();
+    let v1 = fx.v(0);
+    let a = fx.put(v1, 0, 10, 10);
+    let b = fx.put(v1, 10, 10, 10);
+    fx.seq.track_mut(v1).unwrap().transitions = vec![Transition {
+        id: TransitionId(1),
+        effect: filmcraft_project::find_effect("cross_dissolve").unwrap().instance(),
+        start: f(8),
+        duration: f(4),
+        from: Some(a),
+        to: Some(b),
+        align: Default::default(),
+        reverse: false,
+    }];
+    let mut n = fx.next;
+    // left: the transition reaches the sequence start after 8 frames, not the 9 the clips allow
+    assert_eq!(roll(&mut fx.seq, a, b, -f(9), &mut Fx::ctx(&mut n)).unwrap(), -f(8));
+    assert_eq!(fx.spans(v1), vec![(0, 2), (2, 18)]);
+    let tr = &fx.seq.track(v1).unwrap().transitions[0];
+    assert_eq!((tr.start, tr.duration), (f(0), f(4)), "the transition moved with the cut");
+    // right: it reaches the end of the second clip after 16 frames, not 17
+    assert_eq!(roll(&mut fx.seq, a, b, f(17), &mut Fx::ctx(&mut n)).unwrap(), f(16));
+    assert_eq!(fx.spans(v1), vec![(0, 18), (18, 2)]);
+    let tr = &fx.seq.track(v1).unwrap().transitions[0];
+    assert_eq!((tr.start, tr.duration), (f(16), f(4)));
+    fx.seq.check().unwrap();
+}
+
+/// A ripple trim or a slide that moves a cut close to the start of its first clip keeps the
+/// transition on that cut within its two clips, and its stored alignment follows: an End at Cut
+/// transition that now crosses the cut is stored as centered (Custom Start has no variant).
+#[test]
+fn edits_that_move_a_cut_keep_its_transition_on_its_clips() {
+    for slide_it in [false, true] {
+        let mut fx = Fx::new();
+        let v1 = fx.v(0);
+        let a = fx.put(v1, 0, 10, 10);
+        let b = fx.put(v1, 10, 10, 10);
+        fx.put(v1, 20, 10, 10);
+        fx.seq.track_mut(v1).unwrap().transitions = vec![Transition {
+            id: TransitionId(1),
+            effect: filmcraft_project::find_effect("cross_dissolve").unwrap().instance(),
+            start: f(6),
+            duration: f(4),
+            from: Some(a),
+            to: Some(b),
+            align: TransitionAlign::EndAtCut,
+            reverse: false,
+        }];
+        let mut n = fx.next;
+        if slide_it {
+            slide(&mut fx.seq, b, -f(9), &mut Fx::ctx(&mut n)).unwrap();
+        } else {
+            trim(&mut fx.seq, a, Edge::Out, TrimMode::Ripple, -f(9), &mut Fx::ctx(&mut n)).unwrap();
+        }
+        let t = fx.seq.track(v1).unwrap();
+        let (cut, a_start) = (t.item(b).unwrap().start, t.item(a).unwrap().start);
+        assert_eq!(cut, f(1), "slide {slide_it}");
+        let tr = &t.transitions[0];
+        assert_eq!((tr.start, tr.duration), (a_start, f(4)), "slide {slide_it}: the transition starts with its first clip");
+        assert_eq!(tr.align, TransitionAlign::CenterAtCut, "slide {slide_it}");
+        fx.seq.check().unwrap();
+    }
+}
+
+/// A ripple trim that shortens the second clip from its end leaves the cut where it is, and the
+/// transition on that cut still stays within its two clips.
+#[test]
+fn a_ripple_trim_of_the_second_clips_end_keeps_the_transition_within_it() {
+    let mut fx = Fx::new();
+    let v1 = fx.v(0);
+    let a = fx.put(v1, 0, 10, 10);
+    let b = fx.put(v1, 10, 10, 10);
+    fx.seq.track_mut(v1).unwrap().transitions = vec![Transition {
+        id: TransitionId(1),
+        effect: filmcraft_project::find_effect("cross_dissolve").unwrap().instance(),
+        start: f(8),
+        duration: f(4),
+        from: Some(a),
+        to: Some(b),
+        align: TransitionAlign::CenterAtCut,
+        reverse: false,
+    }];
+    let mut n = fx.next;
+    trim(&mut fx.seq, b, Edge::Out, TrimMode::Ripple, -f(9), &mut Fx::ctx(&mut n)).unwrap();
+    assert_eq!(fx.spans(v1), vec![(0, 10), (10, 1)]);
+    let tr = &fx.seq.track(v1).unwrap().transitions[0];
+    assert_eq!((tr.start, tr.duration), (f(7), f(4)), "the transition ends with the second clip");
+    assert_eq!(tr.align, TransitionAlign::CenterAtCut);
+    fx.seq.check().unwrap();
+}
+
 /// #374: moving an edge must not change which media sits under any timeline time the clip still
 /// covers (the timeline's live trim preview draws its waveform from this item), and must leave the
 /// item as the trim itself does.
diff --git a/crates/edit/src/through.rs b/crates/edit/src/through.rs
index 9b662abf9..263bbcce0 100644
--- a/crates/edit/src/through.rs
+++ b/crates/edit/src/through.rs
@@ -22,6 +22,18 @@ pub fn is_through_edit(a: &TrackItem, b: &TrackItem) -> bool {
     if a.end() != b.start || a.item != b.item || a.speed != b.speed || a.reverse != b.reverse || a.multicam != b.multicam {
         return false;
     }
+    if a.enabled != b.enabled
+        || a.gain_db != b.gain_db
+        || a.effects != b.effects
+        || a.scale_to_frame != b.scale_to_frame
+        || a.hold_filters != b.hold_filters
+        || a.time_interpolation != b.time_interpolation
+        || a.field_options != b.field_options
+        || a.audio_stream != b.audio_stream
+        || a.source_channels != b.source_channels
+    {
+        return false;
+    }
     match (a.frame_hold, b.frame_hold) {
         (None, None) => {}
         (Some(x), Some(y)) => return x == y,
@@ -214,6 +226,20 @@ mod tests {
         assert_eq!(q.video_tracks[0].items, orig.video_tracks[0].items);
     }
 
+    #[test]
+    fn pieces_with_different_settings_are_not_through_edits() {
+        let tweaks: [fn(&mut TrackItem); 3] = [|t| t.enabled = false, |t| t.gain_db = -20.0, |t| t.scale_to_frame = true];
+        for tweak in tweaks {
+            let mut q = seq_with(vec![item(10, 0, 100, 500)]);
+            let mut n = 1000;
+            razor(&mut q, &[], Tick(40), &mut ctx(&mut n));
+            tweak(&mut q.video_tracks[0].items[1]);
+            assert!(through_edits(&q).is_empty());
+            assert_eq!(join_through_edits(&mut q, &[]), 0);
+            assert_eq!(q.video_tracks[0].items.len(), 2);
+        }
+    }
+
     #[test]
     fn reversed_and_speed_changed_pieces_join() {
         for (speed, reverse) in [(1.0, true), (1.5, false), (0.7, true)] {
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 088163f10..d39450794 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -42,6 +42,7 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 craft-docpath = { workspace = true }
 web-time = "1"
 
diff --git a/crates/engine/src/aaf_omf.rs b/crates/engine/src/aaf_omf.rs
index 823b895dc..6aeafdcd2 100644
--- a/crates/engine/src/aaf_omf.rs
+++ b/crates/engine/src/aaf_omf.rs
@@ -130,6 +130,9 @@ fn dequantize(pcm: &[u8], channels: usize, bits: u16) -> Vec<Vec<f32>> {
     out
 }
 
+const MAX_EXPORT_AUDIO_CHANNELS: usize = 64;
+const MAX_EXPORT_AUDIO_SAMPLES: usize = 64 * 1024 * 1024;
+
 /// Decode a media range at `sample_rate` (planar).
 fn decode(s: &Session, need: &AudioNeed, sample_rate: u32) -> Result<Vec<Vec<f32>>> {
     let src = s
@@ -138,7 +141,12 @@ fn decode(s: &Session, need: &AudioNeed, sample_rate: u32) -> Result<Vec<Vec<f32
         .ok_or_else(|| EngineError::Other(format!("media {} is offline", need.path.as_deref().unwrap_or("?"))))?;
     let start = need.start.to_units_floor(sample_rate as i64);
     let frames = (need.end.to_units_floor(sample_rate as i64) - start).max(0) as usize;
-    let mut out: Vec<Vec<f32>> = vec![Vec::with_capacity(frames); need.channels.max(1) as usize];
+    let ch = (need.channels.max(1) as usize).min(MAX_EXPORT_AUDIO_CHANNELS);
+    let total_samples = ch.checked_mul(frames).ok_or_else(|| EngineError::Other("audio export buffer size overflow".into()))?;
+    if total_samples > MAX_EXPORT_AUDIO_SAMPLES {
+        return Err(EngineError::Other(format!("audio export buffer size {total_samples} samples exceeds maximum allowed ({MAX_EXPORT_AUDIO_SAMPLES})")));
+    }
+    let mut out: Vec<Vec<f32>> = vec![Vec::with_capacity(frames); ch];
     let chunk = sample_rate as usize * 10;
     let mut done = 0usize;
     while done < frames {
diff --git a/crates/engine/src/aaf_omf_tests.rs b/crates/engine/src/aaf_omf_tests.rs
index 83bdd05de..b80245507 100644
--- a/crates/engine/src/aaf_omf_tests.rs
+++ b/crates/engine/src/aaf_omf_tests.rs
@@ -87,6 +87,50 @@ fn aaf_embedded_trimmed_audio_round_trips_sample_exact() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+#[test]
+fn embedded_aaf_and_omf_import_leave_existing_media_files_intact() {
+    for (format, extension) in [(filmcraft_interchange::Format::Aaf, "aaf"), (filmcraft_interchange::Format::Omf, "omf")] {
+        let (mut s, _items, seq, dir) = setup(&format!("embedded-collision-{extension}"));
+        let path = dir.join(format!("cut.{extension}"));
+        let path_text = path.to_string_lossy().into_owned();
+        let command = if format == filmcraft_interchange::Format::Aaf { "file.exportAaf" } else { "file.exportOmf" };
+        s.execute(command, json!({"path": path_text, "audio": "embedded", "sequence": seq.0})).unwrap();
+        let bytes = std::fs::read(&path).unwrap();
+        let opts = filmcraft_interchange::ImportOptions { base_dir: Some(dir.to_string_lossy().into_owned()), name: Some("cut".into()), ..Default::default() };
+        let (_, extracted, _) = if format == filmcraft_interchange::Format::Aaf {
+            filmcraft_interchange::aaf::import(&bytes, &opts).unwrap()
+        } else {
+            filmcraft_interchange::omf::import(&bytes, &opts).unwrap()
+        };
+        let first = extracted.first().expect("embedded audio");
+        let original = b"ORIGINAL USER DATA";
+        std::fs::create_dir_all(std::path::Path::new(&first.path).parent().unwrap()).unwrap();
+        std::fs::write(&first.path, original).unwrap();
+
+        let response = s.execute("file.import", json!({"paths": [path_text]})).unwrap();
+        assert!(std::fs::read(&first.path).unwrap().as_slice() == original, "{extension}: existing file was overwritten");
+        let imported = s.project.sequence(imported_seq(&response)).unwrap();
+        let new_path = path_of(&s, imported.audio_tracks[0].items[0].item);
+        assert_ne!(new_path, first.path, "{extension}: imported audio still points at the existing file");
+        assert!(new_path.ends_with(" (2).wav"), "{extension}: {new_path}");
+        assert!(std::fs::read(&new_path).unwrap() == first.wav, "{extension}: imported audio was not extracted to the new path");
+        #[cfg(unix)]
+        {
+            let protected = dir.join("protected.wav");
+            std::fs::write(&protected, original).unwrap();
+            std::fs::remove_file(&first.path).unwrap();
+            std::os::unix::fs::symlink(&protected, &first.path).unwrap();
+            let again = s.execute("file.import", json!({"paths": [path.to_string_lossy()]})).unwrap();
+            assert!(std::fs::read(&protected).unwrap().as_slice() == original, "{extension}: symlink target was overwritten");
+            let imported_again = s.project.sequence(imported_seq(&again)).unwrap();
+            let third_path = path_of(&s, imported_again.audio_tracks[0].items[0].item);
+            assert!(third_path.ends_with(" (3).wav"), "{extension}: {third_path}");
+            assert!(std::fs::read(&third_path).unwrap() == first.wav, "{extension}: the third extraction is not the embedded audio");
+        }
+        let _ = std::fs::remove_dir_all(dir);
+    }
+}
+
 #[test]
 fn aaf_separate_aiff_breakout_and_linked() {
     let (mut s, items, seq, dir) = setup("aaf-separate");
diff --git a/crates/engine/src/autosave_tests.rs b/crates/engine/src/autosave_tests.rs
index 4ac6346a4..aad4adc20 100644
--- a/crates/engine/src/autosave_tests.rs
+++ b/crates/engine/src/autosave_tests.rs
@@ -35,6 +35,102 @@ fn journaled(s: &mut Session) -> u64 {
     s.persistence.as_ref().unwrap().status.journaled_revision
 }
 
+fn discard_fixture(tag: &str) -> (Session, std::path::PathBuf) {
+    let d = temp_dir(tag);
+    let mut s = Session::default();
+    start(&mut s, &d);
+    let candidates = ["first", "second", "third"]
+        .into_iter()
+        .map(|id| {
+            let dir = d.join(id);
+            std::fs::create_dir(&dir).unwrap();
+            std::fs::write(dir.join("snapshot.fcproj"), b"retained snapshot").unwrap();
+            autosave::RecoveryCandidate { id: id.into(), dir, meta: Default::default() }
+        })
+        .collect();
+    s.persistence.as_mut().unwrap().candidates = candidates;
+    (s, d)
+}
+
+fn block_discard(dir: &std::path::Path) {
+    // An ordinary file cannot be removed as a directory, on Windows or Unix.
+    std::fs::remove_dir_all(dir).unwrap();
+    std::fs::write(dir, b"occupied directory path").unwrap();
+}
+
+fn recovery_ids(s: &mut Session) -> Vec<String> {
+    s.execute("file.recoveryList", json!({})).unwrap().as_array().unwrap().iter().map(|v| v["id"].as_str().unwrap().to_owned()).collect()
+}
+
+#[test]
+fn discard_failure_preserves_candidates_and_allows_retry() {
+    let (mut s, d) = discard_fixture("discard-first-error");
+    block_discard(&d.join("first"));
+    assert!(s.execute("file.discardRecovery", json!({"all": true})).is_err());
+    assert_eq!(recovery_ids(&mut s), ["first", "second", "third"]);
+    assert!(s.is_enabled("file.discardRecovery"));
+    assert!(d.join("second/snapshot.fcproj").exists());
+    assert!(d.join("third/snapshot.fcproj").exists());
+    std::fs::remove_file(d.join("first")).unwrap();
+    std::fs::create_dir(d.join("first")).unwrap();
+    assert_eq!(s.execute("file.discardRecovery", json!({"all": true})).unwrap()["discarded"], 3);
+    assert!(recovery_ids(&mut s).is_empty());
+    s.shutdown();
+    std::fs::remove_dir_all(d).unwrap();
+}
+
+#[test]
+fn discard_failure_keeps_only_not_yet_deleted_candidates() {
+    let (mut s, d) = discard_fixture("discard-second-error");
+    block_discard(&d.join("second"));
+    assert!(s.execute("file.discardRecovery", json!({"all": true})).is_err());
+    assert_eq!(recovery_ids(&mut s), ["second", "third"]);
+    assert!(!d.join("first").exists());
+    assert!(d.join("third/snapshot.fcproj").exists());
+    s.shutdown();
+    std::fs::remove_dir_all(d).unwrap();
+}
+
+#[test]
+fn discard_selected_failure_keeps_unselected_candidates() {
+    let (mut s, d) = discard_fixture("discard-selected-error");
+    block_discard(&d.join("second"));
+    assert!(s.execute("file.discardRecovery", json!({"id": "second"})).is_err());
+    assert_eq!(recovery_ids(&mut s), ["first", "second", "third"]);
+    assert!(d.join("first/snapshot.fcproj").exists());
+    assert!(d.join("third/snapshot.fcproj").exists());
+    s.shutdown();
+    std::fs::remove_dir_all(d).unwrap();
+}
+
+#[test]
+fn discard_default_failure_does_not_select_another_candidate() {
+    let (mut s, d) = discard_fixture("discard-default-error");
+    block_discard(&d.join("first"));
+    let error = s.execute("file.discardRecovery", json!({})).unwrap_err().to_string();
+    assert!(error.contains("first"), "{error}");
+    assert_eq!(recovery_ids(&mut s), ["first", "second", "third"]);
+    assert!(d.join("second/snapshot.fcproj").exists());
+    s.shutdown();
+    std::fs::remove_dir_all(d).unwrap();
+}
+
+#[test]
+fn discard_selection_and_unknown_id_preserve_other_candidates() {
+    let (mut s, d) = discard_fixture("discard-selection");
+    assert!(s.execute("file.discardRecovery", json!({"id": "unknown"})).is_err());
+    assert_eq!(recovery_ids(&mut s), ["first", "second", "third"]);
+    assert_eq!(s.execute("file.discardRecovery", json!({"id": "second"})).unwrap()["discarded"], 1);
+    assert_eq!(recovery_ids(&mut s), ["first", "third"]);
+    assert!(!d.join("second").exists());
+    assert_eq!(s.execute("file.discardRecovery", json!({})).unwrap()["discarded"], 1);
+    assert_eq!(recovery_ids(&mut s), ["third"]);
+    assert!(!d.join("first").exists());
+    assert!(d.join("third/snapshot.fcproj").exists());
+    s.shutdown();
+    std::fs::remove_dir_all(d).unwrap();
+}
+
 #[test]
 fn preferences_get_set_and_persist() {
     let d = temp_dir("prefs");
diff --git a/crates/engine/src/captions.rs b/crates/engine/src/captions.rs
index d048a5677..3a13cbe9f 100644
--- a/crates/engine/src/captions.rs
+++ b/crates/engine/src/captions.rs
@@ -82,7 +82,11 @@ fn parse_color(v: &Value) -> Option<[u8; 4]> {
             _ => None,
         };
     }
-    let h = v.as_str()?.trim_start_matches('#');
+    let h = v.as_str()?;
+    let h = h.strip_prefix('#').unwrap_or(h);
+    if !h.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
     let b = |i: usize| u8::from_str_radix(h.get(i..i + 2)?, 16).ok();
     match h.len() {
         6 => Some([b(0)?, b(2)?, b(4)?, 255]),
@@ -160,6 +164,58 @@ pub fn delete(s: &mut Session, ids: &[ClipId], ripple: bool) -> Result<Value> {
     Ok(json!({"deleted": n}))
 }
 
+/// Copy the selected captions to the caption clipboard (Edit ▸ Copy / Cut with captions selected).
+/// Returns how many were copied.
+pub fn copy(s: &mut Session) -> usize {
+    let Some(q) = s.active_sequence() else { return 0 };
+    let sel = &s.state.caption_selection;
+    let picked: Vec<(usize, filmcraft_project::Caption)> =
+        q.caption_tracks.iter().enumerate().flat_map(|(ti, t)| t.captions.iter().filter(|c| sel.contains(&c.id)).map(move |c| (ti, c.clone()))).collect();
+    let min = picked.iter().map(|(_, c)| c.start).min().unwrap_or_default();
+    s.state.caption_clipboard = picked.into_iter().map(|(ti, c)| (ti, filmcraft_project::Caption { start: c.start - min, ..c })).collect();
+    s.state.clipboard.clear();
+    s.state.clipboard_markers.clear();
+    s.state.caption_clipboard.len()
+}
+
+/// Paste the caption clipboard at the playhead, each caption on the caption track it was copied
+/// from (the last one when that track is gone), overwriting what is there. Paste Insert first opens
+/// a gap the copied span long on those tracks. The pasted captions are selected and the playhead
+/// moves to their end.
+pub fn paste(s: &mut Session, insert: bool) -> Result<Value> {
+    let at = s.playhead();
+    let clip = s.state.caption_clipboard.clone();
+    let span = clip.iter().map(|(_, c)| c.end()).max().unwrap_or_default();
+    let mut by_track: Vec<(TrackId, Vec<filmcraft_project::Caption>)> = Vec::new();
+    {
+        let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
+        for (ti, c) in clip {
+            let Some(t) = q.caption_tracks.get(ti).or(q.caption_tracks.last()) else {
+                return Err(bad("edit.paste", "the sequence has no caption track to paste into"));
+            };
+            let c = filmcraft_project::Caption { start: c.start + at, ..c };
+            match by_track.iter_mut().find(|(id, _)| *id == t.id) {
+                Some((_, v)) => v.push(c),
+                None => by_track.push((t.id, vec![c])),
+            }
+        }
+    }
+    let ids = s.edit_sequence(if insert { "Paste Insert Captions" } else { "Paste Captions" }, |q, ctx, st| {
+        let mut ids = Vec::new();
+        for (tid, caps) in &by_track {
+            if insert && let Some(tr) = q.caption_track_mut(*tid).filter(|t| !t.locked) {
+                edit::captions::insert_gap(tr, at, span, ctx);
+            }
+            ids.extend(edit::captions::overwrite_captions(q, *tid, caps, ctx)?);
+        }
+        st.caption_selection = ids.clone();
+        st.selection.clear();
+        Ok(ids)
+    })?;
+    s.set_playhead(at + span);
+    Ok(json!({"captions": ids.iter().map(|c| c.0).collect::<Vec<_>>()}))
+}
+
 fn caption_json(s: &Session, c: &filmcraft_project::Caption) -> Value {
     let q = s.active_sequence();
     let (rate, df) = q.map(|q| (q.settings.frame_rate, q.settings.drop_frame)).unwrap_or_default();
@@ -463,6 +519,44 @@ pub fn commands() -> Vec<CommandSpec> {
             let applied = s.edit_sequence("Move Captions", |q, _, _| Ok(edit::captions::move_captions(q, &ids, d)?))?;
             Ok(json!({"applied": applied.0}))
         }),
+        spec("captions.duplicate", "Duplicate Captions", &[], None, r#"{"captions":[id]?,"delta":ticks|"deltaFrames":i64}"#, has_captions, |s, p| {
+            // Option-drag in the Timeline: copies `delta` later (or earlier) on their own
+            // tracks, overwriting what is there; the originals stay
+            let mut ids = caption_ids(s, p);
+            // each caption is copied once, however often it is named
+            let mut seen = std::collections::HashSet::new();
+            ids.retain(|id| seen.insert(*id));
+            if ids.is_empty() {
+                return Err(EngineError::Edit(edit::EditError::Nothing));
+            }
+            let d = delta_p(s, p).ok_or_else(|| bad("captions.duplicate", "need `delta` or `deltaFrames`"))?;
+            let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
+            let mut by_track: Vec<(TrackId, Vec<filmcraft_project::Caption>)> = Vec::new();
+            for id in &ids {
+                let (tid, c) = q.find_caption(*id).ok_or(EngineError::Edit(edit::EditError::NoItem(*id)))?;
+                match by_track.iter_mut().find(|(t, _)| *t == tid) {
+                    Some((_, v)) => v.push(c.clone()),
+                    None => by_track.push((tid, vec![c.clone()])),
+                }
+            }
+            // never before the start of the sequence
+            let earliest = by_track.iter().flat_map(|(_, v)| v.iter().map(|c| c.start)).min().unwrap_or_default();
+            let d = d.max(-earliest);
+            if d == Tick::ZERO {
+                return Err(EngineError::Edit(edit::EditError::Nothing));
+            }
+            let new = s.edit_sequence("Duplicate Captions", |q, ctx, st| {
+                let mut new = Vec::new();
+                for (tid, caps) in &by_track {
+                    let moved: Vec<_> = caps.iter().map(|c| filmcraft_project::Caption { start: c.start + d, ..c.clone() }).collect();
+                    new.extend(edit::captions::overwrite_captions(q, *tid, &moved, ctx)?);
+                }
+                st.caption_selection = new.clone();
+                st.selection.clear();
+                Ok(new)
+            })?;
+            Ok(json!({"captions": new.iter().map(|c| c.0).collect::<Vec<_>>(), "delta": d.0}))
+        }),
         spec("captions.delete", "Delete Captions", &[], None, r#"{"captions":[id]?,"ripple":bool=false}"#, has_captions, |s, p| {
             let ids = caption_ids(s, p);
             delete(s, &ids, bool_p(p, "ripple").unwrap_or(false))
diff --git a/crates/engine/src/captions_tests.rs b/crates/engine/src/captions_tests.rs
index feb65c175..a8b10c8db 100644
--- a/crates/engine/src/captions_tests.rs
+++ b/crates/engine/src/captions_tests.rs
@@ -158,3 +158,69 @@ fn caption_list_track_filter_never_falls_back_to_every_track() {
         assert!(s.execute("captions.list", json!({"track": sel})).is_err(), "{sel} names no caption track");
     }
 }
+
+fn caption_spans(s: &Session) -> Vec<(f64, f64, String)> {
+    let secs = |t: Tick| (t.seconds() * 10.0).round() / 10.0; // the demo sequence snaps to 23.976 fps frames
+    s.active_sequence().unwrap().caption_tracks[0].captions.iter().map(|c| (secs(c.start), secs(c.end()), c.text.clone())).collect()
+}
+
+#[test]
+fn captions_duplicate_copies_and_overwrites() {
+    let mut s = demo();
+    for (sec, text) in [(1.0, "one"), (3.0, "two")] {
+        s.execute("playhead.set", json!({"seconds": sec})).unwrap();
+        s.execute("captions.add", json!({"text": text, "durationSeconds": 1.0})).unwrap();
+    }
+    let one = s.active_sequence().unwrap().caption_tracks[0].captions[0].id;
+    // Option-drag: a copy 5 s later, the original stays; the copy is selected
+    let r = s.execute("captions.duplicate", json!({"captions": [one.0], "delta": 5 * TICKS_PER_SECOND})).unwrap();
+    assert_eq!(caption_spans(&s), vec![(1.0, 2.0, "one".into()), (3.0, 4.0, "two".into()), (6.0, 7.0, "one".into())]);
+    assert_eq!(s.state.caption_selection.len(), 1);
+    assert_eq!(r["captions"][0].as_u64(), Some(s.state.caption_selection[0].0));
+    // a copy dropped half over `two` overwrites that half
+    s.execute("captions.duplicate", json!({"captions": [one.0], "delta": TICKS_PER_SECOND * 3 / 2})).unwrap();
+    assert_eq!(caption_spans(&s)[1..3], [(2.5, 3.5, "one".into()), (3.5, 4.0, "two".into())]);
+    // never before zero; zero delta is nothing
+    s.execute("captions.duplicate", json!({"captions": [one.0], "delta": -100 * TICKS_PER_SECOND})).unwrap();
+    assert_eq!(caption_spans(&s)[0], (0.0, 1.0, "one".into()));
+    assert!(s.execute("captions.duplicate", json!({"captions": [one.0], "delta": 0})).is_err());
+    assert!(s.execute("captions.duplicate", json!({"captions": [one.0]})).is_err(), "needs a delta");
+    assert!(s.execute("captions.duplicate", json!({"captions": [], "delta": TICKS_PER_SECOND})).is_err(), "needs a caption");
+    let before = s.active_sequence().unwrap().caption_tracks[0].captions.len();
+    s.execute("captions.duplicate", json!({"captions": [one.0, one.0], "delta": 20 * TICKS_PER_SECOND})).unwrap();
+    assert_eq!(s.active_sequence().unwrap().caption_tracks[0].captions.len(), before + 1, "a caption named twice is copied once");
+    s.active_sequence().unwrap().check().unwrap();
+}
+
+#[test]
+fn captions_copy_cut_and_paste() {
+    let mut s = demo();
+    // Copy / Paste with only captions selected copies captions, pasted at the playhead
+    s.execute("playhead.set", json!({"seconds": 1.0})).unwrap();
+    s.execute("captions.add", json!({"text": "hi", "durationSeconds": 1.0})).unwrap();
+    assert!(s.state.selection.is_empty());
+    assert_eq!(s.execute("edit.copy", json!({})).unwrap()["copied"], 1);
+    s.execute("playhead.set", json!({"seconds": 10.0})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    assert_eq!(caption_spans(&s), vec![(1.0, 2.0, "hi".into()), (10.0, 11.0, "hi".into())]);
+    assert!((s.playhead().seconds() - 11.0).abs() < 0.05, "the playhead moves past the paste");
+    // Cut takes it away and Paste puts it back
+    s.execute("edit.cut", json!({})).unwrap();
+    assert_eq!(caption_spans(&s), vec![(1.0, 2.0, "hi".into())]);
+    s.execute("playhead.set", json!({"seconds": 4.0})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    assert_eq!(caption_spans(&s)[1], (4.0, 5.0, "hi".into()));
+    // copying clips afterwards makes Paste place clips again, not captions
+    let clip = s.active_sequence().unwrap().video_tracks[0].items[0].id;
+    s.execute("timeline.select", json!({"clips": [clip.0]})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    assert!(s.state.caption_clipboard.is_empty() && !s.state.clipboard.is_empty());
+    // undo takes back a caption paste as one step
+    let mut s = demo();
+    s.execute("captions.add", json!({"text": "x", "durationSeconds": 1.0})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    s.execute("playhead.set", json!({"seconds": 5.0})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(caption_spans(&s).len(), 1);
+}
diff --git a/crates/engine/src/clip_ops.rs b/crates/engine/src/clip_ops.rs
index 8a85b9eee..efc7fb26c 100644
--- a/crates/engine/src/clip_ops.rs
+++ b/crates/engine/src/clip_ops.rs
@@ -826,6 +826,7 @@ fn close_project(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(EngineError::Other("the project has unsaved changes: save it first, or pass {\"force\": true} to discard them".into()));
     }
     s.project = std::sync::Arc::new(Project::new("Untitled"));
+    s.document_epoch = s.document_epoch.wrapping_add(1);
     s.history = Default::default();
     s.history.limit = 200;
     s.state = Session::default().state;
@@ -929,8 +930,12 @@ fn consolidate_duplicates(s: &mut Session, _: &Value) -> Result<Value> {
     let mut groups: BTreeMap<String, Vec<ItemId>> = BTreeMap::new();
     for it in s.project.items.values() {
         if let ItemKind::Media(m) = &it.kind {
-            // same file (or generator), interpretation and streams
-            let shape = (m.info.video.is_some(), m.info.has_audio(), m.info.duration);
+            let generator_rate = if matches!(&m.media, MediaRef::Generator(filmcraft_media::Generator::CountingLeader)) {
+                m.info.video.as_ref().map(|v| v.frame_rate)
+            } else {
+                None
+            };
+            let shape = (m.info.video.is_some(), m.info.has_audio(), m.info.duration, generator_rate);
             let key = serde_json::to_string(&(&m.media, &m.interpret, m.offline, shape)).unwrap_or_default();
             groups.entry(key).or_default().push(it.id);
         }
@@ -1234,7 +1239,15 @@ fn parse_format(f: &str) -> Option<AudioChannels> {
 fn audio_channels(s: &mut Session, p: &Value) -> Result<Value> {
     let items: Vec<ItemId> =
         items_p(s, p).into_iter().filter(|i| s.project.item(*i).and_then(|it| it.as_media()).is_some_and(|m| m.info.has_audio())).collect();
-    if items.is_empty() || p.get("channels").is_some() {
+    // `channels` is the only thing the timeline-clip branch below reads, so it alone decides
+    // which branch runs: no project item selected used to fall into it too (on the theory that
+    // there was nothing else to do), but a `channels`-less call with no item selected (e.g. a
+    // stray `format` with an empty project selection, #1845) then reset the selected clips'
+    // `source_channels` to `[]` via `unwrap_or_default()` instead of being rejected.
+    if items.is_empty() && p.get("channels").is_none() {
+        return Err(bad("clip.audioChannels", "select a clip with audio, or a project item to set its format"));
+    }
+    if p.get("channels").is_some() {
         // timeline audio clips: which source channels each plays
         let clips = match p.get("clips").and_then(Value::as_array) {
             Some(a) if a.iter().all(Value::is_u64) => a.iter().filter_map(|v| v.as_u64().map(ClipId)).collect(),
diff --git a/crates/engine/src/clip_ops_tests.rs b/crates/engine/src/clip_ops_tests.rs
index 262b1ec80..30b6103b5 100644
--- a/crates/engine/src/clip_ops_tests.rs
+++ b/crates/engine/src/clip_ops_tests.rs
@@ -228,6 +228,33 @@ fn remove_unused_and_consolidate_duplicates() {
     assert!(s.project.item(dup).is_some());
 }
 
+#[test]
+fn consolidate_keeps_counting_leaders_with_distinct_source_rates() {
+    let mut s = Session::default();
+    s.execute("file.newProject", json!({"name": "Leader rates"})).unwrap();
+    s.execute("file.newSequence", json!({"name": "24 fps", "fps": 24, "video": 1, "audio": 1})).unwrap();
+    let leader_24 = ItemId(s.execute("file.newCountingLeader", json!({"seconds": 3})).unwrap()["item"].as_u64().unwrap());
+    s.execute("file.newSequence", json!({"name": "60 fps", "fps": 60, "video": 1, "audio": 1})).unwrap();
+    let leader_60 = ItemId(s.execute("file.newCountingLeader", json!({"seconds": 3})).unwrap()["item"].as_u64().unwrap());
+    assert_ne!(leader_24, leader_60);
+    s.execute("timeline.place", json!({"item": leader_60.0, "track": "V1", "audioTrack": "A1", "seconds": 0.0})).unwrap();
+    let before = s.media.full_res_source(&s.project, leader_60, &*s.services).unwrap().audio(0, 2_010, 48_000).unwrap();
+    assert!(before.channels.iter().all(|channel| channel[800..].iter().all(|sample| *sample == 0.0)));
+
+    let result = s.execute("edit.consolidateDuplicates", json!({})).unwrap();
+    assert_eq!(result["removed"], json!([]), "leaders with different source rates are not duplicates");
+    assert!(s.project.item(leader_60).is_some());
+    let sequence = s.active_sequence().unwrap();
+    assert_eq!(sequence.audio_tracks[0].items[0].item, leader_60);
+    let after = s.media.full_res_source(&s.project, leader_60, &*s.services).unwrap().audio(0, 2_010, 48_000).unwrap();
+    assert_eq!(after.channels, before.channels);
+
+    s.execute("project.select", json!({"items": [leader_60.0]})).unwrap();
+    let duplicate = ItemId(s.execute("edit.duplicate", json!({})).unwrap()["items"][0].as_u64().unwrap());
+    let result = s.execute("edit.consolidateDuplicates", json!({})).unwrap();
+    assert_eq!(result["removed"], json!([duplicate.0]), "equal-rate copies should still consolidate");
+}
+
 #[test]
 fn new_sequence_from_clip_bin_from_selection_and_offline_file() {
     let mut s = demo();
@@ -379,6 +406,24 @@ fn modify_audio_channels_and_breakout_to_mono() {
     assert!(s.execute("clip.breakoutToMono", json!({})).is_err(), "no audio");
 }
 
+/// #1845: with no project item selected, a `channels`-less call (a stray `format` included)
+/// used to fall into the timeline-clip branch anyway and reset `source_channels` to `[]` via
+/// `unwrap_or_default()`, instead of being rejected. The map set by the previous `channels` call
+/// must survive a later `format`-only call under the same (empty) project selection.
+#[test]
+fn audio_channels_rejects_a_channel_less_call_with_no_item_selected() {
+    let mut s = demo();
+    s.state.project_selection.clear();
+    let a1 = s.active_sequence().unwrap().audio_tracks[0].items[0].id;
+    s.state.selection = vec![a1];
+    s.execute("clip.audioChannels", json!({"channels": [1]})).unwrap();
+    assert_eq!(clip(&s, a1.0).source_channels, vec![1]);
+    assert!(s.execute("clip.audioChannels", json!({"format": null})).is_err(), "nothing to do: no item selected and no `channels`");
+    assert_eq!(clip(&s, a1.0).source_channels, vec![1], "the existing map must survive a rejected call");
+    assert!(s.execute("clip.audioChannels", json!({})).is_err(), "same with no params at all");
+    assert_eq!(clip(&s, a1.0).source_channels, vec![1]);
+}
+
 #[test]
 fn modify_timecode_and_reset() {
     let mut s = demo();
@@ -1059,3 +1104,60 @@ fn linked_rate_stretch_keeps_one_speed_when_a_neighbour_blocks_the_sound() {
     assert!((pic.speed - sound.speed).abs() < 1e-12);
     assert!((r["speed"].as_f64().unwrap() - 60.0 / 70.0).abs() < 1e-9);
 }
+
+/// #2358: Toggle Animation on a parameter an older effect instance lacks (it was added to the
+/// effect later) creates it from its default and animates it, instead of "no such param".
+#[test]
+fn toggle_animation_creates_a_parameter_missing_from_an_older_instance() {
+    let mut s = crate::Session::default();
+    s.execute("file.openDemoProject", serde_json::json!({})).unwrap();
+    let seq = s.state.active_sequence.unwrap();
+    let clip = s.active_sequence().unwrap().video_tracks[0].items[0].id;
+    // an older project: Motion without its Rotation entry
+    {
+        let p = std::sync::Arc::make_mut(&mut s.project);
+        let q = p.sequence_mut(seq).unwrap();
+        let (_, it) = q.find_item_mut(clip).unwrap();
+        let m = it.effects.iter_mut().find(|e| e.effect == "motion").unwrap();
+        m.params.remove("rotation");
+    }
+    // `"mask": null` is no mask, as in effects.setParam
+    s.execute("effects.toggleAnimation", serde_json::json!({"clip": clip.0, "effect": "motion", "param": "rotation", "mask": null})).unwrap();
+    let it = s.active_sequence().unwrap().find_item(clip).unwrap().1.clone();
+    let rot = it.effect("motion").unwrap().param("rotation").unwrap();
+    assert!(rot.is_animated(), "the stopwatch is on");
+}
+
+/// Transform's Anchor Point and Position are centred in the clip's own picture (on apply and on reset), so Scale grows it
+/// from its centre (they used to be centred in the sequence frame, off to the side of a smaller picture).
+#[test]
+fn applied_transform_centres_its_points_in_the_clip_picture() {
+    let mut s = demo();
+    let r = s.execute("file.newColorMatte", json!({"width": 960, "height": 1080, "color": "#ff0000"})).unwrap();
+    let matte = r["item"].as_u64().unwrap();
+    let r = s.execute("timeline.place", json!({"item": matte, "track": "V3", "seconds": 0.0})).unwrap();
+    let c = r["clips"][0].as_u64().unwrap();
+    s.execute("effects.apply", json!({"clips": [c], "effect": "transform"})).unwrap();
+    let centre = filmcraft_geom::Vec2::new(480.0, 540.0);
+    let point = |s: &Session, k: &str| clip(s, c).effect("transform").unwrap().param(k).unwrap().value.as_vec2().unwrap();
+    assert_eq!(point(&s, "anchor"), centre);
+    assert_eq!(point(&s, "position"), centre);
+    // Reset Effect and Reset Parameter centre them the same way
+    for k in ["anchor", "position"] {
+        s.execute("effects.setParam", json!({"clip": c, "effect": "transform", "param": k, "value": [10.0, 20.0]})).unwrap();
+    }
+    let idx = clip(&s, c).effects.iter().position(|e| e.effect == "transform").unwrap();
+    s.execute("effects.reset", json!({"clip": c, "index": idx})).unwrap();
+    assert_eq!(point(&s, "anchor"), centre);
+    assert_eq!(point(&s, "position"), centre);
+    s.execute("effects.setParam", json!({"clip": c, "effect": "transform", "param": "anchor", "value": [10.0, 20.0]})).unwrap();
+    s.execute("effects.resetParam", json!({"clip": c, "effect": "transform", "param": "anchor"})).unwrap();
+    assert_eq!(point(&s, "anchor"), centre);
+    // intrinsic effects stay centred in the sequence frame when applied to a smaller clip
+    let q = s.active_sequence().unwrap();
+    let frame_centre = filmcraft_geom::Vec2::new(f64::from(q.settings.width) / 2.0, f64::from(q.settings.height) / 2.0);
+    s.execute("effects.apply", json!({"clips": [c], "effect": "motion"})).unwrap();
+    for m in clip(&s, c).effects.iter().filter(|e| e.effect == "motion") {
+        assert_eq!(m.param("position").unwrap().value.as_vec2().unwrap(), frame_centre);
+    }
+}
diff --git a/crates/engine/src/color.rs b/crates/engine/src/color.rs
index 71261bca5..d25270ad5 100644
--- a/crates/engine/src/color.rs
+++ b/crates/engine/src/color.rs
@@ -85,6 +85,9 @@ pub(crate) fn commands() -> Vec<CommandSpec> {
 
 fn import_lut(s: &mut Session, path: &str, name: Option<&str>) -> Result<(String, Value)> {
     let text = std::fs::read_to_string(path).map_err(|e| bad("lut.import", format!("{path}: {e}")))?;
+    if text.len() > filmcraft_project::MAX_LUT_TEXT_BYTES {
+        return Err(bad("lut.import", format!("{path}: LUT source exceeds the {} byte limit", filmcraft_project::MAX_LUT_TEXT_BYTES)));
+    }
     let fmt = LutFormat::from_path(path).ok_or_else(|| bad("lut.import", "expected a .cube or .3dl file"))?;
     let lut = Lut::parse(&text, Some(fmt)).map_err(|e| bad("lut.import", format!("{path}: {e}")))?;
     let stem = std::path::Path::new(path).file_stem().map(|s| s.to_string_lossy().to_string()).unwrap_or_else(|| "LUT".into());
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index f7737f571..5784fa823 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -79,6 +79,11 @@ pub(crate) fn has_selection(s: &Session) -> std::result::Result<(), String> {
     has_seq(s)?;
     if s.state.selection.is_empty() { Err("no clips selected".into()) } else { Ok(()) }
 }
+/// Clips or captions selected (Copy / Cut work on either).
+fn has_clips_or_captions(s: &Session) -> std::result::Result<(), String> {
+    has_seq(s)?;
+    if s.state.selection.is_empty() && s.state.caption_selection.is_empty() { Err("no clips or captions selected".into()) } else { Ok(()) }
+}
 /// Clips or captions selected (Clear / Ripple Delete work on either).
 fn has_any_selection(s: &Session) -> std::result::Result<(), String> {
     has_seq(s)?;
@@ -107,6 +112,9 @@ fn can_undo(s: &Session) -> std::result::Result<(), String> {
 fn can_redo(s: &Session) -> std::result::Result<(), String> {
     if s.history.can_redo() { Ok(()) } else { Err("nothing to redo".into()) }
 }
+fn has_history(s: &Session) -> std::result::Result<(), String> {
+    if s.history.can_undo() || s.history.can_redo() { Ok(()) } else { Err("the history is empty".into()) }
+}
 fn has_in_out(s: &Session) -> std::result::Result<(), String> {
     let seq = s.active_sequence().ok_or("no sequence is open")?;
     if seq.mark_in.is_some() || seq.mark_out.is_some() { Ok(()) } else { Err("mark an In or Out point first".into()) }
@@ -120,7 +128,7 @@ pub(crate) fn has_project_selection(s: &Session) -> std::result::Result<(), Stri
 }
 fn has_clipboard(s: &Session) -> std::result::Result<(), String> {
     has_seq(s)?;
-    if s.state.clipboard.is_empty() { Err("clipboard is empty".into()) } else { Ok(()) }
+    if s.state.clipboard.is_empty() && s.state.caption_clipboard.is_empty() { Err("clipboard is empty".into()) } else { Ok(()) }
 }
 
 /// The ids a caller named under `many` (a list) or `one` (a single id), when the command documents
@@ -344,10 +352,10 @@ pub(crate) fn item_p(p: &Value, k: &str) -> Option<ItemId> {
 /// as `copied`.
 fn move_clips(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "timeline.move";
-    let mut listed: Vec<(ClipId, TrackId, Tick)> = Vec::new();
-    let mut new_moves = Vec::new();
+    let mut listed: Vec<(ClipId, TrackId, Tick, bool)> = Vec::new();
     for m in p.get("moves").and_then(Value::as_array).into_iter().flatten() {
-        let track = if str_p(m, "track").is_some_and(|t| t.eq_ignore_ascii_case("new")) {
+        let new_track = str_p(m, "track").is_some_and(|t| t.eq_ignore_ascii_case("new"));
+        let track = if new_track {
             let clip = clip_p(m, "clip").ok_or_else(|| bad(CMD, "new track needs a clip"))?;
             let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
             let (source, _) = q.find_item(clip).ok_or(edit::EditError::NoItem(clip))?;
@@ -357,13 +365,12 @@ fn move_clips(s: &mut Session, p: &Value) -> Result<Value> {
             if m.get("time").and_then(Value::as_i64).is_none() {
                 return Err(bad(CMD, "new track needs a time"));
             }
-            new_moves.push((clip, source));
             Some(source)
         } else {
             track_p(s, m, "track", CMD)?
         };
         if let (Some(clip), Some(track), Some(time)) = (clip_p(m, "clip"), track, m.get("time").and_then(Value::as_i64)) {
-            listed.push((clip, track, Tick(time)));
+            listed.push((clip, track, Tick(time), new_track));
         }
     }
     if listed.is_empty() {
@@ -371,32 +378,32 @@ fn move_clips(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let follow = bool_p(p, "linked").unwrap_or(s.state.linked_selection);
     let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
-    // (clip, destination track, new start, where a partner starts now). `time` is any i64: the
-    // sums are done in i128, where a few i64 values cannot overflow, and checked on the way back.
-    let mut plan: Vec<(ClipId, TrackId, i128, Option<i128>)> = Vec::new();
-    for &(clip, track, time) in &listed {
-        plan.push((clip, track, i128::from(time.0), None));
+    // (clip, destination track, new start, where a partner starts now, new track requested).
+    // `time` is any i64: sums use i128 and are checked on the way back.
+    let mut plan: Vec<(ClipId, TrackId, i128, Option<i128>, bool)> = Vec::new();
+    for &(clip, track, time, new_track) in &listed {
+        plan.push((clip, track, i128::from(time.0), None, new_track));
         let Some((_, it)) = q.find_item(clip) else { continue }; // `edit::move_items` reports it
         let Some(link) = it.link.filter(|_| follow) else { continue };
         let offset = i128::from(time.0) - i128::from(it.start.0);
         for t in q.all_tracks().filter(|t| !t.locked) {
             for partner in t.items.iter().filter(|i| i.link == Some(link)) {
                 if !listed.iter().any(|m| m.0 == partner.id) && !plan.iter().any(|m| m.0 == partner.id) {
-                    plan.push((partner.id, t.id, i128::from(partner.start.0) + offset, Some(i128::from(partner.start.0))));
+                    plan.push((partner.id, t.id, i128::from(partner.start.0) + offset, Some(i128::from(partner.start.0)), false));
                 }
             }
         }
     }
     let late = plan.iter().map(|m| -m.2).max().unwrap_or(0).max(0);
-    let mut moves: Vec<(ClipId, TrackId, Tick)> = Vec::with_capacity(plan.len());
-    for (clip, track, start, was) in plan {
+    let mut moves: Vec<(ClipId, TrackId, Tick, bool)> = Vec::with_capacity(plan.len());
+    for (clip, track, start, was, new_track) in plan {
         // a partner that ends up where it is does not move (its listed clip only changed track):
         // re-placing it would drop the transitions at its edges
         if was == Some(start + late) {
             continue;
         }
         let start = i64::try_from(start + late).ok().map(Tick).filter(|t| *t <= Tick::MAX).ok_or_else(|| bad(CMD, "`time` is out of range"))?;
-        moves.push((clip, track, start));
+        moves.push((clip, track, start, new_track));
     }
     let ins = bool_p(p, "insert").unwrap_or(false);
     let copy = bool_p(p, "copy").unwrap_or(false);
@@ -409,7 +416,7 @@ fn move_clips(s: &mut Session, p: &Value) -> Result<Value> {
     // Allocate destinations in the same transaction as the move: an invalid edit leaves
     // neither empty tracks nor history entries. Each source track keeps its clips together.
     let prepare = |q: &mut filmcraft_project::Sequence, ctx: &mut edit::EditCtx<'_>| -> Result<Vec<(ClipId, TrackId, Tick)>> {
-        let sources: Vec<_> = q.all_tracks().filter(|t| new_moves.iter().any(|m| m.1 == t.id)).map(|t| (t.id, t.kind, t.channels)).collect();
+        let sources: Vec<_> = q.all_tracks().filter(|t| moves.iter().any(|m| m.3 && m.1 == t.id)).map(|t| (t.id, t.kind, t.channels)).collect();
         for kind in [TrackKind::Video, TrackKind::Audio] {
             let added = sources.iter().filter(|s| s.1 == kind).count();
             if added > 0 && q.tracks(kind).len().saturating_add(added) > crate::sequence_tools::MAX_TRACKS {
@@ -428,8 +435,9 @@ fn move_clips(s: &mut Session, p: &Value) -> Result<Value> {
         }
         Ok(moves
             .iter()
-            .map(|&(clip, track, time)| {
-                let dest = new_moves.iter().find(|m| m.0 == clip).and_then(|m| destinations.iter().find(|d| d.0 == m.1)).map_or(track, |d| d.1);
+            .map(|&(clip, track, time, new_track)| {
+                // A copy can list the same source again with a different destination.
+                let dest = destinations.iter().find(|d| new_track && d.0 == track).map_or(track, |d| d.1);
                 (clip, dest, time)
             })
             .collect())
@@ -575,12 +583,17 @@ pub fn linked_roll_pairs(seq: &filmcraft_project::Sequence, left: ClipId, right:
     pairs
 }
 
-/// Expand a clip selection with linked partners (when linked selection is on).
+/// Keep each selected identity once, then expand linked partners when linked selection is on.
 pub fn with_links(s: &Session, clips: &[ClipId]) -> Vec<ClipId> {
-    let Some(seq) = s.active_sequence() else { return clips.to_vec() };
-    let mut out = clips.to_vec();
+    let mut out = Vec::new();
+    for c in clips {
+        if !out.contains(c) {
+            out.push(*c);
+        }
+    }
+    let Some(seq) = s.active_sequence() else { return out };
     if s.state.linked_selection {
-        let links: Vec<u64> = clips.iter().filter_map(|c| seq.find_item(*c).and_then(|(_, i)| i.link)).collect();
+        let links: Vec<u64> = out.iter().filter_map(|c| seq.find_item(*c).and_then(|(_, i)| i.link)).collect();
         for t in seq.all_tracks() {
             for i in &t.items {
                 if i.link.is_some_and(|l| links.contains(&l)) && !out.contains(&i.id) {
@@ -619,12 +632,59 @@ fn clamp_trim_linked(q: &filmcraft_project::Sequence, clips: &[ClipId], edge: Ed
 /// trim drag shows this, so the edge stops at the end of the media or the neighbouring clip
 /// instead of following the pointer past it (#653).
 pub fn trim_delta(s: &Session, clip: ClipId, edge: Edge, mode: TrimMode, delta: Tick) -> Result<Tick> {
+    trim_delta_linked(s, clip, edge, mode, delta, true)
+}
+
+/// [`trim_delta`] for a trim that, with `linked` false (Alt held), leaves the clip's linked
+/// partners alone (#3300).
+pub fn trim_delta_linked(s: &Session, clip: ClipId, edge: Edge, mode: TrimMode, delta: Tick, linked: bool) -> Result<Tick> {
     let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
     let durations = |id: ItemId| crate::media_duration(&s.project, &s.media, id);
     let starts = |id: ItemId| crate::media_start(&s.project, id);
     let mut next = s.project.next_id;
     let ctx = edit::EditCtx { next_id: &mut next, media_duration: &durations, media_start: &starts, min_duration: q.settings.frame_rate.frame_duration() };
-    clamp_trim_linked(q, &with_links(s, &[clip]), edge, mode, delta, &ctx)
+    let clips = if linked { with_links(s, &[clip]) } else { vec![clip] };
+    clamp_trim_linked(q, &clips, edge, mode, delta, &ctx)
+}
+
+/// `clip` and, unless `p` has `"linked": false` (Alt held), its linked partners.
+fn with_links_p(s: &Session, p: &Value, clip: ClipId) -> Vec<ClipId> {
+    if bool_p(p, "linked").unwrap_or(true) { with_links(s, &[clip]) } else { vec![clip] }
+}
+
+/// The delta a roll of every cut in `pairs` can apply together: `delta` clamped by each pair's
+/// media and the frame left in each clip, each tried on a copy of `q`. 0 when a pair would roll
+/// by another amount (a clip whose Out point is past the end of its media rolls the other way).
+fn clamp_roll_linked(q: &filmcraft_project::Sequence, pairs: &[(ClipId, ClipId)], delta: Tick, ctx: &mut edit::EditCtx) -> Result<Tick> {
+    let mut d = delta;
+    for &(pl, pr) in pairs {
+        let mut probe = q.clone();
+        let x = edit::roll(&mut probe, pl, pr, d, ctx)?;
+        if x.abs() < d.abs() {
+            d = x;
+        }
+    }
+    if d != Tick::ZERO {
+        for &(pl, pr) in pairs {
+            let mut probe = q.clone();
+            if edit::roll(&mut probe, pl, pr, d, ctx)? != d {
+                return Ok(Tick::ZERO);
+            }
+        }
+    }
+    Ok(d)
+}
+
+/// The delta `timeline.roll` would apply for `delta`, without editing anything: the Timeline's
+/// Rolling Edit drag shows this, so the cut stops where the roll on release stops instead of
+/// following the pointer past the media.
+pub fn roll_delta(s: &Session, left: ClipId, right: ClipId, delta: Tick) -> Result<Tick> {
+    let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
+    let durations = |id: ItemId| crate::media_duration(&s.project, &s.media, id);
+    let starts = |id: ItemId| crate::media_start(&s.project, id);
+    let mut next = s.project.next_id;
+    let mut ctx = edit::EditCtx { next_id: &mut next, media_duration: &durations, media_start: &starts, min_duration: q.settings.frame_rate.frame_duration() };
+    clamp_roll_linked(q, &linked_roll_pairs(q, left, right, s.state.linked_selection), delta, &mut ctx)
 }
 
 /// Sequence settings matching a media clip (New Sequence From Clip, New Sequence from an item):
@@ -1134,12 +1194,14 @@ fn marker_list_mut(s: &mut Session) -> Result<(ItemId, Tick)> {
     Ok((seq, s.playhead()))
 }
 
+/// Builds the command registry shared by the UI, CLI and control interfaces.
 fn build() -> Vec<CommandSpec> {
     let mut v = vec![
         // ================= File =================
         cmd!("file.newProject", "Project…", ["File", "New"], Some("Cmd+Alt+N"), r#"{"name":str}"#, always, |s, p| {
             let name = str_p(p, "name").unwrap_or("Untitled").to_string();
             s.project = std::sync::Arc::new(filmcraft_project::Project::new(&name));
+            s.document_epoch = s.document_epoch.wrapping_add(1);
             s.history = Default::default();
             s.history.limit = 200;
             s.state = crate::Session::default().state;
@@ -1149,11 +1211,13 @@ fn build() -> Vec<CommandSpec> {
             s.revision += 1;
             s.saved_revision = s.revision;
             s.events.push(crate::Event::ProjectChanged { revision: s.revision });
-            Ok(Value::Null)
+            // the project as `project_inspect` names it (#1545: an agent needs no extra round trip)
+            Ok(json!({"name": name, "revision": s.revision}))
         }),
         cmd!("file.openDemoProject", "Demo Project", ["File", "New"], None, "{}", always, |s, _| {
             let (p, seq) = crate::demo::demo_project(&s.media);
             s.project = std::sync::Arc::new(p);
+            s.document_epoch = s.document_epoch.wrapping_add(1);
             s.history = Default::default();
             s.history.limit = 200;
             s.state = crate::Session::default().state;
@@ -1521,18 +1585,27 @@ fn build() -> Vec<CommandSpec> {
             let all = bool_p(p, "all").unwrap_or(false);
             let id = str_p(p, "id").map(str::to_string);
             let Some(per) = s.persistence.as_mut() else { return Ok(json!({"discarded": 0})) };
-            let mut n = 0;
+            let mut n = 0usize;
             let mut keep = Vec::new();
+            let mut failure = None;
             for (i, c) in std::mem::take(&mut per.candidates).into_iter().enumerate() {
                 let hit = all || id.as_deref().map_or(i == 0, |want| want == c.id);
-                if hit {
-                    crate::autosave::discard_candidate(&c).map_err(|e| EngineError::Other(e.to_string()))?;
-                    n += 1;
+                if hit && failure.is_none() {
+                    match crate::autosave::discard_candidate(&c) {
+                        Ok(()) => n = n.saturating_add(1),
+                        Err(e) => {
+                            failure = Some(EngineError::Other(format!("could not discard recovery session {}: {e}", c.id)));
+                            keep.push(c);
+                        }
+                    }
                 } else {
                     keep.push(c);
                 }
             }
             per.candidates = keep;
+            if let Some(e) = failure {
+                return Err(e);
+            }
             if n == 0 {
                 return Err(bad("file.discardRecovery", "no such recovery session"));
             }
@@ -1615,7 +1688,16 @@ fn build() -> Vec<CommandSpec> {
         // ================= Edit =================
         cmd!("edit.undo", "Undo", ["Edit"], Some("Cmd+Z"), "{}", can_undo, |s, _| Ok(json!({"undone": s.undo()}))),
         cmd!("edit.redo", "Redo", ["Edit"], Some("Cmd+Shift+Z"), "{}", can_redo, |s, _| Ok(json!({"redone": s.redo()}))),
-        cmd!("edit.cut", "Cut", ["Edit"], Some("Cmd+X"), "{}", has_selection, |s, _| {
+        // the History panel menu; neither one changes the project or its unsaved state
+        cmd!("history.deleteRedoable", "Delete Redoable Actions", [], None, "{}", can_redo, |s, _| Ok(json!({"deleted": s.history.delete_redoable()}))),
+        cmd!("history.clear", "Clear History", [], None, "{}", has_history, |s, _| Ok(json!({"deleted": s.history.clear()}))),
+        cmd!("edit.cut", "Cut", ["Edit"], Some("Cmd+X"), "{}", has_clips_or_captions, |s, _| {
+            if s.state.selection.is_empty() {
+                crate::captions::copy(s);
+                let caps = s.state.caption_selection.clone();
+                crate::captions::delete(s, &caps, false)?;
+                return Ok(Value::Null);
+            }
             copy_selection(s);
             let sel = with_links(s, &s.state.selection.clone());
             s.edit_sequence("Cut", |q, _, st| {
@@ -1625,7 +1707,10 @@ fn build() -> Vec<CommandSpec> {
             })?;
             Ok(Value::Null)
         }),
-        cmd!("edit.copy", "Copy", ["Edit"], Some("Cmd+C"), "{}", has_selection, |s, _| {
+        cmd!("edit.copy", "Copy", ["Edit"], Some("Cmd+C"), "{}", has_clips_or_captions, |s, _| {
+            if s.state.selection.is_empty() {
+                return Ok(json!({"copied": crate::captions::copy(s)}));
+            }
             copy_selection(s);
             Ok(json!({"copied": s.state.clipboard.len()}))
         }),
@@ -1850,7 +1935,8 @@ fn build() -> Vec<CommandSpec> {
         // Each clip flips on its own, as in Premiere (#484): with one enabled and one disabled clip
         // selected, Enable swaps them rather than first making both the same.
         cmd!("clip.enable", "Enable", ["Clip"], Some("Shift+E"), r#"{"clips":[id]?}"#, has_selection, |s, p| {
-            let mut sel = with_links(s, &clips_p(s, p));
+            // An Alt selection is already exact (#3031); explicit targets keep the linked behavior.
+            let mut sel = if p.get("clips").is_some() || p.get("clip").is_some() { with_links(s, &clips_p(s, p)) } else { s.state.selection.clone() };
             // a clip named twice must still flip once
             sel.sort();
             sel.dedup();
@@ -1866,11 +1952,24 @@ fn build() -> Vec<CommandSpec> {
         }),
         cmd!("clip.link", "Link", ["Clip"], Some("Cmd+L"), r#"{"clips":[id]?}"#, has_selection, |s, p| {
             let sel = clips_p(s, p);
-            let linked = sel.iter().all(|c| s.active_sequence().and_then(|q| q.find_item(*c)).is_some_and(|(_, i)| i.link.is_some()));
+            // Unlink when any selected clip is linked, as the Timeline's context menu says (#1103):
+            // a title or a music clip among the selection must not turn Unlink into a re-link
+            let linked = sel.iter().any(|c| s.active_sequence().and_then(|q| q.find_item(*c)).is_some_and(|(_, i)| i.link.is_some()));
             s.edit_sequence(if linked { "Unlink" } else { "Link" }, |q, ctx, _| {
                 if linked {
+                    let mut links = Vec::new();
                     for c in &sel {
                         if let Some((_, i)) = q.find_item_mut(*c) {
+                            links.extend(i.link.take());
+                        }
+                    }
+                    // a partner left alone in its link (one half unlinked on its own) is unlinked
+                    // too: a one-member link would read as "linked" with nothing to follow
+                    for l in links {
+                        let members: Vec<ClipId> = q.all_tracks().flat_map(|t| t.items.iter()).filter(|i| i.link == Some(l)).map(|i| i.id).collect();
+                        if let [lonely] = members[..]
+                            && let Some((_, i)) = q.find_item_mut(lonely)
+                        {
                             i.link = None;
                         }
                     }
@@ -2080,13 +2179,19 @@ fn build() -> Vec<CommandSpec> {
         cmd!("sequence.lift", "Lift", ["Sequence"], Some(";"), "{}", has_in_out, |s, _| {
             let r = in_out_range(s)?;
             let tg = s.targeting().targeted;
-            s.edit_sequence("Lift", |q, ctx, _| Ok(edit::lift(q, &tg, r, ctx)))?;
-            Ok(Value::Null)
+            let cut = s.edit_sequence("Lift", |q, ctx, st| {
+                let cut = cut_range(q, &tg, r, ctx, st.copy_paste_sequence_markers);
+                edit::lift(q, &tg, r, ctx);
+                Ok(cut)
+            })?;
+            let copied = store_cut(s, cut);
+            Ok(json!({"copied": copied}))
         }),
         cmd!("sequence.extract", "Extract", ["Sequence"], Some("'"), "{}", has_in_out, |s, _| {
             let r = in_out_range(s)?;
             let tg = s.targeting().targeted;
-            s.edit_sequence("Extract", |q, ctx, st| {
+            let cut = s.edit_sequence("Extract", |q, ctx, st| {
+                let cut = cut_range(q, &tg, r, ctx, st.copy_paste_sequence_markers);
                 edit::extract(q, &tg, r, ctx);
                 if st.ripple_sequence_markers {
                     crate::sequence_tools::ripple_markers(&mut q.markers, r.end(), -r.duration);
@@ -2094,10 +2199,11 @@ fn build() -> Vec<CommandSpec> {
                 q.mark_in = None;
                 q.mark_out = None;
                 q.split = Default::default();
-                Ok(())
+                Ok(cut)
             })?;
+            let copied = store_cut(s, cut);
             s.set_playhead(r.start);
-            Ok(Value::Null)
+            Ok(json!({"copied": copied}))
         }),
         cmd!(
             "sequence.applyVideoTransition",
@@ -2137,12 +2243,14 @@ fn build() -> Vec<CommandSpec> {
             remove_transitions(s, &ids, "Clear Transition")
         }),
         cmd!("sequence.closeGap", "Close Gap", ["Sequence"], None, r#"{"track":"V1"|id?,"time":ticks?}"#, has_seq, |s, p| {
-            // Shortcuts and menus have no parameters. Resolve that form from the selected gap
-            // (#1135); explicit requests keep their existing track/time validation.
+            // Shortcuts and menus have no parameters. That form closes the selected gap (#1135),
+            // or with none selected every gap between In and Out, as Premiere's Sequence ▸ Close
+            // Gap does (#1986); explicit requests keep their existing track/time validation.
             if p.as_object().is_some_and(|p| p.is_empty()) {
-                let gap = s.state.gap_selection.ok_or_else(|| bad("sequence.closeGap", "select a gap or provide `track`"))?;
-                ripple_delete_gap(s, gap)?;
-                return Ok(Value::Null);
+                return match s.state.gap_selection {
+                    Some(gap) => ripple_delete_gap(s, gap).map(|_| Value::Null),
+                    None => close_sequence_gaps(s),
+                };
             }
             let tr = track_p(s, p, "track", "sequence.closeGap")?.ok_or_else(|| bad("sequence.closeGap", "need `track`"))?;
             let t = time_p(s, p, "").unwrap_or(s.playhead());
@@ -2266,6 +2374,55 @@ fn build() -> Vec<CommandSpec> {
             crate::previews::delete(s, true)
         }),
         query!("sequence.renderBar", "Render Bar", "{}", |s, _| crate::previews::bar_json(s)),
+        // ================= Work area bar =================
+        cmd!("sequence.workAreaBar", "Work Area Bar", [], None, r#"{"show":bool?}"#, has_seq, |s, p| {
+            let shown = s.active_sequence().ok_or(EngineError::NoSequence)?.work_area.is_some();
+            let show = bool_p(p, "show").unwrap_or(!shown);
+            if show == shown {
+                return Ok(json!({"show": show}));
+            }
+            let fd = s.sequence_rate().frame_duration();
+            s.edit_sequence("Work Area Bar", |q, _, _| {
+                // shown again, the bar spans the whole sequence
+                q.work_area = show.then(|| TimeRange::from_bounds(Tick::ZERO, q.duration().max(fd)));
+                Ok(())
+            })?;
+            Ok(json!({"show": show}))
+        }),
+        cmd!(
+            "sequence.setWorkAreaIn",
+            "Set Work Area Bar In Point",
+            [],
+            None,
+            r#"{"time":ticks?,"frame":i64?,"seconds":f64?,"timecode":str?}"#,
+            has_seq,
+            |s, p| set_work_area_point(s, p, true)
+        ),
+        cmd!(
+            "sequence.setWorkAreaOut",
+            "Set Work Area Bar Out Point",
+            [],
+            None,
+            r#"{"time":ticks?,"frame":i64?,"seconds":f64?,"timecode":str?}"#,
+            has_seq,
+            |s, p| set_work_area_point(s, p, false)
+        ),
+        cmd!("sequence.setWorkArea", "Set Work Area", [], None, r#"{"start":ticks,"end":ticks}"#, has_seq, |s, p| {
+            const CMD: &str = "sequence.setWorkArea";
+            let tick = |key: &str| p.get(key).and_then(Value::as_i64).map(Tick).ok_or_else(|| bad(CMD, format!("need `{key}` (ticks)")));
+            let (start, end) = (tick("start")?, tick("end")?);
+            if start < Tick::ZERO {
+                return Err(bad(CMD, "`start` must not be negative"));
+            }
+            if end <= start {
+                return Err(bad(CMD, "`end` must be after `start`"));
+            }
+            s.edit_sequence("Set Work Area", |q, _, _| {
+                q.work_area = Some(TimeRange::from_bounds(start, end));
+                Ok(())
+            })?;
+            Ok(json!({"start": start.0, "end": end.0}))
+        }),
         cmd!("sequence.matchFrame", "Match Frame", ["Sequence"], Some("F"), "{}", has_seq, |s, _| {
             let t = s.playhead();
             let seq = s.active_sequence().ok_or(EngineError::NoSequence)?;
@@ -2636,7 +2793,7 @@ fn build() -> Vec<CommandSpec> {
             "Trim Edit",
             [],
             None,
-            r#"{"clip":id,"edge":"in|out","mode":"regular|ripple","delta":ticks|"deltaFrames":i64}"#,
+            r#"{"clip":id,"edge":"in|out","mode":"regular|ripple","delta":ticks|"deltaFrames":i64,"linked":bool?}"#,
             has_seq,
             |s, p| {
                 let c = clip_p(p, "clip").ok_or_else(|| bad("timeline.trim", "need `clip`"))?;
@@ -2648,7 +2805,7 @@ fn build() -> Vec<CommandSpec> {
                     .map(Tick)
                     .or_else(|| p.get("deltaFrames").and_then(Value::as_i64).map(|f| s.sequence_rate().tick_of(f)))
                     .unwrap_or_default();
-                let clips = with_links(s, &[c]);
+                let clips = with_links_p(s, p, c);
                 let applied = s.edit_sequence(if mode == TrimMode::Ripple { "Ripple Trim" } else { "Trim" }, |q, ctx, st| {
                     if q.find_item(c).is_some_and(|(t, _)| q.track(t).is_some_and(|tr| tr.locked)) {
                         return Err(edit::EditError::Locked.into());
@@ -2771,19 +2928,12 @@ fn build() -> Vec<CommandSpec> {
                 .map(Tick)
                 .or_else(|| p.get("deltaFrames").and_then(Value::as_i64).map(|f| s.sequence_rate().tick_of(f)))
                 .unwrap_or_default();
-            // `followLinks: false` rolls only this pair: Trim mode already lists linked partners as edit points of their own
+            // `followLinks: false` rolls only this pair; the default clamps linked cuts together.
             let follow = s.state.linked_selection && p.get("followLinks").and_then(Value::as_bool).unwrap_or(true);
             let (x, n, linked) = s.edit_sequence("Rolling Edit", |q, ctx, _| {
                 let pairs = linked_roll_pairs(q, l, r, follow);
                 let linked = pairs.len() > 1;
-                let mut d = d;
-                for &(pl, pr) in &pairs {
-                    let mut probe = q.clone();
-                    let x = edit::roll(&mut probe, pl, pr, d, ctx)?;
-                    if x.abs() < d.abs() {
-                        d = x;
-                    }
-                }
+                let d = clamp_roll_linked(q, &pairs, d, ctx)?;
                 if d != Tick::ZERO {
                     for &(pl, pr) in &pairs {
                         edit::roll(q, pl, pr, d, ctx)?;
@@ -2829,7 +2979,7 @@ fn build() -> Vec<CommandSpec> {
             })?;
             Ok(Value::Null)
         }),
-        cmd!("timeline.rateStretch", "Rate Stretch", [], None, r#"{"clip":id,"edge":"in|out","delta":ticks}"#, has_seq, |s, p| {
+        cmd!("timeline.rateStretch", "Rate Stretch", [], None, r#"{"clip":id,"edge":"in|out","delta":ticks,"linked":bool?}"#, has_seq, |s, p| {
             let c = clip_p(p, "clip").ok_or_else(|| bad("timeline.rateStretch", "need `clip`"))?;
             let edge = if str_p(p, "edge") == Some("in") { Edge::In } else { Edge::Out };
             let d = p
@@ -2838,7 +2988,7 @@ fn build() -> Vec<CommandSpec> {
                 .map(Tick)
                 .or_else(|| p.get("deltaFrames").and_then(Value::as_i64).map(|f| s.sequence_rate().tick_of(f)))
                 .unwrap_or_default();
-            let clips = with_links(s, &[c]);
+            let clips = with_links_p(s, p, c);
             let sp = s.edit_sequence("Rate Stretch", |q, ctx, _| Ok(edit::rate_stretch_items(q, &clips, edge, d, ctx)?))?;
             Ok(json!({"speed": sp}))
         }),
@@ -2860,10 +3010,17 @@ fn build() -> Vec<CommandSpec> {
             "Track Settings",
             [],
             None,
-            r#"{"track":"V1"|id,"locked":bool?,"syncLock":bool?,"enabled":bool?,"muted":bool?,"solo":bool?,"name":str?,"volumeDb":f64?,"pan":f64?}"#,
+            r#"{"track":"V1"|id,"locked":bool?,"syncLock":bool?,"enabled":bool?,"muted":bool?,"solo":bool?,"name":str?,"volumeDb":f64?,"pan":f64?,"label":"Violet|Iris|…"|""|null?}"#,
             has_seq,
             |s, p| {
                 let tr = track_p(s, p, "track", "timeline.setTrack")?.ok_or_else(|| bad("timeline.setTrack", "need `track`"))?;
+                // colour label: a label name, or "" / "None" / null for no colour
+                let label = match p.get("label") {
+                    None => None,
+                    Some(Value::Null) => Some(None),
+                    Some(Value::String(n)) if n.is_empty() || n.eq_ignore_ascii_case("none") => Some(None),
+                    Some(v) => Some(Some(v.as_str().and_then(Label::from_name).ok_or_else(|| bad("timeline.setTrack", format!("unknown label {v}")))?)),
+                };
                 let p = p.clone();
                 s.edit_sequence("Track Settings", |q, _, _| {
                     let t = q.track_mut(tr).ok_or(filmcraft_edit::EditError::NoTrack(tr))?;
@@ -2891,6 +3048,9 @@ fn build() -> Vec<CommandSpec> {
                     if let Some(v) = f64_p(&p, "pan") {
                         t.pan = v.clamp(-100.0, 100.0);
                     }
+                    if let Some(l) = label {
+                        t.label = l;
+                    }
                     Ok(())
                 })?;
                 Ok(Value::Null)
@@ -2945,25 +3105,37 @@ fn build() -> Vec<CommandSpec> {
             }
             let (fw, fh) = s.active_sequence().map(|q| (q.settings.width, q.settings.height)).unwrap_or((1920, 1080));
             let label = format!("Apply {}", def.name);
-            s.edit_sequence(&label, |q, _, _| {
-                let mut n = 0;
+            // standard effects run on the clip's source picture, so "auto" points (the centre) are
+            // measured in it, not in the sequence frame
+            let source_sizes: std::collections::BTreeMap<ClipId, (u32, u32)> = s
+                .active_sequence()
+                .map(|q| clips.iter().filter_map(|c| q.find_item(*c).and_then(|(_, i)| s.project.source_size(i.item)).map(|sz| (*c, sz))).collect())
+                .unwrap_or_default();
+            // Answer `{"applied":[{"clip","index","effect"}]}`: where each instance landed, so an
+            // agent can address it (`effects.setParam`, `effects.remove`) without a `sequence_inspect`
+            // round trip, as `timeline.place` answers with its clips (#1545).
+            let applied = s.edit_sequence(&label, |q, _, _| {
+                let mut applied = Vec::new();
                 for t in q.all_tracks_mut() {
                     if (t.kind == TrackKind::Audio) != is_audio {
                         continue;
                     }
                     for i in t.items.iter_mut().filter(|i| clips.contains(&i.id)) {
                         let mut inst = def.instance();
-                        resolve_auto_points(&mut inst, (fw, fh), (fw, fh));
+                        let size = source_sizes.get(&i.id).copied().unwrap_or((fw, fh));
+                        // intrinsic effects (Motion) are laid out in the sequence frame, as `reset_params` does
+                        let frame = if def.intrinsic { (fw, fh) } else { size };
+                        resolve_auto_points(&mut inst, frame, size);
                         // standard effects go before the intrinsic ones (render order)
                         let pos = i.effects.iter().position(|e| e.def().is_some_and(|d| d.intrinsic)).unwrap_or(i.effects.len());
                         let pos = if is_audio { i.effects.len() } else { pos };
                         i.effects.insert(pos, inst);
-                        n += 1;
+                        applied.push(json!({"clip": i.id.0, "index": pos, "effect": def.id}));
                     }
                 }
-                Ok(n)
+                Ok(applied)
             })?;
-            Ok(Value::Null)
+            Ok(json!({"applied": applied}))
         }),
         cmd!("effects.remove", "Remove Effect", [], None, r#"{"clip":id,"index":n}"#, has_seq, |s, p| {
             let c = clip_p(p, "clip").ok_or_else(|| bad("effects.remove", "need `clip`"))?;
@@ -3030,7 +3202,7 @@ fn build() -> Vec<CommandSpec> {
                 if bool_p(p, "begin").unwrap_or(false) {
                     s.history.merge_key = None;
                 }
-                let keyframes = s.edit_sequence_as("Change Effect Parameter", merge.as_deref(), |q, _, _| {
+                let (keyframes, value) = s.edit_sequence_as("Change Effect Parameter", merge.as_deref(), |q, _, _| {
                     let (_, it) = q.find_item_mut(c).ok_or(filmcraft_edit::EditError::NoItem(c))?;
                     let mt = it.source_time_at(at.unwrap_or_else(|| ph.clamp(it.start, (it.end() - Tick(1)).max(it.start))));
                     let e = match &eff {
@@ -3067,6 +3239,13 @@ fn build() -> Vec<CommandSpec> {
                     let (keyframes, v) = {
                         let prm = crate::masks::target_param(e, &pq, &pid).ok_or_else(|| bad("effects.setParam", format!("no param `{pid}`")))?;
                         let v = json_to_param(&prm.value, &val).ok_or_else(|| bad("effects.setParam", "value has the wrong type"))?;
+                        // the parameter's hard range, which `effects.list` publishes: a value outside it
+                        // (a factor where a percentage is meant, #2679) is refused, not saved
+                        if let (Some(filmcraft_project::ParamKind::Float { min, max, .. }), ParamValue::Float(x)) = (def.map(|d| &d.kind), &v)
+                            && !(*min..=*max).contains(x)
+                        {
+                            return Err(bad("effects.setParam", format!("`{pid}` must be between {min} and {max}, got {x}")));
+                        }
                         let keyframes = if keyframe {
                             // the stopwatch and the value in one step
                             prm.put_keyframe(mt, v.clone());
@@ -3077,6 +3256,8 @@ fn build() -> Vec<CommandSpec> {
                         };
                         (keyframes, v)
                     };
+                    let accepted_value = param_value_to_json(&v);
+
                     if e.effect == "ultra_key"
                         && pid == "setting"
                         && let ParamValue::Choice(setting) = v
@@ -3091,10 +3272,10 @@ fn build() -> Vec<CommandSpec> {
                             }
                         }
                     }
-                    Ok(keyframes)
+                    Ok((keyframes, accepted_value))
                 })?;
                 // 0 keyframes: the value is static (`time` was not used)
-                Ok(json!({"keyframes": keyframes}))
+                Ok(json!({"keyframes": keyframes, "param": pid, "value": value}))
             }
         ),
         cmd!("effects.toggleAnimation", "Toggle Animation", [], None, r#"{"clip":id,"effect":str|index,"param":str,"mask":n?}"#, has_seq, |s, p| {
@@ -3111,6 +3292,14 @@ fn build() -> Vec<CommandSpec> {
                     _ => None,
                 }
                 .ok_or_else(|| bad("effects.toggleAnimation", "no such effect"))?;
+                // a parameter an older instance lacks (added to the effect later) starts from its
+                // default, as the UI shows it, without touching an existing one
+                if p.get("mask").is_none_or(Value::is_null)
+                    && !e.params.contains_key(&pid)
+                    && let Some(d) = e.def().and_then(|d| d.param(&pid))
+                {
+                    e.params.insert(pid.clone(), filmcraft_project::Param::new(d.default.clone()));
+                }
                 crate::masks::target_param(e, p, &pid).ok_or_else(|| bad("effects.toggleAnimation", "no such param"))?.toggle_animation(mt);
                 Ok(())
             })?;
@@ -3132,12 +3321,13 @@ fn build() -> Vec<CommandSpec> {
             let c = clip_p(p, "clip").ok_or_else(|| bad("effects.reset", "need `clip`"))?;
             let idx = u64_p(p, "index").unwrap_or(0) as usize;
             let frame = s.active_sequence().map(|q| (q.settings.width, q.settings.height)).unwrap_or((1920, 1080));
+            let source = s.active_sequence().and_then(|q| q.find_item(c)).and_then(|(_, i)| s.project.source_size(i.item)).unwrap_or(frame);
             let ph = s.playhead();
             s.edit_sequence("Reset Effect", |q, _, _| {
                 let (_, it) = q.find_item_mut(c).ok_or(filmcraft_edit::EditError::NoItem(c))?;
                 let mt = it.source_time_at(ph.clamp(it.start, (it.end() - Tick(1)).max(it.start)));
                 if let Some(e) = it.effects.get_mut(idx) {
-                    reset_params(e, None, frame, mt);
+                    reset_params(e, None, frame, source, mt);
                 }
                 Ok(())
             })?;
@@ -3148,6 +3338,7 @@ fn build() -> Vec<CommandSpec> {
             let pid = str_p(p, "param").ok_or_else(|| bad("effects.resetParam", "need `param`"))?.to_string();
             let eff = p.get("effect").cloned().unwrap_or(json!("motion"));
             let frame = s.active_sequence().map(|q| (q.settings.width, q.settings.height)).unwrap_or((1920, 1080));
+            let source = s.active_sequence().and_then(|q| q.find_item(c)).and_then(|(_, i)| s.project.source_size(i.item)).unwrap_or(frame);
             let ph = s.playhead();
             s.edit_sequence("Reset Parameter", |q, _, _| {
                 let (_, it) = q.find_item_mut(c).ok_or(filmcraft_edit::EditError::NoItem(c))?;
@@ -3158,7 +3349,7 @@ fn build() -> Vec<CommandSpec> {
                     _ => None,
                 }
                 .ok_or_else(|| bad("effects.resetParam", "no such effect on clip"))?;
-                if !reset_params(e, Some(&pid), frame, mt) {
+                if !reset_params(e, Some(&pid), frame, source, mt) {
                     return Err(bad("effects.resetParam", format!("no param `{pid}`")));
                 }
                 Ok(())
@@ -3437,11 +3628,12 @@ fn build() -> Vec<CommandSpec> {
 /// Put `e`'s parameters (all of them, or only `only`) back to their defaults, as Premiere's reset
 /// buttons do: a parameter that is not animated gets its default as its static value, and an
 /// animated one keeps its keyframes and gets the default as a keyframe at media time `mt`.
-/// Masks are left alone. Returns whether any parameter was reset.
-fn reset_params(e: &mut filmcraft_project::EffectInstance, only: Option<&str>, frame: (u32, u32), mt: Tick) -> bool {
+/// Masks are left alone. Returns whether any parameter was reset. "Auto" points are centred as
+/// when the effect was added: a standard effect's in the clip's `source` picture it runs on.
+fn reset_params(e: &mut filmcraft_project::EffectInstance, only: Option<&str>, frame: (u32, u32), source: (u32, u32), mt: Tick) -> bool {
     let Some(d) = e.def() else { return false };
     let mut fresh = d.instance();
-    resolve_auto_points(&mut fresh, frame, frame);
+    resolve_auto_points(&mut fresh, if d.intrinsic { frame } else { source }, source);
     let mut any = false;
     for (id, prm) in fresh.params {
         if only.is_some_and(|o| o != id) {
@@ -3586,6 +3778,33 @@ fn mark(s: &mut Session, p: &Value, is_in: bool) -> Result<Value> {
     Ok(Value::Null)
 }
 
+/// Set Work Area Bar In / Out Point: the work area starts (`is_in`) or ends at `time`, else at the
+/// playhead. An In point at or after the end moves the end to the end of the sequence, or to one
+/// frame after the In point when the In point is at or past the end of the sequence; an Out point
+/// at or before the start moves the start to 0. With no work area yet, the other end is the end
+/// or the start of the sequence.
+fn set_work_area_point(s: &mut Session, p: &Value, is_in: bool) -> Result<Value> {
+    let cmd = if is_in { "sequence.setWorkAreaIn" } else { "sequence.setWorkAreaOut" };
+    let t = sequence_time_p(s, p, "", cmd)?.unwrap_or(s.playhead());
+    let fd = s.sequence_rate().frame_duration();
+    let seq = s.active_sequence().ok_or(EngineError::NoSequence)?;
+    let (start, end) = seq.work_area.map(|w| (w.start, w.end())).unwrap_or((Tick::ZERO, seq.duration()));
+    let (start, end) = if is_in {
+        (t, if end > t { end } else { seq.duration().max(t + fd) })
+    } else {
+        if t <= Tick::ZERO {
+            return Err(bad(cmd, "the Out point must be after the start of the sequence"));
+        }
+        (if start < t { start } else { Tick::ZERO }, t)
+    };
+    s.edit_sequence(if is_in { "Set Work Area Bar In Point" } else { "Set Work Area Bar Out Point" }, |q, _, _| {
+        q.work_area = Some(TimeRange::from_bounds(start, end));
+        Ok(())
+    })?;
+    Ok(json!({"start": start.0, "end": end.0}))
+}
+
+/// Decodes caller JSON using the stored parameter as a type template.
 pub(crate) fn json_to_param(template: &ParamValue, v: &Value) -> Option<ParamValue> {
     Some(match template {
         ParamValue::Float(_) => ParamValue::Float(v.as_f64()?),
@@ -3604,7 +3823,7 @@ pub(crate) fn json_to_param(template: &ParamValue, v: &Value) -> Option<ParamVal
             _ => return None,
         },
         ParamValue::Bool(_) => ParamValue::Bool(v.as_bool()?),
-        ParamValue::Choice(_) => ParamValue::Choice(v.as_u64()? as u32),
+        ParamValue::Choice(_) => ParamValue::Choice(u32::try_from(v.as_u64()?).ok()?),
         ParamValue::Text(_) => ParamValue::Text(v.as_str()?.to_string()),
         ParamValue::Path(_) => ParamValue::Path(crate::masks::path_from_json(v)?),
         ParamValue::Curve(_) => {
@@ -3613,6 +3832,20 @@ pub(crate) fn json_to_param(template: &ParamValue, v: &Value) -> Option<ParamVal
     })
 }
 
+/// Encode the accepted parameter value in the JSON shape returned to command callers.
+fn param_value_to_json(value: &ParamValue) -> Value {
+    match value {
+        ParamValue::Float(value) => json!(value),
+        ParamValue::Vec2(value) => json!([value.x, value.y]),
+        ParamValue::Color(value) => json!(value),
+        ParamValue::Bool(value) => json!(value),
+        ParamValue::Choice(value) => json!(value),
+        ParamValue::Text(value) => json!(value),
+        ParamValue::Curve(value) => json!(value),
+        ParamValue::Path(value) => crate::masks::path_to_json(value),
+    }
+}
+
 fn copy_selection(s: &mut Session) {
     let Some(q) = s.active_sequence() else { return };
     let sel = with_links(s, &s.state.selection);
@@ -3634,11 +3867,59 @@ fn copy_selection(s: &mut Session) {
             }
         }
     }
-    s.state.clipboard = clip;
-    s.state.clipboard_markers = markers;
+    set_clipboard(&mut s.state, (clip, markers));
+}
+
+/// Timeline clips (track kind, track index, item) and the sequence markers that go with them.
+type Clipboard = (Vec<(TrackKind, usize, filmcraft_project::TrackItem)>, Vec<Marker>);
+
+fn set_clipboard(st: &mut crate::EditorState, (clips, markers): Clipboard) {
+    st.clipboard = clips;
+    st.clipboard_markers = markers;
+    st.caption_clipboard.clear();
+}
+
+/// Put a Lift or Extract cut on the clipboard; returns how many clips it holds (0 leaves the
+/// clipboard as it was).
+fn store_cut(s: &mut Session, cut: Option<Clipboard>) -> usize {
+    let Some(cut) = cut else { return 0 };
+    let copied = cut.0.len();
+    set_clipboard(&mut s.state, cut);
+    copied
+}
+
+/// What Lift and Extract put on the clipboard, as in Premiere (#3019): the clips of the unlocked
+/// `tracks` (the targeted ones) in `range`, cut at its edges and held the way Copy holds them.
+/// Extract also cuts sync-locked tracks only to keep them in sync; that material is not copied.
+/// Reads the sequence before the edit; None when the range has no clips on those tracks.
+fn cut_range(q: &filmcraft_project::Sequence, tracks: &[TrackId], range: TimeRange, ctx: &mut edit::EditCtx, with_markers: bool) -> Option<Clipboard> {
+    let mut links = std::collections::HashMap::new();
+    let mut clips = Vec::new();
+    for (kind, list) in [(TrackKind::Video, &q.video_tracks), (TrackKind::Audio, &q.audio_tracks)] {
+        for (ti, t) in list.iter().enumerate().filter(|(_, t)| !t.locked && tracks.contains(&t.id)) {
+            let mut t = t.clone();
+            edit::split_track_at(&mut t, range.start, ctx, &mut links);
+            edit::split_track_at(&mut t, range.end(), ctx, &mut links);
+            clips.extend(t.items.into_iter().filter(|i| i.start >= range.start && i.end() <= range.end()).map(|i| (kind, ti, i)));
+        }
+    }
+    let min = clips.iter().map(|c| c.2.start).min()?;
+    let max = clips.iter().map(|c| c.2.end()).max()?;
+    for c in &mut clips {
+        c.2.start -= min;
+    }
+    let markers = if with_markers {
+        q.markers.iter().filter(|m| m.start >= min && m.start < max).map(|m| Marker { start: m.start - min, ..m.clone() }).collect()
+    } else {
+        Vec::new()
+    };
+    Some((clips, markers))
 }
 
 fn paste(s: &mut Session, insert: bool) -> Result<Value> {
+    if !s.state.caption_clipboard.is_empty() {
+        return crate::captions::paste(s, insert);
+    }
     let at = s.playhead();
     let clip = s.state.clipboard.clone();
     let markers = if s.state.copy_paste_sequence_markers { s.state.clipboard_markers.clone() } else { Vec::new() };
@@ -4038,6 +4319,28 @@ fn ripple_delete_gap(s: &mut Session, g: crate::GapSelection) -> Result<Value> {
     Ok(json!({"closed": g.range.duration.0}))
 }
 
+/// `sequence.closeGap` with no gap selected: every span where no track has anything, between In
+/// and Out (the whole sequence without them), closes in one undo step (#1986).
+fn close_sequence_gaps(s: &mut Session) -> Result<Value> {
+    let within = in_out_range(s)?;
+    let gaps = s.active_sequence().map(|q| crate::sequence_extras::sequence_gaps(q, Some(within))).unwrap_or_default();
+    let Some(first) = gaps.first().copied() else {
+        return Err(bad("sequence.closeGap", "no gaps to close"));
+    };
+    s.edit_sequence("Close Gap", |q, _, st| {
+        // a locked track would stay put while everything else moved past it
+        if q.all_tracks().any(|t| t.locked && t.items.iter().any(|i| i.start >= first.end())) {
+            return Err(edit::EditError::Locked.into());
+        }
+        for g in gaps.iter().rev() {
+            crate::sequence_extras::close_sequence_gap(q, *g, st.ripple_sequence_markers);
+        }
+        Ok(())
+    })?;
+    let closed = gaps.iter().fold(Tick::ZERO, |sum, g| sum + g.duration);
+    Ok(json!({"gaps": gaps.len(), "closed": closed.0}))
+}
+
 /// `sequence.closeGap`: ripple the gap on `track` at `t` closed (one undo step, "Ripple Delete").
 fn close_gap(s: &mut Session, tr: TrackId, t: Tick) -> Result<()> {
     s.edit_sequence("Ripple Delete", |q, _, st| {
@@ -4259,6 +4562,7 @@ pub fn inspect_sequence(s: &Session, id: ItemId, q: &filmcraft_project::Sequence
     let tr = |t: &filmcraft_project::Track| {
         json!({
             "id": t.id.0, "name": t.name, "locked": t.locked, "syncLock": t.sync_lock, "enabled": t.enabled, "muted": t.muted, "solo": t.solo,
+            "label": t.label.map(|l| l.name()),
             "items": t.items.iter().map(|i| json!({
                 "clip": i.id.0, "item": i.item.0, "name": i.name, "start": i.start.0, "duration": i.duration.0,
                 "startFrame": rate.frame_at(i.start), "durationFrames": rate.frame_at(i.duration), "sourceIn": i.source_in.0, "speed": i.speed, "reverse": i.reverse,
@@ -4359,6 +4663,7 @@ fn install_project(s: &mut Session, proj: filmcraft_project::Project, path: Opti
     let first = proj.sequences().next().map(|i| i.id);
     s.media.add_stored(&proj, path.as_deref());
     s.project = std::sync::Arc::new(proj);
+    s.document_epoch = s.document_epoch.wrapping_add(1);
     s.history = Default::default();
     s.history.limit = 200;
     s.state = crate::Session::default().state;
diff --git a/crates/engine/src/demo.rs b/crates/engine/src/demo.rs
index c60fc0f53..18fdf3cca 100644
--- a/crates/engine/src/demo.rs
+++ b/crates/engine/src/demo.rs
@@ -220,5 +220,7 @@ fn build_demo(pool: &MediaPool) -> Option<(Project, ItemId)> {
     for tr in s.all_tracks_mut() {
         tr.sort();
     }
+    // the transitions and markers above take fixed ids: new ones start past them
+    p.next_id = p.next_id.max(p.max_id().saturating_add(1));
     Some((p, seq))
 }
diff --git a/crates/engine/src/doc_path.rs b/crates/engine/src/doc_path.rs
index 7168b181a..942d8f43c 100644
--- a/crates/engine/src/doc_path.rs
+++ b/crates/engine/src/doc_path.rs
@@ -39,15 +39,27 @@ impl std::error::Error for NotFollowed {}
 /// where it was opened from.
 pub fn resolve(stored: &str, document: Option<&Path>) -> Result<String, NotFollowed> {
     let document = document.filter(|d| !d.as_os_str().is_empty()).map(|d| std::path::absolute(d).unwrap_or_else(|_| d.to_path_buf()));
-    let path: PathBuf = craft_docpath::resolve(stored, document.as_deref()).map_err(NotFollowed::Refused)?;
-    // A path that is still relative would be taken from the working directory, which the
-    // document does not choose.
-    if path.is_relative() {
-        return Err(NotFollowed::NoDocumentFolder);
-    }
+    let path: PathBuf = match craft_docpath::resolve_absolute(stored, document.as_deref()) {
+        Ok(path) => path,
+        // Without a document, a relative path resolves but stays relative.
+        Err(Refused::Invalid) if document.is_none() && craft_docpath::resolve(stored, None).is_ok_and(|p| !foreign_root(&p)) => {
+            return Err(NotFollowed::NoDocumentFolder);
+        }
+        Err(r) => return Err(NotFollowed::Refused(r)),
+    };
     path.into_os_string().into_string().map_err(|_| NotFollowed::Refused(Refused::Invalid))
 }
 
+/// Whether an unresolved `craft_docpath::resolve` result starts with a drive (`C:`) or a share
+/// root (`\\`) outside Windows. Such a path names no file here, and no document folder makes it one.
+fn foreign_root(path: &Path) -> bool {
+    if cfg!(windows) {
+        return false;
+    }
+    let b = path.as_os_str().as_encoded_bytes();
+    b.starts_with(br"\\") || matches!((b.first(), b.get(1)), (Some(l), Some(b':')) if l.is_ascii_alphabetic())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -60,5 +72,27 @@ mod tests {
         assert_eq!(resolve("clip.mp4", None), Err(NotFollowed::NoDocumentFolder));
         assert_eq!(resolve(r"\\192.0.2.1\share\x.mp4", Some(&doc)), Err(NotFollowed::Refused(Refused::Network)));
         assert_eq!(resolve("file://192.0.2.1/s/x.mp4", Some(&doc)), Err(NotFollowed::Refused(Refused::Network)));
+        assert_eq!(resolve("jar:take.mp4", Some(&doc)), Err(NotFollowed::Refused(Refused::Url)));
+        // Colons in names: an alternate data stream or a URL on Windows, a plain character elsewhere.
+        if cfg!(windows) {
+            assert_eq!(resolve("media/take:2.mp4", Some(&doc)), Err(NotFollowed::Refused(Refused::Invalid)));
+            assert_eq!(resolve("take:2.mp4", Some(&doc)), Err(NotFollowed::Refused(Refused::Url)));
+        } else {
+            assert_eq!(resolve("media/take:2.mp4", Some(&doc)), Ok(dir.join("media").join("take:2.mp4").to_string_lossy().into_owned()));
+            assert_eq!(resolve("take:2.mp4", Some(&doc)), Ok(dir.join("take:2.mp4").to_string_lossy().into_owned()));
+        }
+    }
+
+    /// Without a document a relative path waits for the document's folder; outside Windows a
+    /// drive path names no file and is refused.
+    #[test]
+    fn foreign_drive_paths_without_a_document_are_refused() {
+        for stored in ["clip.mp4", "../clip.mp4"] {
+            assert_eq!(resolve(stored, None), Err(NotFollowed::NoDocumentFolder), "{stored}");
+        }
+        #[cfg(unix)]
+        for stored in [r"C:\x", r"C:x", "file:///C:/x/clip.mp4"] {
+            assert_eq!(resolve(stored, None), Err(NotFollowed::Refused(Refused::Invalid)), "{stored}");
+        }
     }
 }
diff --git a/crates/engine/src/explicit_targets_tests.rs b/crates/engine/src/explicit_targets_tests.rs
index 2abbcee12..d18dc4e93 100644
--- a/crates/engine/src/explicit_targets_tests.rs
+++ b/crates/engine/src/explicit_targets_tests.rs
@@ -130,7 +130,7 @@ fn naming_nothing_usable_does_not_enable_a_command() {
     assert!(why.starts_with("-1 is not a clip id"), "{why}");
     assert_eq!(disabled(s.execute("clip.replaceFromBin", json!({"clips": [v1(&s)[0].id.0], "item": 987_654_321u64}))), "select a clip in the Project panel");
     // `edit.cut` takes no `clips`: it works on the selection only
-    assert_eq!(disabled(s.execute("edit.cut", json!({"clips": [v1(&s)[0].id.0]}))), "no clips selected");
+    assert_eq!(disabled(s.execute("edit.cut", json!({"clips": [v1(&s)[0].id.0]}))), "no clips or captions selected");
     assert!(std::sync::Arc::ptr_eq(&before, &s.project), "nothing was edited");
 }
 
@@ -307,3 +307,26 @@ fn link_leaves_clips_without_a_partner_unlinked() {
     assert_eq!(clip(&s, v1).unwrap().link, None, "v1 has no overlapping audio in the selection");
     assert_eq!(clip(&s, a2).unwrap().link, None, "a2 has no overlapping video in the selection");
 }
+
+/// #1103: Unlink with a selection that also holds an unlinked clip (a title, a music clip) unlinks
+/// the linked ones, as the Timeline's context menu offers, instead of re-linking them.
+#[test]
+fn unlink_with_an_unlinked_clip_in_the_selection_still_unlinks() {
+    let mut s = demo();
+    let (v, a) = (v1(&s), a1(&s));
+    let (v0, a0, v1, a1) = (v[0].id, a[0].id, v[1].id, a[1].id);
+    assert!(clip(&s, v0).unwrap().link.is_some() && clip(&s, v1).unwrap().link.is_some(), "the demo's clips start linked");
+    // make one clip unlinked on its own: its partner goes with it (no one-member link stays)
+    s.execute("clip.link", json!({"clips": [a1.0]})).unwrap();
+    assert_eq!(clip(&s, a1).unwrap().link, None);
+    assert_eq!(clip(&s, v1).unwrap().link, None, "the partner left alone is unlinked too");
+    s.execute("clip.link", json!({"clips": [v0.0, a0.0]})).unwrap();
+    s.execute("clip.link", json!({"clips": [v0.0, a0.0]})).unwrap();
+    assert!(clip(&s, v0).unwrap().link.is_some(), "v0 and a0 linked again");
+    // v0 + a0 linked, v1 not: Unlink
+    let r = s.execute("clip.link", json!({"clips": [v0.0, a0.0, v1.0]})).unwrap();
+    assert_eq!(r["linked"], false);
+    for c in [v0, a0, v1] {
+        assert_eq!(clip(&s, c).unwrap().link, None, "{c:?}");
+    }
+}
diff --git a/crates/engine/src/export_tests.rs b/crates/engine/src/export_tests.rs
index 79ddcb810..cd245649b 100644
--- a/crates/engine/src/export_tests.rs
+++ b/crates/engine/src/export_tests.rs
@@ -9,6 +9,16 @@ use serde_json::{Value, json};
 
 use crate::Session;
 
+#[test]
+fn project_names_become_one_export_filename_component() {
+    for name in ["../../outside", "/absolute/path", r"C:\\outside", ".."] {
+        let safe = crate::export_tools::file_safe(name);
+        assert!(!safe.contains(['/', '\\']), "{name:?} became {safe:?}");
+        assert_ne!(safe, ".");
+        assert_ne!(safe, "..");
+    }
+}
+
 #[test]
 fn hostile_export_ranges_are_rejected_without_panicking() {
     let mut session = demo();
@@ -145,11 +155,13 @@ fn files_in(dir: &Path) -> Vec<String> {
     v
 }
 
-/// Every built-in preset: a quarter second of the demo sequence (seven frames at 23.976) exported
+/// Every built-in preset: 1.0 to 1.08 s of the demo sequence (three frames at 23.976) exported
 /// with `file.exportMedia {preset}`; ffprobe checks container, codec, profile, frame size, frame
-/// rate and audio format, and the data rate where the codec fixes it.
+/// rate and audio format, and the data rate where the codec fixes it. Three frames are enough for
+/// all of these, and each extra frame costs a 4K H.264 encode in five presets.
 #[test]
 fn every_builtin_preset_exports_and_ffprobe_confirms() {
+    let (start, end) = (1.0, 1.08);
     let mut s = demo();
     let presets = s.execute("export.presets.list", json!({})).unwrap()["presets"].as_array().unwrap().clone();
     assert!(presets.len() >= 24);
@@ -159,7 +171,7 @@ fn every_builtin_preset_exports_and_ffprobe_confirms() {
         let sub = dir.0.join(format!("p{}", filmcraft_export::presets::preset_key(name)));
         std::fs::create_dir_all(&sub).unwrap();
         let path = sub.join("Demo").to_string_lossy().to_string();
-        let params = json!({"preset": name, "path": path, "range": "custom", "startSeconds": 1.0, "endSeconds": 1.25, "wait": true});
+        let params = json!({"preset": name, "path": path, "range": "custom", "startSeconds": start, "endSeconds": end, "wait": true});
         let frames = s.execute("export.resolve", params.clone()).unwrap()["frames"].as_u64().unwrap();
         let r = s.execute("file.exportMedia", params).unwrap_or_else(|e| panic!("{name}: {e}"));
         let out = r["path"].as_str().unwrap().to_string();
@@ -172,7 +184,7 @@ fn every_builtin_preset_exports_and_ffprobe_confirms() {
         if matches!(fmt.as_str(), "png" | "tiff" | "bmp" | "jpg" | "tga" | "dpx" | "exr") {
             let files = files_in(&sub);
             let ext = Path::new(&out).extension().unwrap().to_string_lossy().to_string();
-            assert_eq!(frames, 7, "frames 23..=29 at 23.976 fps");
+            assert_eq!(frames, 3, "frames 23..=25 at 23.976 fps");
             let want: Vec<String> = (0..frames).map(|i| format!("Demo{i:03}.{ext}")).collect();
             assert_eq!(files, want, "{name}");
             if let Some(j) = probe(&sub.join(&want[0]).to_string_lossy()) {
@@ -208,7 +220,7 @@ fn every_builtin_preset_exports_and_ffprobe_confirms() {
                 assert_eq!(a["codec_name"], codec, "{name}");
                 assert_eq!(a["sample_rate"], "48000", "{name}");
                 assert_eq!(a["channels"], 2, "{name}");
-                assert!((num(&j["format"]["duration"]) - 0.25).abs() < 0.01, "{name}: {}", j["format"]["duration"]);
+                assert!((num(&j["format"]["duration"]) - (end - start)).abs() < 0.01, "{name}: {}", j["format"]["duration"]);
                 continue;
             }
             "aac" => {
@@ -218,7 +230,7 @@ fn every_builtin_preset_exports_and_ffprobe_confirms() {
                 assert_eq!(j["streams"].as_array().unwrap().len(), 1, "{name}");
                 let a = stream(&j, "audio").unwrap();
                 assert_eq!((a["codec_name"].as_str(), a["sample_rate"].as_str(), a["channels"].as_u64()), (Some("aac"), Some("48000"), Some(2)), "{name}");
-                assert!((num(&j["format"]["duration"]) - 0.25).abs() < 0.03, "{name}: {}", j["format"]["duration"]);
+                assert!((num(&j["format"]["duration"]) - (end - start)).abs() < 0.03, "{name}: {}", j["format"]["duration"]);
                 continue;
             }
             "gif" => {
@@ -322,9 +334,6 @@ fn every_builtin_preset_exports_and_ffprobe_confirms() {
     }
 }
 
-/// H.264 bitrate control over three seconds of the demo: the adaptive Match Source preset
-/// targets width × height × fps × bpp, the 1080p delivery presets their fixed targets; ffprobe's
-/// measured video bitrate stays within the VBR maximum and close to the target.
 #[test]
 fn aac_audio_keeps_a_dot_aac_path_as_adts_and_adds_m4a_otherwise() {
     let mut s = demo();
@@ -344,6 +353,12 @@ fn aac_audio_keeps_a_dot_aac_path_as_adts_and_adds_m4a_otherwise() {
     assert_eq!(&std::fs::read(&m4a).unwrap()[4..8], b"ftyp");
 }
 
+/// H.264 bitrate control over one second of the demo: the adaptive Match Source preset targets
+/// width × height × fps × bpp, the 1080p delivery presets their fixed targets; ffprobe's measured
+/// video bitrate stays within the VBR maximum and close to the target. 0.5 to 1.5 s holds the
+/// second half of the one-second fade in from black, where every frame changes and each preset
+/// spends its whole budget; the shot after it is simple enough that both 1080p presets land at the
+/// same bitrate, far under their targets.
 #[test]
 fn h264_presets_hit_their_bitrates() {
     let mut s = demo();
@@ -356,7 +371,7 @@ fn h264_presets_hit_their_bitrates() {
         let path = dir.path(&format!("{}.mp4", filmcraft_export::presets::preset_key(preset)));
         s.execute(
             "file.exportMedia",
-            json!({"preset": preset, "path": path, "range": "custom", "startSeconds": 0.0, "endSeconds": 3.0, "audio": false, "wait": true}),
+            json!({"preset": preset, "path": path, "range": "custom", "startSeconds": 0.5, "endSeconds": 1.5, "audio": false, "wait": true}),
         )
         .unwrap();
         let Some(j) = probe(&path) else { return };
@@ -847,3 +862,16 @@ fn caption_sidecars_keep_only_the_exported_interval() {
         assert!(doc.cues.is_empty(), "half-open export excludes cues touching either boundary: {doc:?}");
     }
 }
+
+/// #1216: `maxThreads` reaches the export settings from the command parameters (CLI, MCP, control
+/// channel), as a flat parameter or inside `settings`.
+#[test]
+fn max_threads_reaches_the_export_settings() {
+    let session = Session::default();
+    let settings_of = |params: Value| crate::export_tools::settings_from_params(&session, &params, "file.exportMedia").map(|(_, s)| s);
+    assert_eq!(settings_of(json!({"format": "mjpeg", "path": "out.mov", "maxThreads": 2})).unwrap().max_threads, 2);
+    assert_eq!(settings_of(json!({"format": "mjpeg", "path": "out.mov", "settings": {"maxThreads": 3}})).unwrap().max_threads, 3);
+    assert_eq!(settings_of(json!({"format": "mjpeg", "path": "out.mov"})).unwrap().max_threads, 0, "all cores unless asked");
+    assert!(settings_of(json!({"format": "mjpeg", "path": "out.mov", "maxThreads": -1})).is_err(), "a negative count is refused");
+    assert!(settings_of(json!({"format": "mjpeg", "path": "out.mov", "settings": {"maxThread": 2}})).is_err(), "a misspelt setting is refused, not ignored");
+}
diff --git a/crates/engine/src/export_tools.rs b/crates/engine/src/export_tools.rs
index 98c7ad2fc..d8f367013 100644
--- a/crates/engine/src/export_tools.rs
+++ b/crates/engine/src/export_tools.rs
@@ -235,6 +235,9 @@ pub fn settings_from_params(s: &Session, p: &Value, cmd: &str) -> Result<(Option
         settings.bitrate_kbps = v;
         settings.adaptive_bitrate = None;
     }
+    if let Some(v) = crate::commands::checked_u32_p(p, "maxThreads", cmd)? {
+        settings.max_threads = v;
+    }
     if let Some(v) = crate::commands::checked_u32_p(p, "maxBitrateKbps", cmd)? {
         settings.max_bitrate_kbps = Some(v);
     }
@@ -385,10 +388,11 @@ pub fn default_export_dir(s: &Session) -> PathBuf {
     crate::temp_dir()
 }
 
-fn file_safe(n: &str) -> String {
+/// Convert project-derived display text into exactly one safe output filename component.
+pub fn file_safe(n: &str) -> String {
     let s: String = n.chars().map(|c| if c.is_alphanumeric() || " -_().".contains(c) { c } else { '_' }).collect();
     let s = s.trim().to_string();
-    if s.is_empty() { "Export".into() } else { s }
+    if s.is_empty() || matches!(s.as_str(), "." | "..") { "Export".into() } else { s }
 }
 
 /// `path` with the settings' extension (added when missing; image sequences keep theirs).
diff --git a/crates/engine/src/file_tests.rs b/crates/engine/src/file_tests.rs
index f474b268c..f6c6ad218 100644
--- a/crates/engine/src/file_tests.rs
+++ b/crates/engine/src/file_tests.rs
@@ -94,6 +94,19 @@ fn project_is_named_after_its_file() {
     let _ = std::fs::remove_dir_all(&d);
 }
 
+/// #1545: `file.newProject` answers with the project it made (name and revision, as
+/// `project_inspect` reports them) instead of `null`.
+#[test]
+fn new_project_answers_with_its_name_and_revision() {
+    let mut s = Session::default();
+    let r = s.execute("file.newProject", json!({"name": "Trailer"})).unwrap();
+    assert_eq!(r["name"], "Trailer");
+    assert_eq!(r["revision"].as_u64(), Some(s.revision));
+    assert_eq!(s.project.name, "Trailer");
+    let r = s.execute("file.newProject", json!({})).unwrap();
+    assert_eq!(r["name"], "Untitled", "the default name");
+}
+
 /// Opening the demo after a saved project must not keep that path: Save would overwrite it.
 #[test]
 fn open_demo_project_clears_saved_path_so_save_does_not_overwrite() {
diff --git a/crates/engine/src/gap_selection_tests.rs b/crates/engine/src/gap_selection_tests.rs
index 19abd7c4c..74d62d329 100644
--- a/crates/engine/src/gap_selection_tests.rs
+++ b/crates/engine/src/gap_selection_tests.rs
@@ -211,7 +211,6 @@ fn close_gap_rejects_invalid_context_and_explicit_parameters_without_editing() {
     two_clips(&mut s, [0, 96]);
     let before = s.project.clone();
     let undo = s.history.undo.len();
-    assert!(s.execute("sequence.closeGap", json!({})).is_err(), "a shortcut needs a selected gap");
     s.execute("timeline.selectGap", json!({"track":"V1","frame":60})).unwrap();
     for params in [json!({"track":null}), json!({"track":false}), json!({"track":"V99","frame":60}), json!({"time":1})] {
         assert!(s.execute("sequence.closeGap", params).is_err(), "invalid explicit requests must not fall back to the selected gap");
@@ -232,3 +231,76 @@ fn close_gap_rejects_invalid_context_and_explicit_parameters_without_editing() {
     assert!(std::sync::Arc::ptr_eq(&before, &s.project));
     assert_eq!(s.history.undo.len(), undo);
 }
+
+/// 48-frame clips (pictures on V1, linked sounds on A1) placed at `frames`, in that order.
+fn clips_at(s: &mut Session, frames: &[i64]) -> Vec<(ClipId, ClipId)> {
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s.execute("file.newSequence", json!({"name": "Gaps", "video": 1, "audio": 1})).unwrap();
+    let rate = s.sequence_rate();
+    let item = s.project.items.values().find(|i| i.has_video() && i.has_audio() && i.as_media().is_some()).map(|i| i.id).unwrap();
+    for f in frames {
+        s.execute("timeline.place", json!({"item": item.0, "frame": f, "sourceIn": rate.tick_of(48).0, "duration": rate.tick_of(48).0})).unwrap();
+    }
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    let q = s.active_sequence().unwrap();
+    (0..frames.len()).map(|n| (q.video_tracks[0].items[n].id, q.audio_tracks[0].items[n].id)).collect()
+}
+
+/// #1986: Sequence ▸ Close Gap with no gap selected closes every gap in the sequence, on picture and
+/// sound alike, in one undo step (Premiere's Close Gap).
+#[test]
+fn close_gap_without_a_selected_gap_closes_every_gap_in_one_undo_step() {
+    let mut s = Session::default();
+    let clips = clips_at(&mut s, &[24, 96, 200]);
+    let rate = s.sequence_rate();
+    let at = |f: i64| rate.tick_of(f);
+    let (zero, f48, f96) = (Tick::ZERO, at(48), at(96));
+    let before = serde_json::to_value(&s.project).unwrap();
+    let undo = s.history.undo.len();
+    let r = s.execute("sequence.closeGap", json!({})).unwrap();
+    assert_eq!(r["gaps"], json!(3), "the leading gap and the two between the clips: {r}");
+    for ((picture, sound), start) in clips.iter().zip([zero, f48, f96]) {
+        assert_eq!(range(&s, *picture).0, start);
+        assert_eq!(range(&s, *sound).0, start, "sound stays with its picture");
+    }
+    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+    s.undo();
+    assert_eq!(serde_json::to_value(&s.project).unwrap(), before);
+}
+
+/// With In and Out set, only the gaps that lie between them close.
+#[test]
+fn close_gap_without_a_selected_gap_only_closes_gaps_between_in_and_out() {
+    let mut s = Session::default();
+    let clips = clips_at(&mut s, &[0, 96, 200]);
+    let rate = s.sequence_rate();
+    let at = |f: i64| rate.tick_of(f);
+    s.execute("markers.markIn", json!({"time": at(140).0})).unwrap();
+    s.execute("markers.markOut", json!({"time": at(260).0})).unwrap();
+    let r = s.execute("sequence.closeGap", json!({})).unwrap();
+    assert_eq!(r["gaps"], json!(1), "{r}");
+    assert_eq!(range(&s, clips[0].0).0, Tick::ZERO);
+    assert_eq!(range(&s, clips[1].0).0, at(96), "the gap before In stays");
+    assert_eq!(range(&s, clips[2].0).0, at(144), "the gap between In and Out closed");
+}
+
+/// Nothing to close, or a locked track that would be left behind: an error and no edit.
+#[test]
+fn close_gap_without_a_selected_gap_refuses_without_editing() {
+    let mut s = Session::default();
+    clips_at(&mut s, &[0, 48]);
+    let before = s.project.clone();
+    let undo = s.history.undo.len();
+    assert!(s.execute("sequence.closeGap", json!({})).is_err(), "no gaps");
+    assert!(std::sync::Arc::ptr_eq(&before, &s.project));
+    assert_eq!(s.history.undo.len(), undo);
+
+    let mut s = Session::default();
+    clips_at(&mut s, &[0, 96]);
+    s.execute("timeline.setTrack", json!({"track":"A1","locked":true})).unwrap();
+    let before = s.project.clone();
+    let undo = s.history.undo.len();
+    assert!(s.execute("sequence.closeGap", json!({})).is_err(), "A1 is locked and has a clip after the gap");
+    assert!(std::sync::Arc::ptr_eq(&before, &s.project));
+    assert_eq!(s.history.undo.len(), undo);
+}
diff --git a/crates/engine/src/graphic_templates.rs b/crates/engine/src/graphic_templates.rs
index f5053756b..01fa146a4 100644
--- a/crates/engine/src/graphic_templates.rs
+++ b/crates/engine/src/graphic_templates.rs
@@ -44,6 +44,7 @@ fn query(id: &'static str, label: &'static str, params: &'static str, run: Run)
 }
 
 const G: &[&str] = &["Graphics and Titles"];
+const MAX_THUMBNAIL_DIMENSION: u32 = 1920;
 
 fn has_graphic(s: &Session) -> std::result::Result<(), String> {
     has_seq(s)?;
@@ -149,8 +150,7 @@ fn entry_json(e: &LibraryEntry) -> Value {
 /// Render a template's thumbnail (static: rolls are shown at rest) as straight sRGB RGBA8,
 /// `w` pixels wide with the template's aspect ratio. Returns (width, height, pixels).
 pub fn thumbnail(t: &GraphicsTemplate, w: u32) -> (u32, u32, Vec<u8>) {
-    let w = w.clamp(16, 1920);
-    let h = ((w as f64 * t.canvas[1] as f64 / t.canvas[0].max(1) as f64).round() as u32).max(1);
+    let (w, h) = thumbnail_dimensions(t.canvas, w);
     register_fonts(t);
     let mut meta = t.graphic.clone();
     meta.roll.mode = RollMode::Off;
@@ -171,11 +171,25 @@ pub fn thumbnail(t: &GraphicsTemplate, w: u32) -> (u32, u32, Vec<u8>) {
     // a moment into the clip, so intro animations have settled a little
     let at = Tick((t.duration.0 / 2).min(filmcraft_time::TICKS_PER_SECOND));
     let mut img = filmcraft_render::image::Image::new(w as usize, h as usize);
-    let k = w as f64 / t.canvas[0].max(1) as f64;
+    // fit both sides: a capped height leaves `w / canvas width` too large for a tall canvas
+    let k = (w as f64 / t.canvas[0].max(1) as f64).min(h as f64 / t.canvas[1].max(1) as f64);
     filmcraft_render::graphic_clip::render_graphic(&it, at, (t.canvas[0], t.canvas[1]), &Affine::scale(k, k), &mut img);
     (w, h, img.to_rgba8())
 }
 
+/// Fit a requested thumbnail width within a bounded rectangle without trusting the template's
+/// aspect ratio to derive an unbounded second dimension.
+fn thumbnail_dimensions(canvas: [u32; 2], requested_width: u32) -> (u32, u32) {
+    let mut w = requested_width.clamp(16, MAX_THUMBNAIL_DIMENSION);
+    let aspect = canvas[0].max(1) as f64 / canvas[1].max(1) as f64;
+    let mut h = (w as f64 / aspect).round().clamp(1.0, u32::MAX as f64) as u32;
+    if h > MAX_THUMBNAIL_DIMENSION {
+        h = MAX_THUMBNAIL_DIMENSION;
+        w = (h as f64 * aspect).round().clamp(1.0, MAX_THUMBNAIL_DIMENSION as f64) as u32;
+    }
+    (w, h)
+}
+
 /// Cached thumbnails by template id + content + width (the UI asks every frame).
 pub fn thumbnail_cached(t: &GraphicsTemplate, w: u32) -> Arc<(u32, u32, Vec<u8>)> {
     static CACHE: OnceLock<Mutex<std::collections::HashMap<(String, u64, u32), Arc<(u32, u32, Vec<u8>)>>>> = OnceLock::new();
@@ -775,7 +789,12 @@ fn set_char_style(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let tl = s.playhead();
     let (start, end) = (u64_p(p, "start").map(|v| v as usize), u64_p(p, "end").map(|v| v as usize));
-    let runs = s.edit_sequence("Character Style", move |q, _, _| {
+    // A pointer gesture shares one undo step only within the same clip, layer and range.
+    let merge = bool_p(p, "merge").unwrap_or(false).then(|| format!("graphics.setCharStyle:{}:{ei}:{start:?}:{end:?}", clip.0));
+    if bool_p(p, "begin").unwrap_or(false) {
+        s.history.merge_key = None;
+    }
+    let runs = s.edit_sequence_as("Character Style", merge.as_deref(), move |q, _, _| {
         let (_, it) = q.find_item_mut(clip).ok_or(filmcraft_edit::EditError::NoItem(clip))?;
         let mt = it.source_time_at(tl.clamp(it.start, it.end() - Tick(1)));
         let e = &mut it.effects[ei];
@@ -1217,7 +1236,7 @@ pub fn commands() -> Vec<CommandSpec> {
             "graphics.setCharStyle",
             "Character Style",
             &[],
-            r##"{"clip":id?,"layer":n|name?,"start":char=0,"end":char=len,"style":{"font":str,"fontStyle":str,"size":px,"color":"#rrggbb","bold":bool,"italic":bool,"underline":bool,"tracking":n,"baselineShift":px,"caps":"normal|all caps|small caps"},"clear":bool? (remove styles from the range)}"##,
+            r##"{"clip":id?,"layer":n|name?,"start":char=0,"end":char=len,"style":{"font":str,"fontStyle":str,"size":px,"color":"#rrggbb","bold":bool,"italic":bool,"underline":bool,"tracking":n,"baselineShift":px,"caps":"normal|all caps|small caps"},"clear":bool? (remove styles from the range),"merge":bool?,"begin":bool? (start a new undo gesture)}"##,
             has_graphic,
             set_char_style,
         ),
diff --git a/crates/engine/src/graphic_templates_tests.rs b/crates/engine/src/graphic_templates_tests.rs
index 98a55a588..47a7c1528 100644
--- a/crates/engine/src/graphic_templates_tests.rs
+++ b/crates/engine/src/graphic_templates_tests.rs
@@ -143,6 +143,13 @@ fn builtin_templates_apply_and_thumbnail() {
     }
 }
 
+#[test]
+fn template_thumbnail_dimensions_fit_a_bounded_rectangle() {
+    assert_eq!(super::thumbnail_dimensions([1920, 1080], 160), (160, 90));
+    assert_eq!(super::thumbnail_dimensions([1, 16_384], 1920), (1, 1920));
+    assert_eq!(super::thumbnail_dimensions([16_384, 1], 1920), (1920, 1));
+}
+
 #[test]
 fn responsive_time_protects_intro_and_outro_when_trimmed() {
     let mut s = demo("gt-time");
@@ -380,3 +387,52 @@ fn copy_paste_duplicates_a_graphic_clip() {
     assert!((pasted[0].start.seconds() - 620.0).abs() < 0.05, "at the playhead: {:?}", pasted[0].start);
     assert_eq!(texts(&s, pasted[0].id), vec!["Lyric".to_string()]);
 }
+
+#[test]
+fn character_style_drag_merges_only_its_target_and_range() {
+    let mut s = demo("gt-char-drag");
+    let c = clip_of(&s.execute("graphics.newText", json!({"text":"Alpha Bravo"})).unwrap());
+    let before = s.project.clone();
+    let n = s.history.undo.len();
+    for i in 0..8 {
+        s.execute("graphics.setCharStyle", json!({"clip":c.0,"start":0,"end":5,"style":{"size":105+i*5},"merge":true,"begin":i==0})).unwrap();
+    }
+    assert_eq!(s.history.undo.len(), n + 1, "one drag, one undo step");
+    let after = s.project.clone();
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(*s.project, *before);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(*s.project, *after);
+    s.execute("graphics.setCharStyle", json!({"clip":c.0,"start":0,"end":5,"style":{"size":150},"merge":true,"begin":true})).unwrap();
+    assert_eq!(s.history.undo.len(), n + 2, "a new gesture on the same range starts a new step");
+    s.execute("graphics.setCharStyle", json!({"clip":c.0,"start":6,"end":11,"style":{"size":160},"merge":true})).unwrap();
+    assert_eq!(s.history.undo.len(), n + 3, "another character range does not merge");
+    let before = s.project.clone();
+    assert!(s.execute("graphics.setCharStyle", json!({"clip":c.0,"start":3,"end":3,"style":{"size":170},"merge":true})).is_err());
+    assert_eq!(*s.project, *before);
+    assert_eq!(s.history.undo.len(), n + 3, "an invalid edit adds no undo step");
+}
+
+#[test]
+fn character_style_merge_preserves_default_calls_and_separate_clips() {
+    let mut s = demo("gt-char-merge-targets");
+    let a = clip_of(&s.execute("graphics.newText", json!({"text":"First", "newClip":true})).unwrap());
+    let b = clip_of(&s.execute("graphics.newText", json!({"text":"Other", "newClip":true})).unwrap());
+    assert_ne!(a, b);
+    let n = s.history.undo.len();
+    for c in [a, b] {
+        s.execute("graphics.setCharStyle", json!({"clip":c.0,"start":0,"end":5,"style":{"size":120},"merge":true})).unwrap();
+    }
+    assert_eq!(s.history.undo.len(), n + 2, "distinct clips do not merge");
+    for size in [130, 140] {
+        s.execute("graphics.setCharStyle", json!({"clip":b.0,"style":{"size":size}})).unwrap();
+    }
+    assert_eq!(s.history.undo.len(), n + 4, "default calls retain separate undo steps");
+    let added = s.execute("graphics.newText", json!({"clip":b.0,"text":"Layer"})).unwrap();
+    assert_eq!(clip_of(&added), b);
+    let n = s.history.undo.len();
+    for layer in [0, 1] {
+        s.execute("graphics.setCharStyle", json!({"clip":b.0,"layer":layer,"start":0,"end":5,"style":{"size":150},"merge":true})).unwrap();
+    }
+    assert_eq!(s.history.undo.len(), n + 2, "distinct layers do not merge");
+}
diff --git a/crates/engine/src/graphics.rs b/crates/engine/src/graphics.rs
index 998b1e2f7..58b3eaada 100644
--- a/crates/engine/src/graphics.rs
+++ b/crates/engine/src/graphics.rs
@@ -8,7 +8,9 @@
 //! at the playhead.
 
 use filmcraft_geom::Vec2;
-use filmcraft_project::graphic::{self, LayerContent, SHAPE_OPTS, eval_layer, layer_display_name, layer_indices, new_shape_layer, new_text_layer};
+use filmcraft_project::graphic::{
+    self, LayerContent, SHAPE_OPTS, ensure_layer_uids, eval_layer, layer_display_name, layer_indices, new_shape_layer, new_text_layer,
+};
 use filmcraft_project::{ClipId, EffectInstance, ItemId, ItemKind, Label, Param, ParamValue, Sequence, TrackKind};
 use filmcraft_render::graphic_clip::{item_layer_specs, layer_local_bounds, layer_quad, text_layout};
 use filmcraft_time::{Tick, TimeRange};
@@ -138,6 +140,9 @@ pub(crate) fn place_video_clip(
         let mut ti = pr.make_track_item(src, TrackKind::Video, t, TimeRange::new(Tick::ZERO, dur), rate).ok_or_else(|| bad(cmd, "bad item"))?;
         ti.name = name;
         ti.effects.extend(extra);
+        // Every new graphic layer gets a stable uid; a new clip holds layers from `extra` plus
+        // any source-graphic layers, so do it after both are in place (duplicates are repaired).
+        ensure_layer_uids(&mut ti.effects);
         for e in &mut ti.effects {
             filmcraft_project::resolve_auto_points(e, (w, h), src_size);
         }
@@ -179,6 +184,9 @@ fn add_layer(s: &mut Session, clip: ClipId, mut layer: filmcraft_project::Effect
         // new layers go in front: after the last graphic layer
         let pos = layer_indices(&it.effects).last().map_or(it.effects.len(), |l| l + 1);
         it.effects.insert(pos, layer);
+        // Assign a uid to the new layer (and lazily upgrade any uid-less legacy layers) inside
+        // this undo step, so undo/redo keeps the same identities.
+        ensure_layer_uids(&mut it.effects);
         let n = layer_indices(&it.effects).len() - 1;
         st.selection = vec![clip];
         st.graphic_layers = vec![n];
diff --git a/crates/engine/src/graphics_tests.rs b/crates/engine/src/graphics_tests.rs
index e8893104e..8069fd17b 100644
--- a/crates/engine/src/graphics_tests.rs
+++ b/crates/engine/src/graphics_tests.rs
@@ -95,6 +95,31 @@ fn graphic_placement_takes_a_track_and_a_time() {
     }
 }
 
+/// Every graphic layer gets a stable uid when it is created, both in a new clip and when added to
+/// an existing one. Two byte-identical layers with different text must not share an identity.
+#[test]
+fn new_graphic_layers_get_unique_stable_uids() {
+    let mut s = demo();
+    let clip = ClipId(s.execute("graphics.newText", json!({"text": "one", "position": [960, 540], "size": 100})).unwrap()["clip"].as_u64().unwrap());
+    s.execute("graphics.newText", json!({"text": "two", "position": [960, 540], "size": 100, "clip": clip.0})).unwrap();
+    s.execute("graphics.newShape", json!({"shape": "rectangle", "clip": clip.0})).unwrap();
+    let uids = |s: &mut Session| -> Vec<u64> {
+        s.execute("graphics.list", json!({"clip": clip.0})).unwrap()["layers"].as_array().unwrap().iter().map(|l| l["uid"].as_u64().unwrap()).collect()
+    };
+    let first = uids(&mut s);
+    assert_eq!(first.len(), 3);
+    assert!(first.iter().all(|uid| *uid != 0), "every created layer is assigned a uid: {first:?}");
+    assert_eq!(first.iter().copied().collect::<std::collections::BTreeSet<_>>().len(), 3, "uids are unique: {first:?}");
+    // A real reorder keeps the same per-layer identity, and undo/redo restores it unchanged.
+    s.execute("graphics.arrangeLayer", json!({"clip": clip.0, "layer": 0, "to": "front"})).unwrap();
+    let reordered = uids(&mut s);
+    assert_eq!(reordered, vec![first[1], first[2], first[0]]);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(uids(&mut s), first, "undo restores the same identities, not fresh ones");
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(uids(&mut s), reordered);
+}
+
 #[test]
 fn new_text_makes_a_graphic_clip_above_the_footage() {
     let mut s = demo();
diff --git a/crates/engine/src/history_tests.rs b/crates/engine/src/history_tests.rs
new file mode 100644
index 000000000..1f5b26191
--- /dev/null
+++ b/crates/engine/src/history_tests.rs
@@ -0,0 +1,77 @@
+//! The History panel menu: `history.deleteRedoable` (Delete Redoable Actions) forgets the steps
+//! Redo would bring back, and `history.clear` (Clear History) forgets every step. Neither one
+//! changes the project or its unsaved state.
+
+use serde_json::json;
+
+use crate::Session;
+
+/// The demo project with three labeled edits, then two of them undone.
+fn three_edits_two_undone() -> Session {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    for name in ["A", "B", "C"] {
+        s.execute("file.newBin", json!({"name": name})).unwrap();
+    }
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("edit.undo", json!({})).unwrap();
+    s
+}
+
+#[test]
+fn delete_redoable_actions_forgets_the_undone_steps_only() {
+    let mut s = three_edits_two_undone();
+    let before = s.execute("history.list", json!({})).unwrap();
+    assert_eq!(before["redo"].as_array().unwrap().len(), 2, "{before}");
+    let project = s.project.clone();
+    let dirty = s.is_dirty();
+
+    let r = s.execute("history.deleteRedoable", json!({})).unwrap();
+    assert_eq!(r, json!({"deleted": 2}));
+    let after = s.execute("history.list", json!({})).unwrap();
+    assert_eq!(after["undo"], before["undo"], "the steps Undo takes back stay");
+    assert_eq!(after["redo"], json!([]));
+    assert_eq!(*s.project, *project, "the project does not change");
+    assert_eq!(s.is_dirty(), dirty);
+    assert!(s.execute("edit.redo", json!({})).is_err(), "nothing is left to redo");
+    // Undo still takes back the step before
+    s.execute("edit.undo", json!({})).unwrap();
+    // with nothing to redo the command is disabled
+    s.history.redo.clear();
+    assert!(s.execute("history.deleteRedoable", json!({})).is_err());
+}
+
+#[test]
+fn clear_history_forgets_every_step_and_keeps_the_project() {
+    let mut s = three_edits_two_undone();
+    let undo = s.history.undo.len();
+    assert!(undo > 0);
+    let project = s.project.clone();
+    let dirty = s.is_dirty();
+
+    let r = s.execute("history.clear", json!({})).unwrap();
+    assert_eq!(r, json!({"deleted": undo + 2}));
+    assert_eq!(s.execute("history.list", json!({})).unwrap(), json!({"undo": [], "redo": []}));
+    assert_eq!(*s.project, *project, "the project does not change");
+    assert_eq!(s.is_dirty(), dirty);
+    assert!(s.execute("edit.undo", json!({})).is_err());
+    assert!(s.execute("history.clear", json!({})).is_err(), "an empty history has nothing to clear");
+
+    // a new edit starts a new history and can be undone
+    s.execute("file.newBin", json!({"name": "D"})).unwrap();
+    assert_eq!(s.history.undo.len(), 1);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(*s.project, *project);
+}
+
+#[test]
+fn history_commands_ignore_unexpected_parameters() {
+    for p in [json!(null), json!([1, 2]), json!({"deleted": -1}), json!("x")] {
+        let mut s = three_edits_two_undone();
+        let undo = s.history.undo.len();
+        assert_eq!(s.execute("history.deleteRedoable", p.clone()).unwrap(), json!({"deleted": 2}), "{p}");
+        assert_eq!(s.history.undo.len(), undo, "{p}");
+        assert_eq!(s.execute("history.clear", p.clone()).unwrap(), json!({"deleted": undo}), "{p}");
+        assert_eq!(s.execute("history.list", json!({})).unwrap(), json!({"undo": [], "redo": []}), "{p}");
+    }
+}
diff --git a/crates/engine/src/interchange.rs b/crates/engine/src/interchange.rs
index 5102308c8..a0ce36778 100644
--- a/crates/engine/src/interchange.rs
+++ b/crates/engine/src/interchange.rs
@@ -24,6 +24,28 @@ fn is_file_media(item: &filmcraft_project::ProjectItem) -> bool {
     matches!(&item.kind, ItemKind::Media(m) if matches!(m.media, MediaRef::File { .. }))
 }
 
+/// Write embedded audio without replacing an occupied path; return the path used. A numbered
+/// name changes only the file name: the folder keeps its separators as written (`/` or `\`).
+fn write_embedded_audio(s: &Session, path: &str, wav: &[u8]) -> Result<String> {
+    let (folder, name) = path.split_at(path.rfind(['/', '\\']).map_or(0, |i| i + 1));
+    if matches!(name, "" | "." | "..") {
+        return Err(EngineError::Other(format!("{path}: missing audio file name")));
+    }
+    let (stem, extension) = match name.rfind('.') {
+        Some(i) if i > 0 => name.split_at(i),
+        _ => (name, ""),
+    };
+    for number in 1..=1_000 {
+        let candidate = if number == 1 { path.to_owned() } else { format!("{folder}{stem} ({number}){extension}") };
+        match s.services.write_file_new(&candidate, wav) {
+            Ok(()) => return Ok(candidate),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(e) => return Err(EngineError::Other(format!("{candidate}: {e}"))),
+        }
+    }
+    Err(EngineError::Other(format!("{path}: no unused embedded-audio filename after 1000 attempts")))
+}
+
 /// Import a document: merge its bins, media and sequences into the project (one undo step), then
 /// link each media file that exists on disk. Returns the new sequences.
 pub fn import(s: &mut Session, path: &str, bytes: &[u8], format: Format) -> Result<Value> {
@@ -37,17 +59,27 @@ pub fn import(s: &mut Session, path: &str, bytes: &[u8], format: Format) -> Resu
         // AAF / OMF may embed audio: write it next to the document (the media items point there)
         Format::Aaf | Format::Omf => {
             let r = if format == Format::Aaf { filmcraft_interchange::aaf::import(bytes, &opts) } else { filmcraft_interchange::omf::import(bytes, &opts) };
-            let (fragment, extracted, report) = r.map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+            let (mut fragment, extracted, report) = r.map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
             for m in extracted {
-                if let Some(dir) = std::path::Path::new(&m.path).parent().filter(|_| !s.services.export_in_memory()) {
-                    let _ = std::fs::create_dir_all(dir);
+                let media = fragment
+                    .project
+                    .item_mut(m.item)
+                    .and_then(|item| item.as_media_mut())
+                    .ok_or_else(|| EngineError::Other(format!("{}: embedded audio has no media item", m.path)))?;
+                let written_path = write_embedded_audio(s, &m.path, &m.wav)?;
+                if written_path != m.path {
+                    media.media = MediaRef::File { path: written_path };
                 }
-                s.services.write_file(&m.path, &m.wav).map_err(|e| EngineError::Other(format!("{}: {e}", m.path)))?;
             }
             (fragment, report)
         }
         _ => filmcraft_interchange::import_with(bytes, format, &opts).map_err(|e| EngineError::Other(format!("{path}: {e}")))?,
     };
+    for item in fragment.project.items.values() {
+        if let ItemKind::Sequence(sequence) = &item.kind {
+            sequence.settings.validate().map_err(|e| EngineError::Other(format!("{path}: invalid imported sequence settings: {e}")))?;
+        }
+    }
     let before: std::collections::HashSet<ItemId> = s.project.items.keys().copied().collect();
     let name = opts.name.clone().unwrap_or_else(|| format.name().to_string());
     let seqs = s.edit(&format!("Import {name}"), |proj, _| {
@@ -152,3 +184,63 @@ pub fn export(s: &mut Session, p: &Value) -> Result<Value> {
     s.services.write_file(&path, &bytes).map_err(|e| EngineError::Other(e.to_string()))?;
     Ok(json!({"path": path, "bytes": bytes.len(), "report": report_json(&report)}))
 }
+
+#[cfg(test)]
+mod embedded_audio_tests {
+    use std::collections::HashMap;
+    use std::io;
+    use std::sync::{Arc, Mutex};
+
+    use crate::{Services, Session};
+
+    use super::write_embedded_audio;
+
+    #[derive(Default)]
+    struct VirtualFiles(Mutex<HashMap<String, Vec<u8>>>);
+
+    impl Services for VirtualFiles {
+        fn read_file(&self, path: &str) -> io::Result<Vec<u8>> {
+            self.0.lock().unwrap().get(path).cloned().ok_or_else(|| io::ErrorKind::NotFound.into())
+        }
+
+        fn write_file(&self, path: &str, data: &[u8]) -> io::Result<()> {
+            self.0.lock().unwrap().insert(path.to_owned(), data.to_vec());
+            Ok(())
+        }
+
+        fn write_file_new(&self, path: &str, data: &[u8]) -> io::Result<()> {
+            let mut files = self.0.lock().unwrap();
+            if files.contains_key(path) {
+                return Err(io::ErrorKind::AlreadyExists.into());
+            }
+            files.insert(path.to_owned(), data.to_vec());
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn virtual_extraction_keeps_existing_media() {
+        let files = Arc::new(VirtualFiles::default());
+        files.0.lock().unwrap().insert("/files/cut Audio.wav".into(), b"first".to_vec());
+        files.0.lock().unwrap().insert("/files/cut Audio (2).wav".into(), b"second".to_vec());
+        let session = Session::new(files.clone());
+        let path = write_embedded_audio(&session, "/files/cut Audio.wav", b"new audio").unwrap();
+        assert_eq!(path, "/files/cut Audio (3).wav");
+        let stored = files.0.lock().unwrap();
+        assert_eq!(stored["/files/cut Audio.wav"], b"first");
+        assert_eq!(stored["/files/cut Audio (2).wav"], b"second");
+        assert_eq!(stored["/files/cut Audio (3).wav"], b"new audio");
+    }
+
+    #[test]
+    fn numbered_names_keep_the_path_separators() {
+        for path in ["C:/files/cut Audio.wav", "C:\\files\\cut Audio.wav"] {
+            let files = Arc::new(VirtualFiles::default());
+            files.0.lock().unwrap().insert(path.into(), b"first".to_vec());
+            let session = Session::new(files.clone());
+            let numbered = write_embedded_audio(&session, path, b"new audio").unwrap();
+            assert_eq!(numbered, path.replace("cut Audio.wav", "cut Audio (2).wav"));
+            assert_eq!(files.0.lock().unwrap()[path], b"first");
+        }
+    }
+}
diff --git a/crates/engine/src/keyboard.rs b/crates/engine/src/keyboard.rs
index 5d344943f..622bd5300 100644
--- a/crates/engine/src/keyboard.rs
+++ b/crates/engine/src/keyboard.rs
@@ -226,7 +226,11 @@ fn nudge_track(s: &mut Session, up: bool) -> Result<Value> {
     let seq = s.active_sequence().ok_or(EngineError::NoSequence)?;
     let mut moves = Vec::new();
     let mut blocked = 0usize;
+    let mut seen = std::collections::HashSet::new();
     for c in &s.state.selection {
+        if !seen.insert(*c) {
+            continue;
+        }
         let Some((tid, it)) = seq.find_item(*c) else { continue };
         let Some(tr) = seq.track(tid) else { continue };
         let list = seq.tracks(tr.kind);
diff --git a/crates/engine/src/keyboard_tests.rs b/crates/engine/src/keyboard_tests.rs
index 4e6ff2fdf..47a749b83 100644
--- a/crates/engine/src/keyboard_tests.rs
+++ b/crates/engine/src/keyboard_tests.rs
@@ -67,7 +67,7 @@ fn premiere_engine_entries_exist() {
     // UI-owned ids (tools, transport, panels…) are checked by the ui-egui keyboard test
     let ui_prefixes =
         ["tool.", "playback.", "window.", "view.", "app.", "help.", "mode.", "multicam.", "projectPanel.", "textPanel.", "panel.", "mediaBrowser."];
-    let ui_ids = ["timeline.expandAllTracks", "timeline.minimizeAllTracks", "graphics.beginTextEditing"];
+    let ui_ids = ["timeline.expandAllTracks", "timeline.minimizeAllTracks", "graphics.beginTextEditing", "mixer.showHideTracks", "mixer.meterInputOnly"];
     for (id, _, _) in presets::premiere() {
         if id.starts_with("timeline.") && (id.contains("Height") || id.contains("Screen")) || ui_ids.contains(&id) {
             continue;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 5d0a044d0..5b70393d8 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -102,6 +102,14 @@ pub type Result<T> = std::result::Result<T, EngineError>;
 pub trait Services: Send + Sync {
     fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>>;
     fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()>;
+    /// Publish a complete new file only when the final path is unoccupied. Publication must
+    /// reject a concurrent collision; a prior existence check alone is insufficient.
+    /// Return `ErrorKind::AlreadyExists` for an occupied final path so the importer can retry
+    /// with a numbered name; return other errors without publishing a partial file.
+    /// Hosts without this operation fail closed.
+    fn write_file_new(&self, _path: &str, _data: &[u8]) -> std::io::Result<()> {
+        Err(std::io::Error::new(std::io::ErrorKind::Unsupported, "exclusive file creation is unavailable on this host"))
+    }
     /// Size of a file in bytes (an error when it is missing). Hosts should override this: the
     /// default reads the whole file.
     fn file_size(&self, path: &str) -> std::io::Result<u64> {
@@ -159,6 +167,23 @@ impl Services for FsServices {
         // Atomic + durable: temp file in the same directory, fsync, rename, fsync the directory.
         filmcraft_format::atomic_write(std::path::Path::new(path), data)
     }
+    fn write_file_new(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        let path = std::path::Path::new(path);
+        let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or_else(|| std::path::Path::new("."));
+        std::fs::create_dir_all(dir).map_err(|error| {
+            if error.kind() == std::io::ErrorKind::AlreadyExists {
+                std::io::Error::new(std::io::ErrorKind::NotADirectory, format!("{} is not a directory: {error}", dir.display()))
+            } else {
+                error
+            }
+        })?;
+        match std::fs::symlink_metadata(path) {
+            Ok(_) => return Err(std::io::ErrorKind::AlreadyExists.into()),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e),
+        }
+        filmcraft_format::atomic_write_new(path, data)
+    }
     fn file_size(&self, path: &str) -> std::io::Result<u64> {
         let m = std::fs::metadata(path)?;
         if m.is_file() { Ok(m.len()) } else { Err(std::io::Error::new(std::io::ErrorKind::NotFound, format!("{path} is not a file"))) }
@@ -217,6 +242,22 @@ impl History {
     pub fn can_redo(&self) -> bool {
         !self.redo.is_empty()
     }
+    /// The History panel's Delete Redoable Actions: removes every step that Redo would bring
+    /// back. The project and the undo steps stay as they are. Returns how many steps were removed.
+    pub fn delete_redoable(&mut self) -> usize {
+        let n = self.redo.len();
+        self.redo.clear();
+        n
+    }
+    /// The History panel's Clear History: removes every undo and redo step. The project stays as
+    /// it is. Returns how many steps were removed.
+    pub fn clear(&mut self) -> usize {
+        let n = self.undo.len() + self.redo.len();
+        self.undo.clear();
+        self.redo.clear();
+        self.merge_key = None;
+        n
+    }
 }
 
 /// Source patching / track targeting (the track header "V1/A1" source buttons + target toggles).
@@ -344,6 +385,10 @@ pub struct EditorState {
     /// Sequence ▸ Show Through Edits: the timeline marks cuts between continuous pieces of a clip.
     #[serde(default)]
     pub show_through_edits: bool,
+    /// Timeline Display Settings ▸ Show Duplicate Frame Markers: a stripe along the bottom of a
+    /// clip under the media frames another clip also shows.
+    #[serde(default)]
+    pub show_duplicate_frame_markers: bool,
     /// Markers ▸ Ripple Sequence Markers: ripple edits move (and delete) sequence markers too.
     #[serde(default)]
     pub ripple_sequence_markers: bool,
@@ -356,6 +401,11 @@ pub struct EditorState {
     /// Sequence markers copied with the clipboard clips (start relative to the copied range).
     #[serde(skip)]
     pub clipboard_markers: Vec<filmcraft_project::Marker>,
+    /// Captions copied from the Timeline, with their caption track's index (starts relative to the
+    /// copied range). Copying clips empties it and copying captions empties `clipboard`, so Paste
+    /// places whichever was copied last.
+    #[serde(skip)]
+    pub caption_clipboard: Vec<(usize, filmcraft_project::Caption)>,
     /// The last Edit ▸ Find… (Find Next continues it).
     #[serde(default)]
     pub find: Option<project_tools::FindState>,
@@ -381,6 +431,10 @@ pub struct Session {
     pub project: Arc<Project>,
     pub history: History,
     pub revision: u64,
+    /// Bumped whenever the session installs a different project document (`file.newProject`,
+    /// open/import/recovery/template). Frontends use it to discard UI state (text edits, IME
+    /// owners) that belongs to the replaced document even if item ids are reused.
+    pub document_epoch: u64,
     pub saved_revision: u64,
     pub path: Option<String>,
     pub state: EditorState,
@@ -499,6 +553,7 @@ impl Session {
             project: Arc::new(Project::new("Untitled")),
             history: History { limit: 200, ..Default::default() },
             revision: 1,
+            document_epoch: 0,
             saved_revision: 1,
             path: None,
             state: EditorState {
@@ -1235,6 +1290,8 @@ mod file_tests;
 #[cfg(test)]
 mod gap_selection_tests;
 #[cfg(test)]
+mod history_tests;
+#[cfg(test)]
 mod image_sequence_tests;
 #[cfg(test)]
 mod individual_selection_tests;
@@ -1245,6 +1302,8 @@ mod keyboard_tests;
 #[cfg(test)]
 mod linked_speed_tests;
 #[cfg(test)]
+mod linked_trim_tests;
+#[cfg(test)]
 mod locked_clip_edits_tests;
 #[cfg(test)]
 mod masks_tests;
@@ -1324,6 +1383,8 @@ mod trim_tests;
 mod vfx_tests;
 #[cfg(test)]
 mod voiceover_tests;
+#[cfg(test)]
+mod work_area_tests;
 
 #[cfg(test)]
 mod source_placement_tests;
diff --git a/crates/engine/src/linked_trim_tests.rs b/crates/engine/src/linked_trim_tests.rs
new file mode 100644
index 000000000..e1e722a31
--- /dev/null
+++ b/crates/engine/src/linked_trim_tests.rs
@@ -0,0 +1,59 @@
+//! Trimming and rate-stretching one side of a linked clip (#3300): `"linked": false` (Alt held
+//! in the Timeline) edits only the given clip, while the default still edits its partners too.
+
+use crate::Session;
+use filmcraft_project::ClipId;
+use filmcraft_time::Tick;
+use serde_json::json;
+
+fn linked_pair() -> (Session, ClipId, ClipId) {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s.execute("file.newSequence", json!({"name": "Linked trim", "video": 1, "audio": 1})).unwrap();
+    let item = s.project.items.values().find(|i| i.has_video() && i.has_audio() && i.as_media().is_some()).unwrap().id;
+    s.execute("timeline.place", json!({"item": item.0, "frame": 0, "duration": s.sequence_rate().tick_of(48).0})).unwrap();
+    let q = s.active_sequence().unwrap();
+    let (video, sound) = (q.video_tracks[0].items[0].id, q.audio_tracks[0].items[0].id);
+    assert!(q.find_item(video).unwrap().1.link.is_some(), "the pair is linked");
+    (s, video, sound)
+}
+
+fn state(s: &Session, id: ClipId) -> (Tick, Tick, Tick) {
+    let (_, it) = s.active_sequence().unwrap().find_item(id).unwrap();
+    (it.start, it.duration, it.source_in)
+}
+
+#[test]
+fn unlinked_trim_leaves_the_partner_alone() {
+    for mode in ["regular", "ripple"] {
+        for edge in ["in", "out"] {
+            let (mut s, video, sound) = linked_pair();
+            let (before_v, before_a) = (state(&s, video), state(&s, sound));
+            let delta = if edge == "in" { 10 } else { -10 };
+            s.execute("timeline.trim", json!({"clip": video.0, "edge": edge, "mode": mode, "deltaFrames": delta, "linked": false})).unwrap();
+            assert_eq!(state(&s, video).1, before_v.1 - s.sequence_rate().tick_of(10), "{mode} {edge}: the video is trimmed");
+            assert_eq!(state(&s, sound), before_a, "{mode} {edge}: the linked audio keeps its range");
+            assert!(s.state.linked_selection, "the global toggle stays on");
+
+            // without the flag, the partner follows as before
+            let (mut s, video, sound) = linked_pair();
+            s.execute("timeline.trim", json!({"clip": video.0, "edge": edge, "mode": mode, "deltaFrames": delta})).unwrap();
+            assert_eq!(state(&s, video).1, before_v.1 - s.sequence_rate().tick_of(10));
+            assert_eq!(state(&s, sound).1, before_a.1 - s.sequence_rate().tick_of(10), "{mode} {edge}: the linked audio follows");
+        }
+    }
+}
+
+#[test]
+fn unlinked_rate_stretch_leaves_the_partner_alone() {
+    let (mut s, video, sound) = linked_pair();
+    let (before_v, before_a) = (state(&s, video), state(&s, sound));
+    s.execute("timeline.rateStretch", json!({"clip": video.0, "edge": "out", "deltaFrames": 12, "linked": false})).unwrap();
+    assert_eq!(state(&s, video).1, before_v.1 + s.sequence_rate().tick_of(12));
+    assert_eq!(state(&s, sound), before_a, "the linked audio keeps its range");
+
+    let (mut s, video, sound) = linked_pair();
+    s.execute("timeline.rateStretch", json!({"clip": video.0, "edge": "out", "deltaFrames": 12})).unwrap();
+    assert_eq!(state(&s, video).1, before_v.1 + s.sequence_rate().tick_of(12));
+    assert_eq!(state(&s, sound).1, before_a.1 + s.sequence_rate().tick_of(12), "the linked audio follows");
+}
diff --git a/crates/engine/src/masks.rs b/crates/engine/src/masks.rs
index 7dedd9c35..2fd751cda 100644
--- a/crates/engine/src/masks.rs
+++ b/crates/engine/src/masks.rs
@@ -51,7 +51,7 @@ pub(crate) fn commands() -> Vec<CommandSpec> {
         spec(
             "masks.moveVertex",
             "Move Mask Vertex",
-            r#"{"clip":id?,"effect":index|id?,"mask":n?,"vertex":n,"handle":"point"|"in"|"out"?,"to":[x,y]?|"delta":[dx,dy]?,"breakHandles":bool?,"merge":key?}"#,
+            r#"{"clip":id?,"effect":index|id?,"mask":n?,"vertex":n|"vertices":[n],"handle":"point"|"in"|"out"?,"to":[x,y]?|"delta":[dx,dy]?,"breakHandles":bool?,"merge":key?}"#,
             move_vertex,
         ),
         spec("masks.translate", "Move Mask", r#"{"clip":id?,"effect":index|id?,"mask":n?,"delta":[dx,dy],"merge":key?}"#, translate),
@@ -324,6 +324,9 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn move_vertex(s: &mut Session, p: &Value) -> Result<Value> {
+    if p.get("vertices").is_some_and(|v| !v.is_null()) {
+        return move_vertices(s, p);
+    }
     let vi = u64_p(p, "vertex").ok_or_else(|| bad("masks.moveVertex", "need `vertex`"))? as usize;
     let handle = str_p(p, "handle").unwrap_or("point").to_string();
     let to = p.get("to").and_then(pt);
@@ -362,6 +365,33 @@ fn move_vertex(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(Value::Null)
 }
 
+/// `masks.moveVertex` with `vertices`: the listed points move by `delta` together, in one edit
+/// (the multi-vertex drag on the Program monitor). Any index past the path moves nothing.
+fn move_vertices(s: &mut Session, p: &Value) -> Result<Value> {
+    const ID: &str = "masks.moveVertex";
+    let list = p.get("vertices").and_then(Value::as_array).ok_or_else(|| bad(ID, "`vertices` is a list of vertex indices"))?;
+    let mut only = list
+        .iter()
+        .map(|i| i.as_u64().and_then(|i| usize::try_from(i).ok()).ok_or_else(|| bad(ID, "`vertices` is a list of vertex indices")))
+        .collect::<Result<Vec<_>>>()?;
+    only.sort_unstable();
+    only.dedup();
+    if str_p(p, "handle").is_some_and(|h| h != "point") || p.get("to").is_some() {
+        return Err(bad(ID, "`vertices` moves points by `delta`"));
+    }
+    let d = p.get("delta").and_then(pt).ok_or_else(|| bad(ID, "need `delta`"))?;
+    edit_mask(s, p, "Move Mask Vertex", move |m, t| {
+        let mut path = m.path_at(t);
+        for &vi in &only {
+            let v = path.vertices.get_mut(vi).ok_or_else(|| bad(ID, format!("no vertex {vi}")))?;
+            v.p = v.p + d;
+        }
+        set_path_at(m, t, path);
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
 fn translate(s: &mut Session, p: &Value) -> Result<Value> {
     let d = p.get("delta").and_then(pt).ok_or_else(|| bad("masks.translate", "need `delta`"))?;
     edit_mask(s, p, "Move Mask", move |m, t| {
diff --git a/crates/engine/src/masks_tests.rs b/crates/engine/src/masks_tests.rs
index c25cb4680..eab7a3a2e 100644
--- a/crates/engine/src/masks_tests.rs
+++ b/crates/engine/src/masks_tests.rs
@@ -399,3 +399,39 @@ fn path_json_round_trip_keeps_tangents() {
     // the serialized project form still parses
     assert_eq!(crate::masks::path_from_json(&serde_json::to_value(&path).unwrap()), Some(path));
 }
+
+/// `masks.moveVertex` with `vertices` moves several points by the same delta in one edit (the
+/// Program monitor's multi-vertex drag, #3150); a bad index leaves every vertex where it was.
+#[test]
+fn move_vertex_moves_a_list_of_vertices_together() {
+    let (mut s, _) = demo();
+    s.execute("masks.add", json!({"effect": "opacity", "shape": "polygon", "center": [400, 400], "size": [200, 200]})).unwrap();
+    let pts = |s: &mut Session| -> Vec<(f64, f64)> {
+        let l = s.execute("masks.list", json!({})).unwrap();
+        l["masks"][0]["path"]["vertices"].as_array().unwrap().iter().map(|v| (v["p"][0].as_f64().unwrap(), v["p"][1].as_f64().unwrap())).collect()
+    };
+    let before = pts(&mut s);
+    let n = s.history.undo.len();
+    // two frames of one drag, a vertex listed twice moves once
+    for _ in 0..2 {
+        s.execute("masks.moveVertex", json!({"vertices": [0, 2, 2], "delta": [10, -5], "merge": "vertex-1"})).unwrap();
+    }
+    assert_eq!(s.history.undo.len(), n + 1, "one undo step for the drag");
+    let after = pts(&mut s);
+    for i in [0, 2] {
+        assert_eq!(after[i], (before[i].0 + 20.0, before[i].1 - 10.0), "vertex {i}");
+    }
+    for i in [1, 3] {
+        assert_eq!(after[i], before[i], "vertex {i} stays");
+    }
+    // an index past the last vertex moves nothing
+    let e = s.execute("masks.moveVertex", json!({"vertices": [1, 9], "delta": [10, 0]})).unwrap_err().to_string();
+    assert!(e.contains("no vertex 9"), "{e}");
+    assert_eq!(pts(&mut s), after);
+    // a list moves points, by a delta
+    assert!(s.execute("masks.moveVertex", json!({"vertices": [1], "to": [0, 0]})).is_err());
+    assert!(s.execute("masks.moveVertex", json!({"vertices": [1], "handle": "in", "delta": [1, 0]})).is_err());
+    assert!(s.execute("masks.moveVertex", json!({"vertices": "1", "delta": [1, 0]})).is_err());
+    s.undo();
+    assert_eq!(pts(&mut s), before);
+}
diff --git a/crates/engine/src/media_browser.rs b/crates/engine/src/media_browser.rs
index d1e65f815..f2ea3013f 100644
--- a/crates/engine/src/media_browser.rs
+++ b/crates/engine/src/media_browser.rs
@@ -636,22 +636,33 @@ fn format_size(b: u64) -> String {
     }
 }
 
-/// `YYYY-MM-DD HH:MM` (UTC) from Unix seconds.
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// input exact instead of collapsing out-of-range years to the epoch. `secs` is `u64`, so `days`
+/// (≤ `u64::MAX / 86_400`) always fits an `i64`.
+fn utc_parts(secs: u64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((secs / 86_400) as i64, (secs % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
+/// `YYYY-MM-DD HH:MM` (UTC) from Unix seconds. Years far outside chrono's own range are preserved
+/// (the old hand-rolled conversion kept them) rather than collapsing to the epoch.
 pub fn format_date(secs: u64) -> String {
-    let days = (secs / 86_400) as i64;
-    let rem = secs % 86_400;
-    // civil-from-days (Howard Hinnant's algorithm)
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let y = yoe + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = if m <= 2 { y + 1 } else { y };
-    format!("{y:04}-{m:02}-{d:02} {:02}:{:02}", rem / 3600, (rem / 60) % 60)
+    let (y, t) = utc_parts(secs);
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%d %H:%M"))
 }
 
 fn probe_cmd(s: &mut Session, p: &Value) -> Result<Value> {
@@ -773,3 +784,23 @@ pub fn std_home_dir() -> Option<String> {
     let vars = if cfg!(windows) { ["USERPROFILE", "HOME"] } else { ["HOME", "USERPROFILE"] };
     vars.iter().find_map(|v| std::env::var(v).ok().filter(|h| !h.is_empty()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn format_date_is_utc_minutes() {
+        // Pinned against the previous hand-rolled civil-from-days output.
+        assert_eq!(format_date(0), "1970-01-01 00:00");
+        assert_eq!(format_date(951_782_400), "2000-02-29 00:00");
+        assert_eq!(format_date(1_709_164_800), "2024-02-29 00:00");
+        assert_eq!(format_date(1_790_775_907), "2026-09-30 13:45");
+        // Years past 9999 keep the plain zero-padded year (no `+`).
+        assert_eq!(format_date(253_402_300_800), "10000-01-01 00:00");
+        // Values far beyond chrono's own range are preserved (the old hand-rolled civil-from-days
+        // kept them); they must not collapse to the epoch (reviewer FredApps).
+        assert_eq!(format_date(10_000_000_000_000), "318857-05-20 17:46");
+        assert_eq!(format_date(u64::MAX), "584554051223-11-09 07:00");
+    }
+}
diff --git a/crates/engine/src/media_pool.rs b/crates/engine/src/media_pool.rs
index 23278317f..d3bc86e87 100644
--- a/crates/engine/src/media_pool.rs
+++ b/crates/engine/src/media_pool.rs
@@ -17,7 +17,7 @@
 use std::collections::{BTreeSet, HashMap};
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex, RwLock};
+use std::sync::{Arc, Mutex, PoisonError, RwLock};
 
 use filmcraft_frame::{AudioBuffer, VideoFrame};
 use filmcraft_media::generators::GeneratorSource;
@@ -147,24 +147,24 @@ fn file_name(path: &str) -> String {
 
 impl MediaPool {
     pub fn register_opener(&self, o: Opener) {
-        self.openers.write().unwrap_or_else(|e| e.into_inner()).push(o);
+        self.openers.write().unwrap_or_else(PoisonError::into_inner).push(o);
     }
 
     /// Cache a source for an item, valid whatever the item's reference (generators).
     pub fn insert(&self, item: ItemId, src: SharedSource) {
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).insert(item, (String::new(), src));
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).insert(item, (String::new(), src));
     }
 
     /// Cache a source for an item under its [`media_key`].
     pub fn insert_keyed(&self, item: ItemId, key: String, src: SharedSource) {
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).insert(item, (key, src));
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).insert(item, (key, src));
     }
 
     /// Cache a source opened from `path` for an item.
     pub fn insert_file(&self, item: ItemId, path: &str, src: SharedSource) {
-        self.offline.write().unwrap_or_else(|e| e.into_inner()).remove(&item);
+        self.offline.write().unwrap_or_else(PoisonError::into_inner).remove(&item);
         let src = self.unsupported_as_slate(item, path, src);
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).insert(item, (format!("file:{path}"), src));
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).insert(item, (format!("file:{path}"), src));
     }
 
     /// `src` (opened from `path` for `item`) showing the unreadable slate for the frames it
@@ -175,9 +175,9 @@ impl MediaPool {
     }
 
     pub fn remove(&self, item: ItemId) {
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).remove(&item);
-        self.proxies.write().unwrap_or_else(|e| e.into_inner()).remove(&item);
-        self.offline.write().unwrap_or_else(|e| e.into_inner()).remove(&item);
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).remove(&item);
+        self.proxies.write().unwrap_or_else(PoisonError::into_inner).remove(&item);
+        self.offline.write().unwrap_or_else(PoisonError::into_inner).remove(&item);
     }
 
     /// Record the media and proxy paths of `p`, loaded from the document at `document` (None: one
@@ -194,7 +194,7 @@ impl MediaPool {
     /// [`Self::add_stored`] for single paths.
     pub fn add_stored_paths(&self, paths: impl IntoIterator<Item = String>, document: Option<&str>) {
         let document = document.filter(|d| !d.is_empty()).map(PathBuf::from);
-        let mut stored = self.stored.write().unwrap_or_else(|e| e.into_inner());
+        let mut stored = self.stored.write().unwrap_or_else(PoisonError::into_inner);
         for p in paths {
             stored.entry(p).or_insert_with(|| document.clone());
         }
@@ -202,12 +202,12 @@ impl MediaPool {
 
     /// Forget the stored paths (a new project).
     pub fn clear_stored(&self) {
-        self.stored.write().unwrap_or_else(|e| e.into_inner()).clear();
+        self.stored.write().unwrap_or_else(PoisonError::into_inner).clear();
     }
 
     /// The user picked `path` in this session (import, Link Media): open it as given.
     pub fn allow(&self, path: &str) {
-        self.stored.write().unwrap_or_else(|e| e.into_inner()).remove(path);
+        self.stored.write().unwrap_or_else(PoisonError::into_inner).remove(path);
     }
 
     /// The file to open for `path`, a media or proxy path of the project: a stored path as
@@ -217,7 +217,7 @@ impl MediaPool {
         if cfg!(target_arch = "wasm32") {
             return Ok(path.to_string());
         }
-        match self.stored.read().unwrap_or_else(|e| e.into_inner()).get(path) {
+        match self.stored.read().unwrap_or_else(PoisonError::into_inner).get(path) {
             Some(document) => crate::doc_path::resolve(path, document.as_deref()),
             None => Ok(path.to_string()),
         }
@@ -230,18 +230,18 @@ impl MediaPool {
 
     /// Forget every opened source (files are re-read on next use).
     pub fn clear(&self) {
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).clear();
-        self.proxies.write().unwrap_or_else(|e| e.into_inner()).clear();
-        self.offline.write().unwrap_or_else(|e| e.into_inner()).clear();
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).clear();
+        self.proxies.write().unwrap_or_else(PoisonError::into_inner).clear();
+        self.offline.write().unwrap_or_else(PoisonError::into_inner).clear();
     }
 
     pub fn cached(&self, item: ItemId) -> Option<SharedSource> {
-        self.sources.read().unwrap_or_else(|e| e.into_inner()).get(&item).map(|(_, s)| s.clone())
+        self.sources.read().unwrap_or_else(PoisonError::into_inner).get(&item).map(|(_, s)| s.clone())
     }
 
     /// Sources opened so far (originals and proxies; `perf.stats`).
     pub fn open_sources(&self) -> usize {
-        self.sources.read().unwrap_or_else(|e| e.into_inner()).len() + self.proxies.read().unwrap_or_else(|e| e.into_inner()).len()
+        self.sources.read().unwrap_or_else(PoisonError::into_inner).len() + self.proxies.read().unwrap_or_else(PoisonError::into_inner).len()
     }
 
     pub fn use_proxies(&self) -> bool {
@@ -267,12 +267,12 @@ impl MediaPool {
 
     /// Why an item last rendered offline (None = online or not opened yet).
     pub fn offline_status(&self, item: ItemId) -> Option<OfflineStatus> {
-        self.offline.read().unwrap_or_else(|e| e.into_inner()).get(&item).cloned()
+        self.offline.read().unwrap_or_else(PoisonError::into_inner).get(&item).cloned()
     }
 
     /// Open a file through the registered openers.
     pub fn open_bytes(&self, name: &str, bytes: Arc<[u8]>) -> Result<SharedSource, MediaError> {
-        let openers = self.openers.read().unwrap_or_else(|e| e.into_inner()).clone();
+        let openers = self.openers.read().unwrap_or_else(PoisonError::into_inner).clone();
         filmcraft_media::open_bytes(name, bytes, &openers)
     }
 
@@ -281,7 +281,7 @@ impl MediaPool {
     pub fn open_file(&self, path: &str, services: &dyn Services) -> Result<SharedSource, MediaError> {
         let io = |e: std::io::Error| if e.kind() == std::io::ErrorKind::NotFound { MediaError::Offline(e.to_string()) } else { MediaError::Io(e.to_string()) };
         if let Some(r) = services.reader(path) {
-            let openers = self.openers.read().unwrap_or_else(|e| e.into_inner()).clone();
+            let openers = self.openers.read().unwrap_or_else(PoisonError::into_inner).clone();
             return filmcraft_media::reader::open_reader(&file_name(path), r.map_err(io)?, &filmcraft_codecs::reader_openers(), &openers);
         }
         let bytes = services.read_file(path).map_err(io)?;
@@ -294,7 +294,7 @@ impl MediaPool {
     pub fn probe_file(&self, path: &str, services: &dyn Services) -> Result<SharedSource, MediaError> {
         let Some(r) = services.reader(path) else { return self.open_file(path, services) };
         let r = r.map_err(|e| if e.kind() == std::io::ErrorKind::NotFound { MediaError::Offline(e.to_string()) } else { MediaError::Io(e.to_string()) })?;
-        let openers = self.openers.read().unwrap_or_else(|e| e.into_inner()).clone();
+        let openers = self.openers.read().unwrap_or_else(PoisonError::into_inner).clone();
         filmcraft_media::reader::open_reader_within(&file_name(path), r, &filmcraft_codecs::reader_openers(), &openers, PROBE_WHOLE_FILE_MAX)
     }
 
@@ -319,7 +319,7 @@ impl MediaPool {
             return Some(s);
         }
         let key = media_key(m);
-        if let Some((k, s)) = self.sources.read().unwrap_or_else(|e| e.into_inner()).get(&item)
+        if let Some((k, s)) = self.sources.read().unwrap_or_else(PoisonError::into_inner).get(&item)
             && (k.is_empty() || *k == key)
         {
             return Some(s.clone());
@@ -342,7 +342,7 @@ impl MediaPool {
                 }
             }) {
                 Ok(s) => {
-                    self.offline.write().unwrap_or_else(|e| e.into_inner()).remove(&item);
+                    self.offline.write().unwrap_or_else(PoisonError::into_inner).remove(&item);
                     self.unsupported_as_slate(item, path, s)
                 }
                 Err(_) if filmcraft_media::pending::is_set() => {
@@ -357,17 +357,17 @@ impl MediaPool {
                 }
             },
         };
-        self.sources.write().unwrap_or_else(|e| e.into_inner()).insert(item, (key, src.clone()));
+        self.sources.write().unwrap_or_else(PoisonError::into_inner).insert(item, (key, src.clone()));
         Some(src)
     }
 
     fn set_offline(&self, item: ItemId, reason: OfflineReason, path: &str, error: &str) {
-        self.offline.write().unwrap_or_else(|e| e.into_inner()).insert(item, OfflineStatus { reason, path: path.to_string(), error: error.to_string() });
+        self.offline.write().unwrap_or_else(PoisonError::into_inner).insert(item, OfflineStatus { reason, path: path.to_string(), error: error.to_string() });
     }
 
     fn proxy_source(&self, item: ItemId, path: &str, m: &MediaClip, services: &dyn Services) -> Option<SharedSource> {
         let key = format!("proxy:{path}");
-        if let Some((k, s)) = self.proxies.read().unwrap_or_else(|e| e.into_inner()).get(&item)
+        if let Some((k, s)) = self.proxies.read().unwrap_or_else(PoisonError::into_inner).get(&item)
             && *k == key
         {
             return Some(s.clone());
@@ -387,7 +387,7 @@ impl MediaPool {
                     None
                 };
                 let src: SharedSource = Arc::new(ProxySource { proxy: s, info: m.info.clone(), audio_from });
-                self.proxies.write().unwrap_or_else(|e| e.into_inner()).insert(item, (key, src.clone()));
+                self.proxies.write().unwrap_or_else(PoisonError::into_inner).insert(item, (key, src.clone()));
                 Some(src)
             }
             Err(e) => {
@@ -432,7 +432,7 @@ impl PoolProvider {
     /// item order (subclips count as their media). Empty when not recording.
     pub fn offline_used(&self) -> Vec<OfflineMedia> {
         let Some(used) = &self.used else { return Vec::new() };
-        let used = used.lock().unwrap_or_else(|e| e.into_inner()).clone();
+        let used = used.lock().unwrap_or_else(PoisonError::into_inner).clone();
         let media: BTreeSet<ItemId> = used.into_iter().filter_map(|i| self.project.resolve_media(i).map(|(id, _, _)| id)).collect();
         media
             .into_iter()
@@ -453,7 +453,7 @@ impl PoolProvider {
 impl filmcraft_render::SourceProvider for PoolProvider {
     fn source(&self, item: ItemId) -> Option<SharedSource> {
         if let Some(used) = &self.used {
-            used.lock().unwrap_or_else(|e| e.into_inner()).insert(item);
+            used.lock().unwrap_or_else(PoisonError::into_inner).insert(item);
         }
         if self.full_res { self.pool.full_res_source(&self.project, item, &*self.services) } else { self.pool.source_for(&self.project, item, &*self.services) }
     }
@@ -485,7 +485,7 @@ impl MediaSource for SlateSource {
         let v = self.info.video.as_ref().ok_or(MediaError::NoStream("video"))?;
         let s = req.scale.clamp(1.0 / 64.0, 1.0);
         let (w, h) = (((v.width as f32 * s).round() as u32).max(2), ((v.height as f32 * s).round() as u32).max(2));
-        let mut last = self.last.lock().unwrap_or_else(|e| e.into_inner());
+        let mut last = self.last.lock().unwrap_or_else(PoisonError::into_inner);
         if let Some(f) = last.as_ref()
             && f.width == w
             && f.height == h
@@ -521,7 +521,7 @@ impl MediaSource for UnsupportedAsSlate {
     fn video_frame(&self, req: FrameRequest) -> filmcraft_media::Result<Arc<VideoFrame>> {
         match self.inner.video_frame(req) {
             Err(MediaError::Unsupported(why)) => {
-                self.offline.write().unwrap_or_else(|e| e.into_inner()).entry(self.item).or_insert_with(|| {
+                self.offline.write().unwrap_or_else(PoisonError::into_inner).entry(self.item).or_insert_with(|| {
                     log::warn!("media unreadable: {}: {why}", self.path);
                     OfflineStatus { reason: OfflineReason::Unreadable, path: self.path.clone(), error: why }
                 });
@@ -560,7 +560,7 @@ impl MediaSource for DamagedAsSlate {
     }
     fn video_frame(&self, req: FrameRequest) -> filmcraft_media::Result<Arc<VideoFrame>> {
         let r = self.inner.video_frame(req);
-        let mut failures = self.failures.lock().unwrap_or_else(|e| e.into_inner());
+        let mut failures = self.failures.lock().unwrap_or_else(PoisonError::into_inner);
         match r {
             Ok(f) => {
                 failures.remove(&self.item);
diff --git a/crates/engine/src/multicam.rs b/crates/engine/src/multicam.rs
index 66e36308f..6145bbbd3 100644
--- a/crates/engine/src/multicam.rs
+++ b/crates/engine/src/multicam.rs
@@ -243,17 +243,19 @@ fn can_synchronize(s: &Session) -> std::result::Result<(), String> {
     if sel.len() < 2 { Err("select at least two clips to synchronize".into()) } else { Ok(()) }
 }
 fn has_items(s: &Session) -> std::result::Result<(), String> {
-    if s.state.project_selection.iter().any(|i| sync::project_clip(&s.project, *i).is_some()) {
+    if selected_items(s).iter().any(|i| sync::project_clip(&s.project, *i).is_some()) {
         Ok(())
     } else {
-        Err("select clips in the Project panel".into())
+        Err("select clips in the Project panel or the Timeline".into())
     }
 }
+/// Two clips or more: Merge Clips then opens its dialog, which says what is wrong with a
+/// selection it can't merge (two video clips, no audio clip) instead of a greyed-out menu item.
 fn has_two_items(s: &Session) -> std::result::Result<(), String> {
-    if s.state.project_selection.iter().filter(|i| sync::project_clip(&s.project, **i).is_some()).count() >= 2 {
+    if selected_items(s).iter().filter(|i| sync::project_clip(&s.project, **i).is_some()).count() >= 2 {
         Ok(())
     } else {
-        Err("select a video clip and audio clips in the Project panel".into())
+        Err("select a video clip and audio clips in the Project panel or the Timeline".into())
     }
 }
 
@@ -262,10 +264,30 @@ fn has_two_items(s: &Session) -> std::result::Result<(), String> {
 fn items_p(s: &Session, p: &Value) -> Vec<ItemId> {
     match p.get("items").and_then(Value::as_array) {
         Some(a) => a.iter().filter_map(|v| v.as_u64().map(ItemId)).collect(),
-        None => s.state.project_selection.clone(),
+        None => selected_items(s),
     }
 }
 
+/// The items Merge Clips and Create Multi-Camera Source Sequence work on without `items`: the
+/// clips selected in the Project panel, or, with none there, the media of the clips selected in
+/// the Timeline (with their linked partners), once each in selection order (#1362).
+pub fn selected_items(s: &Session) -> Vec<ItemId> {
+    if s.state.project_selection.iter().any(|i| sync::project_clip(&s.project, *i).is_some()) {
+        return s.state.project_selection.clone();
+    }
+    let Some(q) = s.active_sequence() else { return Vec::new() };
+    let mut out = Vec::new();
+    for c in with_links(s, &s.state.selection) {
+        if let Some((_, it)) = q.find_item(c)
+            && sync::project_clip(&s.project, it.item).is_some()
+            && !out.contains(&it.item)
+        {
+            out.push(it.item);
+        }
+    }
+    out
+}
+
 fn method_p(p: &Value, cmd: &str) -> Result<Method> {
     Method::from_params(p).map_err(|e| bad(cmd, e))
 }
diff --git a/crates/engine/src/multicam_tests.rs b/crates/engine/src/multicam_tests.rs
index 1a8c3528b..c9221726f 100644
--- a/crates/engine/src/multicam_tests.rs
+++ b/crates/engine/src/multicam_tests.rs
@@ -328,6 +328,59 @@ const H: u32 = 90;
 /// Three 4-second cameras (different scenes, own audio), a multi-camera source sequence by In
 /// points, and a sequence holding one multi-camera clip on V1/A1. Returns (session, camera items,
 /// source sequence, edit sequence).
+/// #1362: with nothing selected in the Project panel, Create Multi-Camera Source Sequence and Merge
+/// Clips take the media of the clips selected in the Timeline.
+#[test]
+fn multicam_from_clips_selected_in_the_timeline() {
+    let dir = tmp_dir("mc-timeline");
+    let files: Vec<PathBuf> = ["a.mov", "b.mov", "c.mov"].iter().map(|f| dir.join(f)).collect();
+    for (f, sc) in files.iter().zip([DemoScene::OceanSunset, DemoScene::CityNight, DemoScene::Aurora]) {
+        make_movie(f, sc, W, H, 48);
+    }
+    let mut s = Session::default();
+    let refs: Vec<&Path> = files.iter().map(|p| p.as_path()).collect();
+    let items = import(&mut s, &refs);
+    let mut p = (*s.project).clone();
+    let edit =
+        p.new_sequence("Edit", filmcraft_project::SequenceSettings { width: W, height: H, frame_rate: FrameRate::FPS_24, ..Default::default() }, 1, 1, None);
+    s.project = std::sync::Arc::new(p);
+    s.state.active_sequence = Some(edit);
+    for (k, item) in items.iter().enumerate() {
+        s.set_playhead(FrameRate::FPS_24.tick_of(k as i64 * 48));
+        s.execute("source.open", json!({"item": item.0})).unwrap();
+        s.execute("source.overwrite", json!({})).unwrap();
+    }
+    s.execute("project.select", json!({"items": []})).unwrap();
+    s.execute("timeline.select", json!({"clips": []})).unwrap();
+    assert!(!s.is_enabled("clip.createMulticam"), "nothing selected anywhere");
+    let clips: Vec<u64> = s.active_sequence().unwrap().video_tracks[0].items.iter().map(|c| c.id.0).collect();
+    assert_eq!(clips.len(), 3);
+    s.execute("timeline.select", json!({"clips": clips})).unwrap();
+    assert!(s.is_enabled("clip.createMulticam") && s.is_enabled("clip.mergeClips"));
+    // Merge Clips opens on them, and says why it can't merge three video clips
+    assert!(s.execute("clip.mergeClips", json!({"method": "in"})).unwrap_err().to_string().contains("one video clip"));
+    let r = s.execute("clip.createMulticam", json!({"method": "in"})).unwrap();
+    let src = ItemId(r["sequence"].as_u64().unwrap());
+    let cameras: Vec<ItemId> = s.project.sequence(src).unwrap().video_tracks.iter().filter_map(|t| t.items.first().map(|c| c.item)).collect();
+    assert_eq!(cameras, items, "one camera per selected clip's media, in selection order");
+
+    // one video clip and an audio-only one, selected in the Timeline: Merge Clips takes them
+    s.state.active_sequence = Some(edit);
+    let wav = dir.join("room.wav");
+    std::fs::write(&wav, crate::voiceover::write_wav_f32(&vec![0.0; 48_000 * 2], 48_000)).unwrap();
+    let audio = import(&mut s, &[wav.as_path()])[0];
+    s.set_playhead(FrameRate::FPS_24.tick_of(200));
+    s.execute("source.open", json!({"item": audio.0})).unwrap();
+    s.execute("source.overwrite", json!({})).unwrap();
+    let q = s.active_sequence().unwrap();
+    let a = q.audio_tracks.iter().flat_map(|t| &t.items).find(|c| c.item == audio).unwrap().id.0;
+    s.execute("project.select", json!({"items": []})).unwrap();
+    s.execute("timeline.select", json!({"clips": [clips[0], a], "linked": false})).unwrap();
+    assert!(s.is_enabled("clip.mergeClips"));
+    let r = s.execute("clip.mergeClips", json!({"method": "in"})).unwrap();
+    assert!(r["item"].as_u64().is_some(), "{r}");
+}
+
 fn mc_session(audio: &str) -> (Session, Vec<ItemId>, ItemId, ItemId) {
     let dir = tmp_dir("mc-edit");
     let files: Vec<PathBuf> = ["a.mov", "b.mov", "c.mov"].iter().map(|f| dir.join(f)).collect();
diff --git a/crates/engine/src/narration.rs b/crates/engine/src/narration.rs
index cc9f1fdf8..562271dd1 100644
--- a/crates/engine/src/narration.rs
+++ b/crates/engine/src/narration.rs
@@ -98,7 +98,7 @@ fn cache_key(n: &Narration) -> String {
 
 fn tts_err(cmd: &str, e: tts::TtsError) -> EngineError {
     match e {
-        tts::TtsError::NotInstalled => bad(cmd, "the natural voices are not downloaded yet: Text to Speech ▸ Download natural voices (tts.downloadVoices)"),
+        tts::TtsError::NotInstalled => bad(cmd, "the natural voices are not downloaded yet: Text to Speech > Download natural voices (tts.downloadVoices)"),
         e => bad(cmd, e.to_string()),
     }
 }
diff --git a/crates/engine/src/previews.rs b/crates/engine/src/previews.rs
index 5b75c02f4..c726953db 100644
--- a/crates/engine/src/previews.rs
+++ b/crates/engine/src/previews.rs
@@ -219,17 +219,20 @@ impl PreviewStore {
         self.bump();
     }
 
-    /// Move to `dir`, taking this store's preview files along (first save of a project).
+    /// Move to `dir`, taking this store's preview files along (first save of a project). The folder is
+    /// created only when there are files to take along: a render creates it when it needs it (#2343).
     pub fn move_to(&self, dir: PathBuf) {
         let old = self.dir();
         if old.as_deref() == Some(dir.as_path()) {
             return;
         }
+        let files = self.files.read().unwrap_or_else(|e| e.into_inner()).clone();
         if let Some(old) = &old
+            && !files.is_empty()
             && (old.starts_with(crate::temp_dir()) || self.temp_root().is_some_and(|r| old.starts_with(r)))
         {
             let _ = std::fs::create_dir_all(&dir);
-            for name in self.files.read().unwrap_or_else(|e| e.into_inner()).iter() {
+            for name in &files {
                 let (a, b) = (old.join(name), dir.join(name));
                 if !b.exists() && std::fs::rename(&a, &b).is_err() {
                     let _ = std::fs::copy(&a, &b).map(|_| std::fs::remove_file(&a));
@@ -535,8 +538,7 @@ impl PreviewStore {
             }
         }
         let path = self.dir()?.join(name);
-        let bytes = std::fs::read(&path).ok()?;
-        let src = pool.open_bytes(name, bytes.into()).ok()?;
+        let src = open_preview_file(pool, name, &path)?;
         let mut g = self.sources.lock().unwrap_or_else(|e| e.into_inner());
         g.push((name.to_string(), src.clone()));
         if g.len() > 6 {
@@ -546,6 +548,21 @@ impl PreviewStore {
     }
 }
 
+/// Open a rendered preview file. Native builds read it in place (the container's index now,
+/// frames on demand): previews are full-resolution ProRes, gigabytes a minute, and reading each
+/// one whole filled memory during render and playback (#2185).
+#[cfg(any(unix, windows))]
+pub(crate) fn open_preview_file(_pool: &MediaPool, name: &str, path: &std::path::Path) -> Option<SharedSource> {
+    let reader = filmcraft_media::reader::FileReader::open(path).ok()?;
+    filmcraft_media::reader::open_reader_within(name, std::sync::Arc::new(reader), &filmcraft_codecs::reader_openers(), &[], 0).ok()
+}
+
+#[cfg(not(any(unix, windows)))]
+pub(crate) fn open_preview_file(pool: &MediaPool, name: &str, path: &std::path::Path) -> Option<SharedSource> {
+    let bytes = std::fs::read(path).ok()?;
+    pool.open_bytes(name, bytes.into()).ok()
+}
+
 fn need_state(seg: &Segment) -> BarState {
     match seg.need {
         Need::None => BarState::None,
@@ -639,7 +656,6 @@ pub fn render(s: &mut Session, mode: RenderMode, p: &Value) -> Result<Value> {
     let provider = s.media.full_res_provider(project.clone(), s.services.clone());
     let (prog, res) = (job.progress.clone(), job.result.clone());
     let nseg = todo.len();
-    let pool = s.media.clone();
     let run = move || {
         let t0 = web_time::Instant::now();
         let mut bytes = 0u64;
@@ -679,8 +695,6 @@ pub fn render(s: &mut Session, mode: RenderMode, p: &Value) -> Result<Value> {
                         break;
                     }
                     store.add_video(&name);
-                    // open it now so the first playback doesn't wait for the file read
-                    let _ = store.open(&pool, &name);
                 }
                 Err(e) => {
                     let _ = std::fs::remove_file(&part);
diff --git a/crates/engine/src/previews_tests.rs b/crates/engine/src/previews_tests.rs
index dfc6b7a48..837d1b62b 100644
--- a/crates/engine/src/previews_tests.rs
+++ b/crates/engine/src/previews_tests.rs
@@ -224,6 +224,27 @@ fn previews_survive_save_and_open() {
     let _ = std::fs::remove_dir_all(&folder);
 }
 
+#[test]
+fn saving_without_previews_creates_no_previews_folder() {
+    // #2343: a project with nothing rendered leaves only the file it was asked to write
+    let mut s = Session::default();
+    let folder = tmp("save-empty");
+    std::fs::create_dir_all(&folder).unwrap();
+    let path = folder.join("Film.fcproj").to_string_lossy().to_string();
+    s.execute("file.save", json!({"path": path})).unwrap();
+    assert_eq!(s.previews.dir().unwrap(), folder.join("FilmCraft Previews").join("Film"));
+    assert!(!folder.join("FilmCraft Previews").exists());
+    // the first render creates it
+    let (mut r, _) = session("save-empty-render");
+    r.execute("file.save", json!({"path": path})).unwrap();
+    assert!(!folder.join("FilmCraft Previews").exists());
+    let v = r.execute("sequence.renderEffectsInToOut", json!({"wait": true})).unwrap();
+    job_ok(&r, &v);
+    assert!(folder.join("FilmCraft Previews").join("Film").is_dir());
+    assert_eq!(states(&r), vec!["green", "none"]);
+    let _ = std::fs::remove_dir_all(&folder);
+}
+
 #[test]
 fn render_selection_and_audio_previews() {
     let (mut s, a) = session("sel");
@@ -282,3 +303,29 @@ fn float_wav_round_trip() {
 fn bar_state_serializes_lowercase() {
     assert_eq!(serde_json::to_value(BarState::Green).unwrap(), json!("green"));
 }
+
+/// #2185: preview files are read in place, never whole. Rendered previews still play from their
+/// files, and a file only a whole-file reader could open is refused rather than loaded.
+#[test]
+fn preview_files_are_streamed_not_read_whole() {
+    let (mut s, _) = session("stream");
+    let v = s.execute("sequence.renderEffectsInToOut", json!({"wait": true})).unwrap();
+    job_ok(&s, &v);
+    let seq = s.state.active_sequence.unwrap();
+    assert!(s.previews.frame(&s.media, &s.project, seq, 5, 1.0).is_some(), "a rendered frame plays from its file");
+    // a still image opens only from its whole bytes: as a preview file it is not opened
+    let dir = s.previews.dir().unwrap();
+    let png = dir.join("still.png");
+    // a 1×1 PNG
+    const PNG: &[u8] = &[
+        137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8, 6, 0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 13, 73, 68, 65, 84,
+        120, 218, 99, 100, 96, 248, 95, 15, 0, 2, 135, 1, 128, 235, 71, 186, 146, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130,
+    ];
+    std::fs::write(&png, PNG).unwrap();
+    assert!(s.media.open_bytes("still.png", PNG.into()).is_ok(), "the image opens from its bytes");
+    // (the web, without a file reader, still reads preview files whole)
+    if cfg!(any(unix, windows)) {
+        assert!(crate::previews::open_preview_file(&s.media, "still.png", &png).is_none());
+    }
+    let _ = std::fs::remove_dir_all(dir);
+}
diff --git a/crates/engine/src/project_manager.rs b/crates/engine/src/project_manager.rs
index 3a78fff18..53c543e80 100644
--- a/crates/engine/src/project_manager.rs
+++ b/crates/engine/src/project_manager.rs
@@ -137,7 +137,10 @@ pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
     for id in ids {
         let Some(m) = proj.item(id).and_then(|i| i.as_media()).cloned() else { continue };
         let MediaRef::File { path } = &m.media else { continue };
-        let size = s.services.file_size(path).unwrap_or(0);
+        // Project files carry stored paths; use only the media pool's resolved, policy-approved
+        // pathname for filesystem I/O. Keep the stored path in the project itself.
+        let source_path = s.media.follow(path).map_err(|why| EngineError::Other(format!("{path} is not opened: {why}")))?;
+        let size = s.services.file_size(&source_path).unwrap_or(0);
         original_bytes += size;
         let file = Path::new(path);
         let stem = file.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| format!("media-{}", id.0));
@@ -158,20 +161,23 @@ pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
         };
         taken.push(out.clone());
         let proxy = match (&m.proxy, include_proxies) {
-            (Some(MediaRef::File { path: pp }), true) if s.services.file_size(pp).is_ok() => {
-                let pf = Path::new(pp);
-                let ps = pf.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-                let pe = pf.extension().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-                let o = unique_path(&dest_dir.join("Proxies"), &ps, "", &pe, &taken).to_string_lossy().into_owned();
-                taken.push(o.clone());
-                let b = s.services.file_size(pp).unwrap_or(0);
-                original_bytes += b;
-                result_bytes += b;
-                Some((pp.clone(), o))
-            }
+            (Some(MediaRef::File { path: pp }), true) => match s.media.follow(pp) {
+                Ok(resolved_proxy) if s.services.file_size(&resolved_proxy).is_ok() => {
+                    let pf = Path::new(&resolved_proxy);
+                    let ps = pf.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                    let pe = pf.extension().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                    let o = unique_path(&dest_dir.join("Proxies"), &ps, "", &pe, &taken).to_string_lossy().into_owned();
+                    taken.push(o.clone());
+                    let b = s.services.file_size(&resolved_proxy).unwrap_or(0);
+                    original_bytes += b;
+                    result_bytes += b;
+                    Some((resolved_proxy, o))
+                }
+                _ => None,
+            },
             _ => None,
         };
-        work.push(Work { item: id, src_path: path.clone(), out, range, proxy });
+        work.push(Work { item: id, src_path: source_path, out, range, proxy });
     }
     let previews = s.path.as_deref().map(crate::previews::dir_for_project).filter(|d| include_previews && d.is_dir());
     if let Some(d) = &previews {
diff --git a/crates/engine/src/project_tools.rs b/crates/engine/src/project_tools.rs
index c5f967a75..a7959bac0 100644
--- a/crates/engine/src/project_tools.rs
+++ b/crates/engine/src/project_tools.rs
@@ -678,6 +678,7 @@ fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
     proj.name = name.clone();
     proj.root.name = name;
     s.project = std::sync::Arc::new(proj);
+    s.document_epoch = s.document_epoch.wrapping_add(1);
     s.history = Default::default();
     s.history.limit = 200;
     s.state = Session::default().state;
@@ -1027,7 +1028,7 @@ fn inside(dir: &std::path::Path, root: &std::path::Path) -> bool {
 
 /// Remember the Scratch Disks folders chosen in this session, so projects naming them may use
 /// them later (see [`trusted_scratch`]).
-fn remember_scratch_folders(s: &mut Session, dirs: &[String]) {
+pub(crate) fn remember_scratch_folders(s: &mut Session, dirs: &[String]) {
     const KEEP: usize = 64;
     let mut prefs = s.prefs.clone();
     let list = &mut prefs.auto_save.scratch_folders;
@@ -1062,7 +1063,7 @@ pub(crate) fn warn_untrusted_scratch(s: &mut Session) {
     let list = ignored.join(", ");
     log::warn!("project scratch disks outside the project folder not used: {list}");
     s.toast(format!(
-        "Scratch Disks: not using {list} (outside the project folder and not chosen on this computer). Auto-saves, previews and captured media go to the default location; choose the folder in Project Settings ▸ Scratch Disks to use it."
+        "Scratch Disks: not using {list} (outside the project folder and not chosen on this computer). Auto-saves, previews and captured media go to the default location; choose the folder in Project Settings > Scratch Disks to use it."
     ));
 }
 
@@ -1076,12 +1077,10 @@ fn project_settings_scratch(s: &mut Session, p: &Value) -> Result<Value> {
             None => {}
             Some(Value::Null) => *slot = None,
             Some(Value::String(x)) if x.is_empty() || x.eq_ignore_ascii_case("same as project") => *slot = None,
-            Some(Value::String(x))
-                if matches!(crate::doc_path::resolve(x, s.path.as_deref().map(std::path::Path::new)), Err(crate::doc_path::NotFollowed::Refused(_))) =>
-            {
-                return Err(bad("file.projectSettings.scratchDisks", format!("`{k}` must be a folder on this computer, not a network share or device")));
-            }
             Some(Value::String(x)) => {
+                if let Err(crate::doc_path::NotFollowed::Refused(why)) = crate::doc_path::resolve(x, s.path.as_deref().map(std::path::Path::new)) {
+                    return Err(bad("file.projectSettings.scratchDisks", format!("`{k}` must be a folder on this computer: {why}")));
+                }
                 chosen.push(x.clone());
                 *slot = Some(x.clone());
             }
diff --git a/crates/engine/src/project_tools_tests.rs b/crates/engine/src/project_tools_tests.rs
index 075525654..64965166c 100644
--- a/crates/engine/src/project_tools_tests.rs
+++ b/crates/engine/src/project_tools_tests.rs
@@ -307,6 +307,11 @@ fn media_properties_settings_and_scratch_disks() {
     assert!(s.execute("file.projectSettings.general", json!({"renderer": "quantum"})).is_err());
     s.execute("edit.undo", json!({})).unwrap();
     assert_eq!(s.project.settings.renderer, crate::project_tools::RENDERER_GPU);
+    // Scratch Disks: a drive another system names is refused before the project has a folder
+    if cfg!(unix) {
+        assert!(s.execute("file.projectSettings.scratchDisks", json!({"captured": r"D:\Captured"})).is_err());
+        assert!(s.project.settings.scratch.captured.is_none());
+    }
     // Scratch Disks: previews follow the Video Previews folder once the project is saved
     let proj = dir.join("Show.fcproj").to_string_lossy().to_string();
     s.execute("file.saveAs", json!({"path": proj})).unwrap();
diff --git a/crates/engine/src/proxies.rs b/crates/engine/src/proxies.rs
index d6c720fa6..e6e7f203c 100644
--- a/crates/engine/src/proxies.rs
+++ b/crates/engine/src/proxies.rs
@@ -97,6 +97,25 @@ pub fn transcode(
     preset: &Preset,
     progress: &Progress,
 ) -> std::result::Result<Report, String> {
+    transcode_with_file(clip, name, src, range, Dest { path: out, file: None }, preset, progress)
+}
+
+/// Output path, plus the already-open file to write into when the caller holds one.
+struct Dest<'a> {
+    path: &'a str,
+    file: Option<Arc<std::fs::File>>,
+}
+
+fn transcode_with_file(
+    clip: &MediaClip,
+    name: &str,
+    src: SharedSource,
+    range: Option<TimeRange>,
+    dest: Dest<'_>,
+    preset: &Preset,
+    progress: &Progress,
+) -> std::result::Result<Report, String> {
+    let Dest { path: out, file: output_file } = dest;
     let info = &clip.info;
     let rate = clip.frame_rate();
     let mut st = SequenceSettings::default();
@@ -140,6 +159,7 @@ pub fn transcode(
             as u32,
         part_of_batch: true,
         prores_profile: preset.prores.to_string(),
+        output_file,
         ..Default::default()
     };
     let project = Arc::new(p);
@@ -147,6 +167,59 @@ pub fn transcode(
     filmcraft_export::export(&project, seq, &settings, &provider, progress).map_err(|e| e.to_string())
 }
 
+/// An output created exclusively while choosing its name. Unless kept after a successful
+/// transcode, dropping it removes only that file (including on a cancelled or rejected job).
+struct ReservedOutput {
+    path: PathBuf,
+    file: Option<Arc<std::fs::File>>,
+    keep: bool,
+}
+
+impl ReservedOutput {
+    fn path(&self) -> &Path {
+        &self.path
+    }
+
+    fn file(&self) -> Option<Arc<std::fs::File>> {
+        self.file.clone()
+    }
+
+    fn preserve(&mut self) {
+        self.keep = true;
+    }
+}
+
+impl Drop for ReservedOutput {
+    fn drop(&mut self) {
+        if !self.keep {
+            // Release our handle before removal, which is required on Windows.
+            self.file.take();
+            let _ = std::fs::remove_file(&self.path);
+        }
+    }
+}
+
+/// Reserve a numbered output name without following a later replacement of its pathname.
+fn reserve_unique_path(dir: &Path, stem: &str, suffix: &str, ext: &str, taken: &[String]) -> Result<ReservedOutput> {
+    std::fs::create_dir_all(dir).map_err(|e| EngineError::Other(format!("{}: {e}", dir.display())))?;
+    let mut n = 1;
+    loop {
+        let name = if n == 1 { format!("{stem}{suffix}.{ext}") } else { format!("{stem}{suffix} {n}.{ext}") };
+        let path = dir.join(name);
+        if taken.contains(&path.to_string_lossy().into_owned()) {
+            n += 1;
+            continue;
+        }
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&path) {
+            Ok(file) => {
+                return Ok(ReservedOutput { path, file: Some(Arc::new(file)), keep: false });
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => n += 1,
+            Err(e) => return Err(EngineError::Other(format!("{}: {e}", path.display()))),
+        }
+    }
+}
+
 /// Frames a transcode of `clip` will write (for progress totals).
 pub fn frame_count(clip: &MediaClip, range: Option<TimeRange>) -> u64 {
     let rate = clip.frame_rate();
@@ -184,17 +257,17 @@ fn items_param(s: &Session, p: &Value) -> Vec<ItemId> {
 }
 
 /// Start a background transcode job over `work` (item, output path, preset). Returns the job id.
-pub fn start_job(s: &mut Session, label: String, work: Vec<(ItemId, String, &'static Preset)>, on_done: OnDone, wait: bool) -> Result<u64> {
+fn start_job(s: &mut Session, label: String, work: Vec<(ItemId, ReservedOutput, &'static Preset)>, on_done: OnDone, wait: bool) -> Result<u64> {
     let mut tasks = Vec::new();
     let mut total = 0;
-    for (item, out, pr) in work {
+    for (item, output, pr) in work {
         let (clip, _, name) = media_path(&s.project, item).ok_or_else(|| bad("media.createProxies", format!("item {} is not file media", item.0)))?;
         let src = s.media.full_res_source(&s.project, item, &*s.services).ok_or_else(|| EngineError::Other(format!("{name}: no source")))?;
         if s.media.offline_status(item).is_some() {
             return Err(EngineError::Other(format!("{name} is offline; link it first")));
         }
         total += frame_count(&clip, None);
-        tasks.push((item, clip, name, src, out, pr));
+        tasks.push((item, clip, name, src, output, pr));
     }
     let id = s.jobs.iter().map(|j| j.id).max().unwrap_or(0) + 1;
     let job = crate::Job { id, label, progress: Default::default(), result: Default::default() };
@@ -206,22 +279,20 @@ pub fn start_job(s: &mut Session, label: String, work: Vec<(ItemId, String, &'st
         let mut bytes = 0;
         let mut err = None;
         let n = tasks.len();
-        for (k, (item, clip, name, src, out, pr)) in tasks.into_iter().enumerate() {
+        for (k, (item, clip, name, src, mut output, pr)) in tasks.into_iter().enumerate() {
             if prog.cancel.load(std::sync::atomic::Ordering::Relaxed) {
                 err = Some("cancelled".to_string());
                 break;
             }
             *prog.status.lock().unwrap_or_else(|e| e.into_inner()) = format!("{name} ({} of {n})", k + 1);
-            if let Some(d) = Path::new(&out).parent() {
-                let _ = std::fs::create_dir_all(d);
-            }
-            match transcode(&clip, &name, src, None, &out, pr, &prog) {
+            let out = output.path().to_string_lossy().into_owned();
+            match transcode_with_file(&clip, &name, src, None, Dest { path: &out, file: output.file() }, pr, &prog) {
                 Ok(r) => {
                     bytes += r.bytes;
+                    output.preserve();
                     outs.lock().unwrap_or_else(|e| e.into_inner()).push((item, out));
                 }
                 Err(e) => {
-                    let _ = std::fs::remove_file(&out);
                     err = Some(format!("{name}: {e}"));
                     break;
                 }
@@ -371,14 +442,15 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
             }
         };
         let stem = Path::new(&path).file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or(name);
-        let out = unique_path(&proxy_dir(&path, dest.as_deref()), &stem, "_Proxy", pr.extension, &taken).to_string_lossy().into_owned();
+        let output = reserve_unique_path(&proxy_dir(&path, dest.as_deref()), &stem, "_Proxy", pr.extension, &taken)?;
+        let out = output.path().to_string_lossy().into_owned();
         taken.push(out.clone());
-        work.push((i, out, pr));
+        work.push((i, output, pr));
     }
     if work.is_empty() {
         return Err(EngineError::Other(format!("nothing to proxy: {}", skipped.iter().filter_map(|v| v["reason"].as_str()).collect::<Vec<_>>().join("; "))));
     }
-    let outputs: Vec<Value> = work.iter().map(|(i, o, _)| json!({"item": i.0, "path": o})).collect();
+    let outputs: Vec<Value> = work.iter().map(|(i, o, _)| json!({"item": i.0, "path": o.path()})).collect();
     let n = work.len();
     let label = format!("Create Proxies ({n} clip{})", if n == 1 { "" } else { "s" });
     let attach = bool_p(p, "attach").unwrap_or(true);
@@ -442,13 +514,24 @@ pub fn ingest(s: &mut Session, items: &[ItemId]) -> Result<Value> {
     if !ing.enabled || items.is_empty() {
         return Ok(Value::Null);
     }
+    // Ingest settings travel in a project file. A destination only becomes active after this
+    // machine has chosen it, or when it is safely inside the project folder.
+    let destination = ing
+        .destination
+        .as_deref()
+        .filter(|d| !d.is_empty())
+        .and_then(|d| crate::project_tools::trusted_scratch(Some(d), s.path.as_deref(), &s.prefs.auto_save.scratch_folders));
+    if ing.destination.as_deref().is_some_and(|d| !d.is_empty()) && destination.is_none() {
+        s.toast("Ingest: ignoring an untrusted project destination; choose it locally in Ingest Settings to enable copying.");
+        return Ok(json!({"skipped": "untrusted ingest destination"}));
+    }
     let mut copied = Vec::new();
     let copy = matches!(ing.action, IngestAction::Copy | IngestAction::CopyAndCreateProxies);
     if copy {
         for &i in items {
             let Some((_, path, _)) = media_path(&s.project, i) else { continue };
-            let dir = match &ing.destination {
-                Some(d) if !d.is_empty() => PathBuf::from(d),
+            let dir = match &destination {
+                Some(d) => d.clone(),
                 _ => Path::new(&path).parent().unwrap_or(Path::new(".")).join("Ingested Media"),
             };
             if Path::new(&path).file_name().is_some_and(|name| Path::new(&path) == dir.join(name)) {
@@ -461,7 +544,7 @@ pub fn ingest(s: &mut Session, items: &[ItemId]) -> Result<Value> {
     let mut job = Value::Null;
     match ing.action {
         IngestAction::CreateProxies | IngestAction::CopyAndCreateProxies => {
-            let p = json!({"items": items.iter().map(|i| i.0).collect::<Vec<_>>(), "preset": if ing.preset.is_empty() { DEFAULT_PROXY_PRESET } else { ing.preset.as_str() }, "destination": ing.destination});
+            let p = json!({"items": items.iter().map(|i| i.0).collect::<Vec<_>>(), "preset": if ing.preset.is_empty() { DEFAULT_PROXY_PRESET } else { ing.preset.as_str() }, "destination": destination.as_ref().map(|d| d.to_string_lossy().into_owned())});
             if items.iter().any(|i| s.project.item(*i).and_then(|x| x.as_media()).is_some_and(|m| m.info.video.is_some() && m.info.kind == MediaKind::Movie)) {
                 job = create(s, &p)?;
             }
@@ -476,14 +559,15 @@ pub fn ingest(s: &mut Session, items: &[ItemId]) -> Result<Value> {
                 if clip.info.video.is_none() {
                     continue;
                 }
-                let dir = match &ing.destination {
-                    Some(d) if !d.is_empty() => PathBuf::from(d),
+                let dir = match &destination {
+                    Some(d) => d.clone(),
                     _ => Path::new(&path).parent().unwrap_or(Path::new(".")).join("Ingested Media"),
                 };
                 let stem = Path::new(&path).file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or(name);
-                let out = unique_path(&dir, &stem, "", pr.extension, &taken).to_string_lossy().into_owned();
+                let output = reserve_unique_path(&dir, &stem, "", pr.extension, &taken)?;
+                let out = output.path().to_string_lossy().into_owned();
                 taken.push(out.clone());
-                work.push((i, out, pr));
+                work.push((i, output, pr));
             }
             if !work.is_empty() {
                 let id = start_job(s, format!("Ingest: transcode {} clip(s)", work.len()), work, OnDone::ReplaceMedia, false)?;
@@ -613,6 +697,9 @@ pub fn commands() -> Vec<CommandSpec> {
                 }
                 if let Some(d) = p.get("destination") {
                     ing.destination = d.as_str().filter(|d| !d.is_empty()).map(str::to_string);
+                    if let Some(d) = ing.destination.as_ref() {
+                        crate::project_tools::remember_scratch_folders(s, std::slice::from_ref(d));
+                    }
                 }
                 if let Some(pr) = str_p(p, "preset") {
                     if !pr.is_empty() && preset(pr).is_none() {
diff --git a/crates/engine/src/relink.rs b/crates/engine/src/relink.rs
index c3b6b3879..9649e5815 100644
--- a/crates/engine/src/relink.rs
+++ b/crates/engine/src/relink.rs
@@ -489,9 +489,14 @@ pub fn index_folder(root: &Path, limit: usize) -> BTreeMap<String, Vec<PathBuf>>
             if name.starts_with('.') {
                 continue;
             }
-            if p.is_dir() {
+            let Ok(file_type) = e.file_type() else { continue };
+            // A relink search must stay within the folder explicitly chosen by the user. In
+            // particular, following a directory symlink can make a small loop defeat the file
+            // budget and walk an unrelated tree. Symlinked files are still candidates.
+            let is_file = if file_type.is_symlink() { std::fs::metadata(&p).is_ok_and(|m| m.is_file()) } else { file_type.is_file() };
+            if file_type.is_dir() {
                 queue.push_back(p);
-            } else {
+            } else if is_file {
                 out.entry(name.to_ascii_lowercase()).or_default().push(p);
                 n += 1;
                 if n >= limit {
@@ -564,7 +569,11 @@ pub fn make_offline(s: &mut Session, p: &Value) -> Result<Value> {
     let mut deleted = Vec::new();
     if delete {
         for (_, path) in &files {
-            if std::fs::remove_file(path).is_ok() {
+            // Stored paths in an opened document are not authority to delete arbitrary files.
+            // Delete only the resolved path that the media pool permits opening.
+            if let Ok(path) = s.media.follow(path)
+                && std::fs::remove_file(&path).is_ok()
+            {
                 deleted.push(path.clone());
             }
         }
@@ -583,14 +592,14 @@ fn status_json(s: &Session, id: ItemId) -> Option<Value> {
     let status = match &path {
         None => "generated",
         Some(_) if m.offline => "offline",
-        Some(p) if s.services.file_size(p).is_err() => "missing",
+        Some(p) if s.media.follow(p).ok().is_none_or(|file| s.services.file_size(&file).is_err()) => "missing",
         Some(_) => match s.media.offline_status(id) {
             Some(o) if o.reason == filmcraft_render::offline::OfflineReason::Unreadable => "unreadable",
             _ => "online",
         },
     };
     let proxy = match &m.proxy {
-        Some(MediaRef::File { path }) => json!({"path": path, "online": s.services.file_size(path).is_ok()}),
+        Some(MediaRef::File { path }) => json!({"path": path, "online": s.media.follow(path).is_ok_and(|file| s.services.file_size(&file).is_ok())}),
         _ => Value::Null,
     };
     Some(json!({
@@ -743,11 +752,11 @@ pub fn on_open(s: &mut Session) -> usize {
         list.iter().filter(|m| m.status == "missing").filter_map(|m| s.media.follow(&m.path).err().map(|why| format!("{} ({why})", m.path))).collect();
     if !refused.is_empty() {
         log::warn!("media paths stored in the project not opened: {}", refused.join(", "));
-        s.toast(format!("Not opening {} media file(s) the project names on another computer or device; File ▸ Link Media… reconnects them", refused.len()));
+        s.toast(format!("Not opening {} media file(s) the project names on another computer or device; File > Link Media… reconnects them", refused.len()));
     }
     s.offline.prompt = !s.offline.missing.is_empty();
     if !s.offline.missing.is_empty() {
-        s.toast(format!("{} media file(s) are missing; File ▸ Link Media… reconnects them", s.offline.missing.len()));
+        s.toast(format!("{} media file(s) are missing; File > Link Media… reconnects them", s.offline.missing.len()));
     }
     list.len()
 }
diff --git a/crates/engine/src/relink_tests.rs b/crates/engine/src/relink_tests.rs
index 33208c544..7660f85ba 100644
--- a/crates/engine/src/relink_tests.rs
+++ b/crates/engine/src/relink_tests.rs
@@ -163,6 +163,29 @@ fn make_offline_shows_the_slate_until_relinked() {
     let _ = std::fs::remove_dir_all(&root);
 }
 
+#[cfg(unix)]
+#[test]
+fn relink_search_does_not_follow_directory_symlinks() {
+    use std::os::unix::fs::symlink;
+
+    let root = tmp_dir("relink-no-symlink-walk");
+    let inside = root.join("inside");
+    let outside = root.join("outside");
+    std::fs::create_dir_all(&inside).unwrap();
+    std::fs::create_dir_all(&outside).unwrap();
+    std::fs::write(inside.join("kept.mov"), b"kept").unwrap();
+    std::fs::write(outside.join("outside.mov"), b"outside").unwrap();
+    symlink(&outside, inside.join("loop")).unwrap();
+    symlink(outside.join("outside.mov"), inside.join("linked.mov")).unwrap();
+
+    let index = crate::relink::index_folder(&inside, 20_000);
+    assert!(index.contains_key("kept.mov"));
+    assert!(!index.contains_key("outside.mov"));
+    // a symlinked file is still media the user can relink to
+    assert!(index.contains_key("linked.mov"));
+    let _ = std::fs::remove_dir_all(&root);
+}
+
 // Regression test for issue #110: after `file.import` re-imports a file at a path the project
 // already listed as offline, `s.offline.missing` must drop that item so the slate and the
 // "Media missing" badge clear without reopening the project. Before the fix (the patch in
diff --git a/crates/engine/src/remix.rs b/crates/engine/src/remix.rs
index 6f46e75e8..87d2a3c88 100644
--- a/crates/engine/src/remix.rs
+++ b/crates/engine/src/remix.rs
@@ -102,13 +102,17 @@ fn analysis(s: &Session, item: ItemId, source_in: Tick, dur: Tick) -> Result<Arc
     let sr = s.active_sequence().map(|q| q.settings.sample_rate).unwrap_or(48_000).max(1);
     let m0 = source_in.to_units_floor(sr as i64);
     let len = (source_in + dur).to_units_floor(sr as i64) - m0;
+    let max = i64::try_from(u64::from(sr).saturating_mul(dsp::MAX_ANALYSIS_SECONDS)).unwrap_or(i64::MAX);
+    if !(0..=max).contains(&len) {
+        return Err(EngineError::Other(format!("cannot remix: audio is longer than {} minutes", dsp::MAX_ANALYSIS_SECONDS / 60)));
+    }
     let key = (item.0, m0, len, sr);
     if let Some((_, a)) = cache().lock().unwrap_or_else(|e| e.into_inner()).iter().find(|(k, _)| *k == key) {
         return Ok(a.clone());
     }
     let provider = s.media.provider(s.project.clone(), s.services.clone());
     let src = filmcraft_render::SourceProvider::source(&provider, item).ok_or_else(|| EngineError::Other("the clip's media is offline".into()))?;
-    let buf = src.audio(m0, len.max(0) as usize, sr).map_err(|e| EngineError::Other(format!("reading the clip's audio: {e}")))?;
+    let buf = src.audio(m0, len as usize, sr).map_err(|e| EngineError::Other(format!("reading the clip's audio: {e}")))?;
     let refs: Vec<&[f32]> = buf.channels.iter().map(Vec::as_slice).collect();
     let a = Arc::new(dsp::analyze(&refs, sr).map_err(|e| EngineError::Other(format!("cannot remix: {e}")))?);
     let mut c = cache().lock().unwrap_or_else(|e| e.into_inner());
diff --git a/crates/engine/src/roll_linked_tests.rs b/crates/engine/src/roll_linked_tests.rs
index dd3f2e4b2..ee89a8938 100644
--- a/crates/engine/src/roll_linked_tests.rs
+++ b/crates/engine/src/roll_linked_tests.rs
@@ -45,6 +45,59 @@ fn roll_moves_linked_audio_cut() {
     assert_eq!(range(&s, a1), (f(60), f(96)));
 }
 
+/// The delta the Timeline previews while a cut is rolled is the one `timeline.roll` applies on
+/// release: rolled far to the left, the cut stops where the right clip's media starts, 12 frames
+/// before its In point.
+#[test]
+fn roll_delta_stops_at_the_start_of_the_media() {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s.execute("file.newSequence", json!({"name": "Roll", "video": 1, "audio": 1})).unwrap();
+    let rate = s.sequence_rate();
+    let f = |n: i64| rate.tick_of(n);
+    let item = s.project.items.values().find(|i| i.has_video() && i.has_audio() && i.as_media().is_some()).map(|i| i.id).unwrap();
+    for (frame, source_in) in [(0, 48), (48, 12)] {
+        s.execute("timeline.place", json!({"item": item.0, "frame": frame, "sourceIn": f(source_in).0, "duration": f(48).0})).unwrap();
+    }
+    let q = s.active_sequence().unwrap();
+    let (left, right) = (q.video_tracks[0].items[0].id, q.video_tracks[0].items[1].id);
+    let far = Tick(-3600 * filmcraft_time::TICKS_PER_SECOND);
+    let shown = crate::commands::roll_delta(&s, left, right, far).unwrap();
+    assert_eq!(shown, -f(12), "clamped to the media before the right clip's In point");
+    assert_eq!(crate::commands::roll_delta(&s, left, right, -f(5)).unwrap(), -f(5), "a roll within the media is not clamped");
+    let r = s.execute("timeline.roll", json!({"left": left.0, "right": right.0, "delta": far.0})).unwrap();
+    assert_eq!(r["delta"], json!(shown.0), "the preview and the roll agree");
+    assert_eq!(range(&s, right), (f(36), f(96)));
+}
+
+/// A clip whose Out point is past the end of its media (the file became shorter) cannot roll by
+/// a small amount: `edit::roll` would move its cut the other way. The roll moves nothing, and the
+/// preview and the roll both report 0.
+#[test]
+fn roll_delta_is_zero_when_a_clip_cannot_roll_by_the_asked_amount() {
+    let mut s = Session::default();
+    let [(v0, _), (v1, a1)] = two_clips(&mut s);
+    let rate = s.sequence_rate();
+    let f = |n: i64| rate.tick_of(n);
+    let item = s.active_sequence().unwrap().find_item(v0).unwrap().1.item;
+    match std::sync::Arc::make_mut(&mut s.project).items.get_mut(&item).map(|i| &mut i.kind) {
+        Some(filmcraft_project::ItemKind::Media(m)) => m.info.duration = f(94),
+        other => panic!("not media: {other:?}"),
+    }
+    for asked in [f(1), -f(1)] {
+        assert_eq!(crate::commands::roll_delta(&s, v0, v1, asked).unwrap(), Tick::ZERO, "{asked:?}");
+        let r = s.execute("timeline.roll", json!({"left": v0.0, "right": v1.0, "delta": asked.0})).unwrap();
+        assert_eq!(r["delta"], json!(0), "{r}");
+        assert_eq!(range(&s, v1), (f(48), f(96)), "the cut stays where it was");
+        assert_eq!(range(&s, a1), (f(48), f(96)));
+    }
+    assert_eq!(crate::commands::roll_delta(&s, v0, v1, -f(5)).unwrap(), -f(5), "a roll back into the media applies");
+    let r = s.execute("timeline.roll", json!({"left": v0.0, "right": v1.0, "delta": (-f(5)).0})).unwrap();
+    assert_eq!(r["delta"], json!((-f(5)).0), "{r}");
+    assert_eq!(range(&s, v1), (f(43), f(96)));
+    assert_eq!(range(&s, a1), (f(43), f(96)));
+}
+
 /// Linked selection off (or unlinked clips) rolls only the given pair and says so.
 #[test]
 fn roll_without_linked_selection_leaves_audio() {
diff --git a/crates/engine/src/sequence_extras.rs b/crates/engine/src/sequence_extras.rs
index 093ce0f29..54449fa0c 100644
--- a/crates/engine/src/sequence_extras.rs
+++ b/crates/engine/src/sequence_extras.rs
@@ -413,27 +413,8 @@ pub fn simplify_sequence(proj: &filmcraft_project::Project, q: &mut Sequence, o:
     // close gaps: spans where no track has anything
     let mut closed = Tick::ZERO;
     if o.close_gaps {
-        let mut spans: Vec<TimeRange> = q.all_tracks().flat_map(|t| t.items.iter().map(|i| i.range())).collect();
-        spans.extend(q.caption_tracks.iter().flat_map(|t| t.captions.iter().map(|c| c.range())));
-        spans.sort_by_key(|r| r.start);
-        let mut gaps: Vec<TimeRange> = Vec::new();
-        let mut cursor = Tick::ZERO;
-        for r in &spans {
-            if r.start > cursor {
-                gaps.push(TimeRange::from_bounds(cursor, r.start));
-            }
-            cursor = cursor.max(r.end());
-        }
-        for g in gaps.iter().rev() {
-            for t in q.video_tracks.iter_mut().chain(q.audio_tracks.iter_mut()) {
-                edit::shift_track_from(t, g.end(), Tick::ZERO - g.duration);
-            }
-            for t in &mut q.caption_tracks {
-                for c in t.captions.iter_mut().filter(|c| c.start >= g.end()) {
-                    c.start -= g.duration;
-                }
-            }
-            crate::sequence_tools::ripple_markers(&mut q.markers, g.end(), Tick::ZERO - g.duration);
+        for g in sequence_gaps(q, None).iter().rev() {
+            close_sequence_gap(q, *g, true);
             closed += g.duration;
         }
     }
@@ -456,6 +437,43 @@ pub fn simplify_sequence(proj: &filmcraft_project::Project, q: &mut Sequence, o:
     json!({"removedClips": removed_clips, "removedEffects": removed_effects, "movedClips": moved, "closedGaps": closed.0, "removedTracks": removed_tracks})
 }
 
+/// Spans where no track has anything (clips or captions), in time order: the gaps before, between
+/// and inside the material, never the open time after the last clip. With `within`, only the gaps
+/// that lie entirely inside it (Close Gap between In and Out).
+pub(crate) fn sequence_gaps(q: &Sequence, within: Option<TimeRange>) -> Vec<TimeRange> {
+    let mut spans: Vec<TimeRange> = q.all_tracks().flat_map(|t| t.items.iter().map(|i| i.range())).collect();
+    spans.extend(q.caption_tracks.iter().flat_map(|t| t.captions.iter().map(|c| c.range())));
+    spans.sort_by_key(|r| r.start);
+    let mut gaps: Vec<TimeRange> = Vec::new();
+    let mut cursor = Tick::ZERO;
+    for r in &spans {
+        if r.start > cursor {
+            gaps.push(TimeRange::from_bounds(cursor, r.start));
+        }
+        cursor = cursor.max(r.end());
+    }
+    if let Some(w) = within {
+        gaps.retain(|g| g.start >= w.start && g.end() <= w.end());
+    }
+    gaps
+}
+
+/// Ripple one of [`sequence_gaps`] closed: everything after it, on every track, moves left by its
+/// length (it is empty on all of them, so nothing can collide). Close later gaps first.
+pub(crate) fn close_sequence_gap(q: &mut Sequence, g: TimeRange, markers: bool) {
+    for t in q.video_tracks.iter_mut().chain(q.audio_tracks.iter_mut()) {
+        edit::shift_track_from(t, g.end(), Tick::ZERO - g.duration);
+    }
+    for t in &mut q.caption_tracks {
+        for c in t.captions.iter_mut().filter(|c| c.start >= g.end()) {
+            c.start -= g.duration;
+        }
+    }
+    if markers {
+        crate::sequence_tools::ripple_markers(&mut q.markers, g.end(), Tick::ZERO - g.duration);
+    }
+}
+
 fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
     let o = SimplifyOptions::from_params(p)?;
     let seq_id = s.state.active_sequence.ok_or(EngineError::NoSequence)?;
diff --git a/crates/engine/src/sequence_tools.rs b/crates/engine/src/sequence_tools.rs
index 90716d2fc..980e571c1 100644
--- a/crates/engine/src/sequence_tools.rs
+++ b/crates/engine/src/sequence_tools.rs
@@ -10,6 +10,8 @@
 //! | `sequence.showThroughEdits` | Sequence ▸ Show Through Edits | |
 //! | `sequence.joinThroughEdits` | (clip and edit point context menus) Join Through Edits | |
 //! | `sequence.throughEdits` | query: the through edits of the active sequence | |
+//! | `sequence.showDuplicateFrameMarkers` | (Timeline Display Settings) Show Duplicate Frame Markers | |
+//! | `sequence.duplicateFrames` | query: the duplicate frame markers of the active sequence | |
 //! | `sequence.makeSubsequence` | Sequence ▸ Make Subsequence | Shift+U |
 //! | `sequence.deleteTracks` | Sequence ▸ Delete Tracks… | |
 //! | `markers.markSplitVideoIn` … `markers.markSplitAudioOut` | Markers ▸ Mark Split ▸ Video In … Audio Out | |
@@ -26,9 +28,12 @@
 //! that side. Insert / Overwrite from the Source monitor honour source split points: each channel
 //! takes its own range and lands offset by the difference of the In points (J- and L-cuts).
 
+use std::collections::{BTreeMap, HashMap, HashSet};
+
 use filmcraft_edit as edit;
-use filmcraft_project::{AudioChannels, ClipId, ItemId, Label, Marker, MarkerId, MarkerKind, SplitMarks, TrackId, TrackItem, TrackKind};
-use filmcraft_time::{Tick, TimeRange};
+use filmcraft_media::MediaKind;
+use filmcraft_project::{AudioChannels, ClipId, ItemId, Label, Marker, MarkerId, MarkerKind, Project, Sequence, SplitMarks, TrackId, TrackItem, TrackKind};
+use filmcraft_time::{FrameRate, Tick, TimeRange};
 use serde_json::{Value, json};
 
 use crate::commands::{
@@ -105,6 +110,22 @@ fn groups() -> Vec<(&'static str, Vec<CommandSpec>)> {
                     s.state.show_through_edits = bool_p(p, "on").unwrap_or(!s.state.show_through_edits);
                     Ok(json!({"showThroughEdits": s.state.show_through_edits}))
                 }),
+                spec("sequence.showDuplicateFrameMarkers", "Show Duplicate Frame Markers", &[], None, r#"{"on":bool?}"#, always, |s, p| {
+                    s.state.show_duplicate_frame_markers = bool_p(p, "on").unwrap_or(!s.state.show_duplicate_frame_markers);
+                    Ok(json!({"showDuplicateFrameMarkers": s.state.show_duplicate_frame_markers}))
+                }),
+                query("sequence.duplicateFrames", "List Duplicate Frames", "{}", |s, _| {
+                    let q = s.active_sequence().ok_or(EngineError::NoSequence)?;
+                    Ok(Value::Array(
+                        duplicate_frames(&s.project, q)
+                            .iter()
+                            .map(|d| {
+                                let ranges: Vec<Value> = d.ranges.iter().map(|r| json!({"start": r.start.0, "end": r.end().0})).collect();
+                                json!({"clip": d.clip.0, "color": d.color, "ranges": ranges})
+                            })
+                            .collect(),
+                    ))
+                }),
                 spec(
                     "sequence.joinThroughEdits",
                     "Join Through Edits",
@@ -376,6 +397,110 @@ fn join_through_edit_at(s: &mut Session, cut: &Value) -> Result<Value> {
     Ok(json!({"joined": n}))
 }
 
+// ---------- duplicate frames ----------
+
+/// How many colors duplicate frame markers use; master clips past the last one share it.
+pub const DUPLICATE_FRAME_COLORS: usize = 10;
+
+/// One clip's duplicate frame markers: where on the timeline it shows media frames that another
+/// video clip of the same sequence also shows.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct DuplicateFrames {
+    pub clip: ClipId,
+    /// The color of the clip's master clip, 0 to [`DUPLICATE_FRAME_COLORS`] - 1: master clips with
+    /// duplicate frames are numbered in the order they first appear in the sequence.
+    pub color: usize,
+    /// Timeline ranges inside the clip, in order and apart from each other.
+    pub ranges: Vec<TimeRange>,
+}
+
+/// The most timeline frames [`duplicate_frames`] compares in one sequence. A clip whose frames
+/// would pass that count, in timeline order, is not compared and gets no markers, and later clips
+/// that still fit are compared.
+pub const MAX_DUPLICATE_FRAME_CHECKS: i64 = 1_000_000;
+
+/// Timeline Display Settings ▸ Show Duplicate Frame Markers: the video clips of `q` that show a
+/// media frame another video clip of `q` also shows. Each frame of the sequence is compared by the
+/// media frame the clip shows there ([`TrackItem::source_time_at`] at the frame's start, counted in
+/// the media's frame rate). A subclip counts as its master clip. Clips of still images,
+/// generators, nested sequences, graphics and adjustment layers, frame holds and clips whose Time
+/// Remapping speed has keyframes get no markers and are not compared.
+pub fn duplicate_frames(project: &Project, q: &Sequence) -> Vec<DuplicateFrames> {
+    let rate = q.settings.frame_rate;
+    // every clip that can be compared, with its master clip and the media frame rate, in timeline
+    // order (track order for clips that start together)
+    let mut clips: Vec<(u64, FrameRate, &TrackItem)> =
+        q.video_tracks.iter().flat_map(|tr| &tr.items).filter_map(|it| comparable_master(project, it).map(|(m, r)| (m.0, r, it))).collect();
+    clips.sort_by_key(|(_, _, it)| it.start);
+    // the sequence frames each clip covers, while the limit allows
+    let mut budget = MAX_DUPLICATE_FRAME_CHECKS;
+    let spans: Vec<Option<(i64, i64)>> = clips
+        .iter()
+        .map(|(_, _, it)| {
+            let first = rate.frame_at(it.start);
+            let first = if rate.tick_of(first) < it.start { first.saturating_add(1) } else { first };
+            let last = rate.frame_at(it.end() - Tick(1));
+            let n = last.saturating_sub(first).saturating_add(1);
+            (n > 0 && n <= budget).then(|| {
+                budget -= n;
+                (first, last)
+            })
+        })
+        .collect();
+    let shows = |media_rate: FrameRate, it: &TrackItem, f: i64| media_rate.frame_at(it.source_time_at(rate.tick_of(f)));
+    // (master clip, media frame) → the first clip that shows it, and whether another clip does too
+    let mut seen: HashMap<(u64, i64), (ClipId, bool)> = HashMap::new();
+    for ((m, media_rate, it), span) in clips.iter().zip(&spans) {
+        let Some((first, last)) = *span else { continue };
+        for f in first..=last {
+            let e = seen.entry((*m, shows(*media_rate, it, f))).or_insert((it.id, false));
+            e.1 |= e.0 != it.id;
+        }
+    }
+    // colors go to the master clips with a repeated frame, in the order they first appear
+    let repeated: HashSet<u64> = seen.iter().filter(|(_, e)| e.1).map(|((m, _), _)| *m).collect();
+    let mut colors: BTreeMap<u64, usize> = BTreeMap::new();
+    for (m, ..) in clips.iter().filter(|(m, ..)| repeated.contains(m)) {
+        let next = colors.len().min(DUPLICATE_FRAME_COLORS - 1);
+        colors.entry(*m).or_insert(next);
+    }
+    let mut out = Vec::new();
+    for ((m, media_rate, it), span) in clips.iter().zip(&spans) {
+        let Some((first, last)) = *span else { continue };
+        let mut ranges: Vec<TimeRange> = Vec::new();
+        let mut run: Option<i64> = None;
+        for f in first..=last.saturating_add(1) {
+            let repeated = f <= last && seen.get(&(*m, shows(*media_rate, it, f))).is_some_and(|e| e.1);
+            match (repeated, run) {
+                (true, None) => run = Some(f),
+                (false, Some(from)) => {
+                    let (a, b) = (rate.tick_of(from).max(it.start), rate.tick_of(f).min(it.end()));
+                    ranges.push(TimeRange::new(a, b - a));
+                    run = None;
+                }
+                _ => {}
+            }
+        }
+        if !ranges.is_empty() {
+            out.push(DuplicateFrames { clip: it.id, color: colors.get(m).copied().unwrap_or(0), ranges });
+        }
+    }
+    out
+}
+
+/// The master clip `it` shows frames of and the master clip's frame rate, when its frames can be
+/// compared.
+fn comparable_master(project: &Project, it: &TrackItem) -> Option<(ItemId, FrameRate)> {
+    if it.frame_hold.is_some() || !(it.speed.is_finite() && it.speed.abs() > 0.0) || it.duration <= Tick::ZERO {
+        return None;
+    }
+    if it.effect("time_remap").and_then(|e| e.param("speed")).is_some_and(|p| p.is_animated()) {
+        return None;
+    }
+    let (master, media, _) = project.resolve_media(it.item)?;
+    (matches!(media.info.kind, MediaKind::Movie | MediaKind::ImageSequence) && media.info.video.is_some()).then(|| (master, media.frame_rate()))
+}
+
 // ---------- subsequence ----------
 
 /// Sequence ▸ Make Subsequence: a new sequence (same settings and track layout) holding copies of the
diff --git a/crates/engine/src/sequence_tools_tests.rs b/crates/engine/src/sequence_tools_tests.rs
index 8f1ae2d4d..2d0eb2dd7 100644
--- a/crates/engine/src/sequence_tools_tests.rs
+++ b/crates/engine/src/sequence_tools_tests.rs
@@ -142,6 +142,171 @@ fn through_edits_show_and_join() {
     assert_eq!(s.execute("sequence.throughEdits", json!({})).unwrap().as_array().unwrap().len(), n - 2);
 }
 
+/// The demo project with a new empty sequence active, and its first two movie items.
+fn demo_with_empty_sequence() -> (Session, u64, u64) {
+    let mut s = demo();
+    let mut movies: Vec<u64> = s
+        .project
+        .items
+        .values()
+        .filter(|i| i.as_media().is_some_and(|m| m.info.kind == filmcraft_media::MediaKind::Movie && m.info.video.is_some()))
+        .map(|i| i.id.0)
+        .collect();
+    movies.sort();
+    s.execute("file.newSequence", json!({"name": "Duplicates"})).unwrap();
+    (s, movies[0], movies[1])
+}
+
+/// The video clip on video track `track` (0 = V1) that starts at `frame`.
+fn video_clip_at(s: &Session, track: usize, frame: i64) -> u64 {
+    let start = f(s, frame);
+    s.active_sequence().unwrap().video_tracks[track].items.iter().find(|c| c.start == start).unwrap().id.0
+}
+
+fn clip_duration(s: &Session, clip: u64) -> Tick {
+    s.active_sequence().unwrap().find_item(ClipId(clip)).unwrap().1.duration
+}
+
+/// `sequence.duplicateFrames` as (clip, color, [(start frame, end frame)]).
+fn duplicates(s: &mut Session) -> Vec<(u64, u64, Vec<(i64, i64)>)> {
+    let frame = f(s, 1).0;
+    let r = s.execute("sequence.duplicateFrames", json!({})).unwrap();
+    r.as_array()
+        .unwrap()
+        .iter()
+        .map(|d| {
+            let ranges = d["ranges"].as_array().unwrap().iter().map(|r| (r["start"].as_i64().unwrap() / frame, r["end"].as_i64().unwrap() / frame)).collect();
+            (d["clip"].as_u64().unwrap(), d["color"].as_u64().unwrap(), ranges)
+        })
+        .collect()
+}
+
+#[test]
+fn duplicate_frame_markers_cover_the_repeated_frames() {
+    let (mut s, forest, other) = demo_with_empty_sequence();
+    assert_eq!(s.execute("sequence.showDuplicateFrameMarkers", json!({})).unwrap()["showDuplicateFrameMarkers"], json!(true));
+    assert_eq!(s.execute("sequence.showDuplicateFrameMarkers", json!({"on": false})).unwrap()["showDuplicateFrameMarkers"], json!(false));
+    // media frames 0–48 at 0, media frames 24–72 at 100: frames 24–48 are shown twice
+    place(&mut s, forest, "V1", 0, 0, 48);
+    place(&mut s, forest, "V1", 100, 24, 48);
+    // another master clip, used once
+    place(&mut s, other, "V2", 0, 0, 48);
+    // a generator used twice has no markers
+    let matte = s.execute("file.newColorMatte", json!({"width": 64, "height": 64, "color": "#ff0000"})).unwrap()["item"].as_u64().unwrap();
+    s.execute("timeline.place", json!({"item": matte, "track": "V2", "frame": 200, "duration": f(&s, 24).0})).unwrap();
+    s.execute("timeline.place", json!({"item": matte, "track": "V2", "frame": 300, "duration": f(&s, 24).0})).unwrap();
+    let (a, b) = (video_clip_at(&s, 0, 0), video_clip_at(&s, 0, 100));
+    assert_eq!(duplicates(&mut s), [(a, 0, vec![(24, 48)]), (b, 0, vec![(100, 124)])]);
+    // the second master clip used again (frames 40–60 twice) takes the next color
+    place(&mut s, other, "V2", 400, 40, 20);
+    place(&mut s, other, "V3", 400, 40, 20);
+    let (c, d, e) = (video_clip_at(&s, 1, 0), video_clip_at(&s, 1, 400), video_clip_at(&s, 2, 400));
+    assert_eq!(
+        duplicates(&mut s),
+        [(a, 0, vec![(24, 48)]), (c, 1, vec![(40, 48)]), (b, 0, vec![(100, 124)]), (d, 1, vec![(400, 420)]), (e, 1, vec![(400, 420)])]
+    );
+    // clips that only touch in the media share no frame
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("edit.undo", json!({})).unwrap();
+    place(&mut s, forest, "V3", 500, 72, 24);
+    assert_eq!(duplicates(&mut s), [(a, 0, vec![(24, 48)]), (b, 0, vec![(100, 124)])]);
+}
+
+/// Only master clips with duplicate frames take a color: a master clip used once ahead of a
+/// duplicated one leaves the first color to the duplicated one.
+#[test]
+fn duplicate_frame_markers_color_only_master_clips_with_duplicates() {
+    let (mut s, forest, other) = demo_with_empty_sequence();
+    place(&mut s, other, "V1", 0, 0, 48);
+    place(&mut s, forest, "V1", 100, 0, 24);
+    place(&mut s, forest, "V1", 200, 0, 24);
+    let (a, b) = (video_clip_at(&s, 0, 100), video_clip_at(&s, 0, 200));
+    assert_eq!(duplicates(&mut s), [(a, 0, vec![(100, 124)]), (b, 0, vec![(200, 224)])]);
+}
+
+#[test]
+fn duplicate_frame_markers_follow_speed_reverse_and_holds() {
+    let (mut s, forest, _) = demo_with_empty_sequence();
+    place(&mut s, forest, "V1", 0, 0, 48);
+    // at 200 % from media frame 24, timeline frames 100–112 show media frames 24, 26 … 46
+    place(&mut s, forest, "V2", 100, 24, 24);
+    let (a, b) = (video_clip_at(&s, 0, 0), video_clip_at(&s, 1, 100));
+    let set = |s: &mut Session, clip: u64, change: fn(&mut filmcraft_project::TrackItem)| {
+        s.edit_sequence("test", |q, _, _| {
+            change(q.find_item_mut(ClipId(clip)).unwrap().1);
+            Ok(())
+        })
+        .unwrap();
+    };
+    set(&mut s, b, |it| it.speed = 2.0);
+    let every_other: Vec<(i64, i64)> = (24..48).step_by(2).map(|f| (f, f + 1)).collect();
+    assert_eq!(duplicates(&mut s), [(a, 0, every_other), (b, 0, vec![(100, 112)])]);
+    // reversed, 100 %: timeline frames 0–48 show media frames 47 down to 0, so 0–24 shows 24–48
+    set(&mut s, b, |it| it.speed = 1.0);
+    set(&mut s, a, |it| it.reverse = true);
+    assert_eq!(duplicates(&mut s), [(a, 0, vec![(0, 24)]), (b, 0, vec![(100, 124)])]);
+    // a frame hold and Time Remapping keyframes take a clip out of the comparison
+    set(&mut s, a, |it| it.frame_hold = Some(it.source_in));
+    assert!(duplicates(&mut s).is_empty());
+    set(&mut s, a, |it| it.frame_hold = None);
+    assert_eq!(duplicates(&mut s).len(), 2);
+    // a clip longer than the comparison limit is skipped instead of walked frame by frame
+    let dur = clip_duration(&s, a);
+    set(&mut s, a, |it| it.duration = Tick(i64::MAX / 4));
+    assert!(duplicates(&mut s).is_empty());
+    s.edit_sequence("test", |q, _, _| {
+        q.find_item_mut(ClipId(a)).unwrap().1.duration = dur;
+        Ok(())
+    })
+    .unwrap();
+    assert_eq!(duplicates(&mut s).len(), 2);
+    set(&mut s, b, |it| {
+        let p = it
+            .effect_mut("time_remap")
+            .unwrap()
+            .params
+            .entry("speed".into())
+            .or_insert_with(|| filmcraft_project::Param::new(filmcraft_project::ParamValue::Float(100.0)));
+        p.keyframes.push(filmcraft_project::Keyframe::new(Tick::ZERO, filmcraft_project::ParamValue::Float(100.0)));
+        p.keyframes.push(filmcraft_project::Keyframe::new(Tick(1), filmcraft_project::ParamValue::Float(50.0)));
+    });
+    assert!(duplicates(&mut s).is_empty());
+    // parameters of the wrong type are ignored: `on` that is not a boolean toggles
+    s.state.show_duplicate_frame_markers = false;
+    for p in [json!({"on": "yes"}), json!({"on": [1]}), json!(null), json!(7)] {
+        let on = s.state.show_duplicate_frame_markers;
+        assert_eq!(s.execute("sequence.showDuplicateFrameMarkers", p).unwrap()["showDuplicateFrameMarkers"], json!(!on));
+    }
+    assert!(s.execute("sequence.duplicateFrames", json!({"clips": "x", "ranges": -1})).is_ok());
+    // without a sequence there is nothing to list
+    s.state.active_sequence = None;
+    assert!(s.execute("sequence.duplicateFrames", json!({})).is_err());
+}
+
+/// A clip at 200 % skips every other media frame: clips are compared by the frames they show,
+/// not by the media between their In and Out.
+#[test]
+fn duplicate_frame_markers_compare_the_frames_a_fast_clip_shows() {
+    let (mut s, forest, _) = demo_with_empty_sequence();
+    assert_eq!(s.active_sequence().unwrap().settings.frame_rate, s.project.item(ItemId(forest)).unwrap().as_media().unwrap().frame_rate());
+    // media frames 0, 2, 4 … 46 and 1, 3, 5 … 47: no frame in common
+    place(&mut s, forest, "V1", 0, 0, 24);
+    place(&mut s, forest, "V2", 0, 1, 24);
+    let (even, odd) = (video_clip_at(&s, 0, 0), video_clip_at(&s, 1, 0));
+    for c in [even, odd] {
+        s.edit_sequence("test", |q, _, _| {
+            q.find_item_mut(ClipId(c)).unwrap().1.speed = 2.0;
+            Ok(())
+        })
+        .unwrap();
+    }
+    assert!(duplicates(&mut s).is_empty());
+    // media frames 0 and 1 at 100 %: the even clip shows frame 0 at timeline frame 0
+    place(&mut s, forest, "V3", 100, 0, 2);
+    let slow = video_clip_at(&s, 2, 100);
+    assert_eq!(duplicates(&mut s), [(even, 0, vec![(0, 1)]), (odd, 0, vec![(0, 1)]), (slow, 0, vec![(100, 102)])]);
+}
+
 /// `cut: [left, right]` (the timeline's edit point menu, #219) joins exactly that cut and its
 /// linked partner, even when one of its pieces is also part of another through edit.
 #[test]
@@ -671,3 +836,64 @@ fn move_to_new_track_adds_it_in_one_undo_step() {
     assert_eq!(*s.active_sequence().unwrap(), before);
     assert_eq!(s.history.undo.len(), undo);
 }
+
+/// Lift and Extract put what they take off the timeline on the clipboard, cut at the In and Out
+/// points, from the targeted tracks only, with the sequence markers in the range when Copy Paste
+/// Includes Sequence Markers is on (#3019).
+#[test]
+fn lift_and_extract_put_the_range_on_the_clipboard() {
+    for cmd in ["sequence.lift", "sequence.extract"] {
+        let (mut s, item) = fresh();
+        place(&mut s, item, "V1", 0, 0, 48);
+        place(&mut s, item, "V2", 0, 0, 48);
+        for t in ["V2", "A2"] {
+            s.execute("timeline.setTargeting", json!({"track": t, "targeted": false})).unwrap();
+        }
+        s.execute("markers.copyPasteIncludesSequenceMarkers", json!({"on": true})).unwrap();
+        s.execute("markers.add", json!({"frame": 15, "name": "inside"})).unwrap();
+        s.execute("markers.add", json!({"frame": 30, "name": "after"})).unwrap();
+        s.execute("markers.markIn", json!({"frame": 12})).unwrap();
+        s.execute("markers.markOut", json!({"frame": 23})).unwrap();
+        assert_eq!(s.execute(cmd, json!({})).unwrap()["copied"], json!(2), "{cmd}: the V1 and A1 pieces");
+        s.execute("playhead.set", json!({"frame": 100})).unwrap();
+        s.execute("edit.paste", json!({})).unwrap_or_else(|e| panic!("{cmd} then edit.paste: {e:?}"));
+        let q = s.active_sequence().unwrap();
+        let at = f(&s, 100);
+        let pasted: Vec<_> = [&q.video_tracks[0], &q.audio_tracks[0]]
+            .iter()
+            .map(|t| t.items.iter().find(|i| i.start == at).unwrap_or_else(|| panic!("{cmd}: nothing pasted on {}", t.name)))
+            .collect();
+        for p in &pasted {
+            assert_eq!((p.duration, p.source_in), (f(&s, 12), f(&s, 12)), "{cmd}: the pasted piece is frames 12-23 of the media");
+        }
+        assert!(pasted[0].link.is_some() && pasted[0].link == pasted[1].link, "{cmd}: the pasted video and audio stay linked");
+        for t in [&q.video_tracks[1], &q.audio_tracks[1]] {
+            assert!(t.items.iter().all(|i| i.start != at), "{cmd}: nothing from the untargeted {} is pasted", t.name);
+        }
+        let pasted_markers: Vec<_> = q.markers.iter().filter(|m| m.start >= at).map(|m| (m.start, m.name.as_str())).collect();
+        assert_eq!(pasted_markers, vec![(f(&s, 103), "inside")], "{cmd}: only the marker inside the range comes along");
+    }
+}
+
+/// Over a range with no clips on the targeted tracks, Lift and Extract copy nothing and Paste still
+/// brings back what was copied before (#3019).
+#[test]
+fn lift_and_extract_over_no_clips_keep_the_clipboard() {
+    for cmd in ["sequence.lift", "sequence.extract"] {
+        let (mut s, item) = fresh();
+        let clips = place(&mut s, item, "V1", 0, 0, 48);
+        s.execute("timeline.select", json!({"clips": clips})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        for t in ["V1", "A1"] {
+            s.execute("timeline.setTargeting", json!({"track": t, "targeted": false})).unwrap();
+        }
+        s.execute("markers.markIn", json!({"frame": 12})).unwrap();
+        s.execute("markers.markOut", json!({"frame": 23})).unwrap();
+        assert_eq!(s.execute(cmd, json!({})).unwrap()["copied"], json!(0), "{cmd}");
+        s.execute("playhead.set", json!({"frame": 100})).unwrap();
+        s.execute("edit.paste", json!({})).unwrap_or_else(|e| panic!("{cmd} then edit.paste: {e:?}"));
+        let q = s.active_sequence().unwrap();
+        let pasted = q.video_tracks[0].items.iter().find(|i| i.start == f(&s, 100)).map(|i| i.duration);
+        assert_eq!(pasted, Some(f(&s, 48)), "{cmd}: the earlier copy is pasted");
+    }
+}
diff --git a/crates/engine/src/settings.rs b/crates/engine/src/settings.rs
index 0c7ee9156..3d34b1049 100644
--- a/crates/engine/src/settings.rs
+++ b/crates/engine/src/settings.rs
@@ -109,6 +109,9 @@ pub struct AppearancePrefs {
     /// "UI Scale": `auto` (default: the scale the operating system reports) or a fixed
     /// percentage of [`UI_SCALES`] (`100` = one point per physical pixel).
     pub ui_scale: String,
+    /// "Animate zoom, scrolling and menus" (#2325): off, the Timeline zooms and scrolls in one
+    /// step and menus, collapsing sections and tooltips appear without a fade.
+    pub animations: bool,
 }
 
 impl Default for AppearancePrefs {
@@ -122,6 +125,7 @@ impl Default for AppearancePrefs {
             accessible_contrast: false,
             highlight_color: DEFAULT_HIGHLIGHT.into(),
             ui_scale: "auto".into(),
+            animations: true,
         }
     }
 }
@@ -1054,6 +1058,7 @@ static CATEGORIES: &[Category] = &[
             b("appearance.accessibleContrast", "Accessible color contrast", true),
             f("appearance.highlightColor", "Highlight Color", Kind::Color, true),
             f("appearance.uiScale", "UI Scale", Kind::Choice(UI_SCALES), true),
+            b("appearance.animations", "Animate zoom, scrolling and menus", true),
         ],
     },
     Category {
diff --git a/crates/engine/src/shortcut_presets.rs b/crates/engine/src/shortcut_presets.rs
index 7e105e509..19e514d68 100644
--- a/crates/engine/src/shortcut_presets.rs
+++ b/crates/engine/src/shortcut_presets.rs
@@ -264,6 +264,7 @@ pub const PREMIERE: &[Entry] = &[
     ("source.open", "Shift+O", "Project"),
     ("edit.undo", "Left", "History"),
     ("edit.redo", "Right", "History"),
+    ("history.deleteRedoable", "Backspace", "History"),
 ];
 
 /// Premiere's panel-scoped default keys for the keyboard-only commands (M3.12). FilmCraft Default
@@ -289,6 +290,8 @@ pub const PREMIERE_PANEL: &[Entry] = &[
     ("timeline.decreaseAudioHeight", "Alt+-", "Timeline"),
     ("timeline.nextScreen", "PageDown", "Timeline"),
     ("timeline.prevScreen", "PageUp", "Timeline"),
+    ("sequence.setWorkAreaIn", "Alt+[", "Timeline"),
+    ("sequence.setWorkAreaOut", "Alt+]", "Timeline"),
     ("graphics.nudgeLeft", "Cmd+Left", "Program"),
     ("graphics.nudgeRight", "Cmd+Right", "Program"),
     ("graphics.nudgeUp", "Cmd+Up", "Program"),
@@ -350,6 +353,8 @@ pub const PREMIERE_PANEL: &[Entry] = &[
     ("captions.merge", "Alt+M", "Text"),
     ("captions.split", "Alt+S", "Text"),
     ("playback.loop", "Cmd+L", "Audio Track Mixer"),
+    ("mixer.showHideTracks", "Cmd+Alt+T", "Audio Track Mixer"),
+    ("mixer.meterInputOnly", "Ctrl+Shift+I", "Audio Track Mixer"),
     ("playback.toggle", "Space", "Metadata"),
     ("playback.loop", "Cmd+L", "Metadata"),
     ("mediaBrowser.openInSource", "Shift+O", "Media Browser"),
diff --git a/crates/engine/src/shortcuts_tests.rs b/crates/engine/src/shortcuts_tests.rs
index c6beec578..4aeb6e824 100644
--- a/crates/engine/src/shortcuts_tests.rs
+++ b/crates/engine/src/shortcuts_tests.rs
@@ -288,7 +288,7 @@ fn list_searches_labels_and_keys() {
     let v = s.execute("shortcuts.list", json!({"query": "cmd+k", "platform": "windows"})).unwrap();
     assert!(v.as_array().unwrap().iter().any(|c| c["id"] == "sequence.addEdit"), "{v}");
     let v = s.execute("shortcuts.list", json!({"panel": "History", "assigned": true})).unwrap();
-    assert_eq!(v.as_array().unwrap().len(), 2, "{v}");
+    assert_eq!(v.as_array().unwrap().len(), 3, "{v}");
 }
 
 #[test]
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index fe3e35133..8034a4020 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -349,11 +349,11 @@ fn set_param_writes_a_keyframe_when_asked_or_animated() {
     let mut first = set(60.0, 0.5);
     first["keyframe"] = json!(true);
     let r = s.execute("effects.setParam", first).unwrap();
-    assert_eq!(r["keyframes"], 1, "{r}");
+    assert_eq!(r, json!({"keyframes": 1, "param": "scale", "value": 60.0}));
     assert_eq!(scale(&s).0, 1);
     // animated now, so a plain set at another time is a second keyframe
     let r = s.execute("effects.setParam", set(120.0, 2.5)).unwrap();
-    assert_eq!(r["keyframes"], 2, "{r}");
+    assert_eq!(r, json!({"keyframes": 2, "param": "scale", "value": 120.0}));
     let (n, _, a, b) = scale(&s);
     assert_eq!((n, a, b), (2, 60.0, 120.0));
     // a keyframe that is already there is replaced, not doubled
@@ -381,6 +381,38 @@ fn set_param_writes_a_keyframe_when_asked_or_animated() {
     assert_eq!(s.execute("effects.setParam", odd).unwrap()["keyframes"], 2);
 }
 
+/// The response reflects the stored point when extra input coordinates are ignored.
+#[test]
+fn set_param_reports_the_stored_vector_value() {
+    let mut s = demo();
+    let c = s.active_sequence().unwrap().video_tracks[0].items[0].id.0;
+    let result = s.execute("effects.setParam", json!({"clip": c, "effect": "motion", "param": "position", "value": [11.0, 22.0, 33.0]})).unwrap();
+    assert_eq!(result, json!({"keyframes": 0, "param": "position", "value": [11.0, 22.0]}));
+
+    let sequence = s.execute("sequence.inspect", json!({})).unwrap();
+    let effects = sequence["video"][0]["items"][0]["effects"].as_array().unwrap();
+    let motion = effects.iter().find(|e| e["effect"] == "motion").unwrap();
+    assert_eq!(motion["params"]["position"]["value"], "Vec2(Vec2 { x: 11.0, y: 22.0 })");
+}
+
+/// A static edit succeeds without creating keyframes; its response identifies the accepted value.
+#[test]
+fn set_param_reports_static_value_and_parameter() {
+    let mut s = demo();
+    let c = s.active_sequence().unwrap().video_tracks[0].items[0].id.0;
+    for (effect, param, value, stored, inspected) in
+        [("opacity", "blend", json!("Screen"), json!(8), "Choice(8)"), ("motion", "scale", json!(80.0), json!(80.0), "Float(80.0)")]
+    {
+        let result = s.execute("effects.setParam", json!({"clip": c, "effect": effect, "param": param, "value": value})).unwrap();
+        assert_eq!(result, json!({"keyframes": 0, "param": param, "value": stored}));
+        let sequence = s.execute("sequence.inspect", json!({})).unwrap();
+        let effects = sequence["video"][0]["items"][0]["effects"].as_array().unwrap();
+        let effect = effects.iter().find(|e| e["effect"] == effect).unwrap();
+        assert_eq!(effect["params"][param]["value"], inspected);
+        assert_eq!(effect["params"][param]["keyframes"], 0);
+    }
+}
+
 /// A keyframe set with a `time` outside the clip stays at that time (#1055), before the start as
 /// after the end: a ramp that spans a cut shows its true slice, and a clip-end keyframe is not
 /// overwritten by a later one. Only the playhead fallback is pinned to the clip.
@@ -457,7 +489,7 @@ fn set_param_takes_a_choice_by_name() {
     // a name that is not an option is an error that lists the options and changes nothing
     let e = s.execute("effects.setParam", set(json!("Glow"))).unwrap_err().to_string();
     assert!(e.contains("Screen") && e.contains("Overlay"), "{e}");
-    for bad in [json!(""), json!(null), json!([8]), json!({"name": "Screen"}), json!(-1), json!(1.5)] {
+    for bad in [json!(""), json!(null), json!([8]), json!({"name": "Screen"}), json!(-1), json!(1.5), json!(u64::from(u32::MAX) + 1)] {
         assert!(s.execute("effects.setParam", set(bad.clone())).is_err(), "{bad}");
     }
     assert_eq!(blend(&s), ParamValue::Choice(12));
@@ -1087,6 +1119,31 @@ fn enable_flips_each_selected_clip() {
     assert_eq!((enabled(&s, a), enabled(&s, b)), (true, true));
 }
 
+/// #3031: with linked selection on, Enable on an Alt-selected audio clip flips only that clip,
+/// while a linked selection still flips both sides.
+#[test]
+fn enable_on_an_individual_selection_leaves_the_linked_partner() {
+    let mut s = demo();
+    assert!(s.state.linked_selection);
+    let enabled = |s: &Session, c: ClipId| s.active_sequence().unwrap().find_item(c).unwrap().1.enabled;
+    let video = ClipId(v1(&s)[0].0);
+    let audio = {
+        let q = s.active_sequence().unwrap();
+        let link = q.find_item(video).unwrap().1.link.unwrap();
+        q.all_tracks().flat_map(|t| t.items.iter()).find(|i| i.link == Some(link) && i.id != video).unwrap().id
+    };
+    s.execute("timeline.select", json!({"clips": [audio.0], "linked": false})).unwrap();
+    assert_eq!(s.state.selection, vec![audio]);
+    s.execute("clip.enable", json!({})).unwrap();
+    assert_eq!((enabled(&s, video), enabled(&s, audio)), (true, false), "only the selected audio is disabled");
+    s.execute("clip.enable", json!({})).unwrap();
+    assert_eq!((enabled(&s, video), enabled(&s, audio)), (true, true));
+    // a linked selection still flips both sides
+    s.execute("timeline.select", json!({"clips": [audio.0], "linked": true})).unwrap();
+    s.execute("clip.enable", json!({})).unwrap();
+    assert_eq!((enabled(&s, video), enabled(&s, audio)), (false, false));
+}
+
 /// #580: Escape takes back what a gesture changed, merged or not: the project returns to the mark,
 /// neither undo nor redo keeps the changes, and older steps stay.
 #[test]
diff --git a/crates/engine/src/timeline_move_tests.rs b/crates/engine/src/timeline_move_tests.rs
index f6aa640ff..846c5a19a 100644
--- a/crates/engine/src/timeline_move_tests.rs
+++ b/crates/engine/src/timeline_move_tests.rs
@@ -36,6 +36,320 @@ fn pair_in_an_empty_sequence(s: &mut Session, seconds: f64) -> (TrackId, TrackIt
     (q.video_tracks[0].id, v, q.audio_tracks[0].id, a)
 }
 
+fn assert_selection_edit_matches_control(s: &mut Session, selection: Vec<ClipId>, command: &str, params: serde_json::Value) {
+    let before = s.project.clone();
+    let undo = s.history.undo.len();
+    let mut control = Session { project: s.project.clone(), state: s.state.clone(), history: s.history.clone(), media: s.media.clone(), ..Session::default() };
+    control.state.selection = selection;
+    let expected = control.execute(command, params.clone()).unwrap();
+    let actual = s.execute(command, params).unwrap();
+    assert_eq!(actual, expected, "{command} returns the unique-selection result");
+    assert_eq!(s.project, control.project, "{command} produces the complete unique-selection project");
+    assert_eq!(s.history.undo.len(), undo + 1, "the edit is one undo step");
+    assert_eq!(s.history.undo, control.history.undo);
+    assert_eq!(s.history.redo, control.history.redo);
+    assert_eq!(s.history.merge_key, control.history.merge_key);
+    let q = s.active_sequence().unwrap();
+    let ids: Vec<ClipId> = q.all_tracks().flat_map(|t| t.items.iter().map(|i| i.id)).collect();
+    assert_eq!(ids.iter().copied().collect::<std::collections::HashSet<_>>().len(), ids.len(), "no identity was duplicated");
+    q.check().unwrap();
+    let after = s.project.clone();
+    s.execute("edit.undo", json!({})).unwrap();
+    control.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.project, before, "undo restores the entire pre-edit project");
+    assert_eq!(s.project, control.project);
+    assert_eq!(s.history.undo, control.history.undo);
+    assert_eq!(s.history.redo, control.history.redo);
+    s.active_sequence().unwrap().check().unwrap();
+    s.execute("edit.redo", json!({})).unwrap();
+    control.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(s.project, after, "redo restores the entire edited project");
+    assert_eq!(s.project, control.project);
+    assert_eq!(s.history.undo, control.history.undo);
+    assert_eq!(s.history.redo, control.history.redo);
+    s.active_sequence().unwrap().check().unwrap();
+}
+
+#[test]
+fn duplicate_selection_inputs_keep_first_occurrence_and_toggle_once() {
+    for linked in [false, true] {
+        let mut s = demo();
+        let (_, v, _, a) = pair_in_an_empty_sequence(&mut s, 0.0);
+        s.execute("sequence.linkedSelection", json!({"on": linked})).unwrap();
+        let before = s.project.clone();
+        let history = s.history.clone();
+        let ids = json!([a.id.0, a.id.0, v.id.0, a.id.0, v.id.0]);
+        let result = s.execute("timeline.select", json!({"clips": ids})).unwrap();
+        assert_eq!(s.state.selection, vec![a.id, v.id], "explicit order precedes linked expansion");
+        assert_eq!(result["selection"], json!([a.id.0, v.id.0]));
+        s.execute("timeline.select", json!({"clips": [v.id.0, v.id.0], "add": true})).unwrap();
+        assert_eq!(s.state.selection, vec![a.id, v.id], "adding an identity twice does not reorder the selection");
+        s.execute("timeline.select", json!({"clips": ids, "toggle": true})).unwrap();
+        assert!(s.state.selection.is_empty(), "each selected identity toggles off once");
+        s.execute("timeline.select", json!({"clips": ids, "toggle": true})).unwrap();
+        assert_eq!(s.state.selection, vec![a.id, v.id], "each unselected identity toggles on once");
+        s.execute("timeline.select", json!({"clips": []})).unwrap();
+        s.execute("timeline.select", json!({"clips": [v.id.0, v.id.0], "add": true})).unwrap();
+        assert_eq!(s.state.selection, if linked { vec![v.id, a.id] } else { vec![v.id] });
+        assert_eq!(s.project, before, "selection admission does not edit the project");
+        assert_eq!(s.history.undo, history.undo);
+        assert_eq!(s.history.redo, history.redo);
+        s.active_sequence().unwrap().check().unwrap();
+    }
+}
+
+#[test]
+fn duplicate_selection_expansion_is_unique_without_an_active_sequence() {
+    let clips = [ClipId(9), ClipId(3), ClipId(9), ClipId(3), ClipId(5)];
+    for linked in [false, true] {
+        let mut s = Session::default();
+        s.state.linked_selection = linked;
+        for active in [None, Some(filmcraft_project::ItemId(u64::MAX))] {
+            s.state.active_sequence = active;
+            let before = serde_json::to_value(&s.state).unwrap();
+            assert_eq!(crate::commands::with_links(&s, &clips), vec![ClipId(9), ClipId(3), ClipId(5)]);
+            assert_eq!(serde_json::to_value(&s.state).unwrap(), before);
+        }
+    }
+}
+
+#[test]
+fn duplicate_selection_public_admission_keeps_nudges_equivalent_to_unique_selection() {
+    for (command, linked) in [("timeline.nudgeRight", false), ("timeline.nudgeRight", true), ("timeline.nudgeUp", false)] {
+        let mut s = demo();
+        let (_, v, _, a) = pair_in_an_empty_sequence(&mut s, 60.0);
+        s.execute("sequence.linkedSelection", json!({"on": linked})).unwrap();
+        s.execute("timeline.select", json!({"clips": [v.id.0, v.id.0]})).unwrap();
+        let selection = if linked { vec![v.id, a.id] } else { vec![v.id] };
+        assert_eq!(s.state.selection, selection);
+        assert_selection_edit_matches_control(&mut s, selection.clone(), command, json!({}));
+        assert_eq!(s.state.selection, selection);
+    }
+}
+
+#[test]
+fn duplicate_selection_already_in_session_keeps_nudges_equivalent_to_unique_selection() {
+    for linked in [false, true] {
+        for command in ["timeline.nudgeRight", "timeline.nudgeUp"] {
+            let mut s = demo();
+            let (_, v, a_track, a) = pair_in_an_empty_sequence(&mut s, 60.0);
+            s.execute("sequence.linkedSelection", json!({"on": linked})).unwrap();
+            s.state.selection = vec![v.id, v.id, v.id];
+            assert_selection_edit_matches_control(&mut s, vec![v.id], command, json!({}));
+            let q = s.active_sequence().unwrap();
+            if command == "timeline.nudgeUp" {
+                assert_eq!(state(&s, v.id), (q.video_tracks[1].id, v.start));
+                assert_eq!(state(&s, a.id), (a_track, a.start), "vertical nudges remain selected-only even with linked selection on");
+            } else {
+                assert_eq!(state(&s, v.id).1, v.start + s.sequence_rate().tick_of(1));
+                assert_eq!(state(&s, a.id).1, a.start + if linked { s.sequence_rate().tick_of(1) } else { Tick::ZERO });
+            }
+        }
+    }
+}
+
+#[test]
+fn duplicate_selection_delete_matches_unique_selection_with_and_without_links() {
+    for linked in [false, true] {
+        for command in ["edit.clear", "edit.rippleDelete"] {
+            let mut s = demo();
+            let (_, v, a_track, a) = pair_in_an_empty_sequence(&mut s, 60.0);
+            s.execute("sequence.linkedSelection", json!({"on": linked})).unwrap();
+            if !linked {
+                s.execute("timeline.setTrack", json!({"track": a_track.0, "syncLock": false})).unwrap();
+            }
+            // Clear and Ripple Delete act on the selection as it is: selecting the clip takes its
+            // partner along only with Linked Selection on
+            s.execute("timeline.select", json!({"clips": [v.id.0]})).unwrap();
+            let unique = s.state.selection.clone();
+            s.state.selection = unique.iter().chain(&unique).copied().collect();
+            assert_selection_edit_matches_control(&mut s, unique, command, json!({}));
+            assert!(s.active_sequence().unwrap().find_item(v.id).is_none());
+            assert_eq!(s.active_sequence().unwrap().find_item(a.id).is_none(), linked);
+            assert!(s.state.selection.is_empty());
+        }
+    }
+}
+
+#[test]
+fn duplicate_move_targets_are_rejected_and_retry_is_undoable() {
+    for insert in [false, true] {
+        let mut s = demo();
+        let (_, v, _, _) = pair_in_an_empty_sequence(&mut s, 0.0);
+        let before = s.project.clone();
+        let undo = s.history.undo.len();
+        let at = s.sequence_rate().tick_of(48).0;
+        let result = s.execute(
+            "timeline.move",
+            json!({"moves": [{"clip": v.id.0, "track": "V1", "time": at}, {"clip": v.id.0, "track": "V2", "time": at}], "insert": insert, "linked": false}),
+        );
+        assert!(result.is_err(), "duplicate move entries were accepted: {result:?}");
+        assert_eq!(s.project, before);
+        assert_eq!(s.history.undo.len(), undo);
+        s.execute("timeline.move", json!({"moves": [{"clip": v.id.0, "track": "V2", "time": at}], "insert": insert, "linked": false})).unwrap();
+        let after = s.project.clone();
+        assert_eq!(state(&s, v.id).1.0, at);
+        s.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(s.project, before);
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(s.project, after);
+    }
+}
+
+fn reject_duplicate_new_track_move(s: &mut Session, clip: ClipId, insert: bool, linked: bool, new_first: bool) {
+    s.state.selection = vec![clip];
+    let before = s.project.clone();
+    let selection = s.state.selection.clone();
+    let editor_state = serde_json::to_value(&s.state).unwrap();
+    let history = s.history.clone();
+    let journal = s.journal.clone();
+    let at = s.sequence_rate().tick_of(48).0;
+    let tracks = if new_first { ["new", "V2"] } else { ["V2", "new"] };
+    let result = s.execute(
+        "timeline.move",
+        json!({"moves": [{"clip": clip.0, "track": tracks[0], "time": at}, {"clip": clip.0, "track": tracks[1], "time": at}], "insert": insert, "linked": linked}),
+    );
+    assert!(matches!(result, Err(EngineError::Edit(filmcraft_edit::EditError::Other(_)))), "duplicate move entries must be rejected: {result:?}");
+    assert_eq!(s.project, before, "the project and its id allocator stay unchanged");
+    assert_eq!(s.state.selection, selection);
+    assert_eq!(serde_json::to_value(&s.state).unwrap(), editor_state);
+    assert_eq!(s.history.undo.len(), history.undo.len(), "no oldest undo entry is evicted");
+    assert_eq!(s.history.redo.len(), history.redo.len(), "no existing redo entry is lost");
+    assert_eq!(s.history.undo, history.undo);
+    assert_eq!(s.history.redo, history.redo);
+    assert_eq!(s.history.merge_key, history.merge_key);
+    assert_eq!(s.history.limit, history.limit);
+    assert_eq!(s.journal, journal, "the failed command is not journaled");
+}
+
+#[test]
+fn duplicate_new_track_move_preserves_redo_and_retry_is_undoable() {
+    for insert in [false, true] {
+        for linked in [false, true] {
+            for new_first in [false, true] {
+                let mut s = demo();
+                let (_, v, _, _) = pair_in_an_empty_sequence(&mut s, 0.0);
+                s.execute("timeline.setTrack", json!({"track": "V2", "locked": true})).unwrap();
+                let redo_project = s.project.clone();
+                s.execute("edit.undo", json!({})).unwrap();
+                assert!(!s.history.redo.is_empty());
+                reject_duplicate_new_track_move(&mut s, v.id, insert, linked, new_first);
+                let before = s.project.clone();
+                s.execute("edit.redo", json!({})).unwrap();
+                assert_eq!(s.project, redo_project, "the previously available redo still works");
+                s.execute("edit.undo", json!({})).unwrap();
+                assert_eq!(s.project, before);
+                let at = s.sequence_rate().tick_of(48).0;
+                s.execute("timeline.move", json!({"moves": [{"clip": v.id.0, "track": "new", "time": at}], "insert": insert, "linked": linked})).unwrap();
+                let after = s.project.clone();
+                assert_eq!(state(&s, v.id).1.0, at);
+                assert_eq!(s.active_sequence().unwrap().video_tracks.len(), 3);
+                s.active_sequence().unwrap().check().unwrap();
+                s.execute("edit.undo", json!({})).unwrap();
+                assert_eq!(s.project, before, "one undo removes the new track and restores the move");
+                s.execute("edit.redo", json!({})).unwrap();
+                assert_eq!(s.project, after);
+            }
+        }
+    }
+}
+
+#[test]
+fn duplicate_new_track_move_preserves_full_undo_history() {
+    for insert in [false, true] {
+        for linked in [false, true] {
+            for new_first in [false, true] {
+                let mut s = demo();
+                let (_, v, _, _) = pair_in_an_empty_sequence(&mut s, 0.0);
+                assert_eq!(s.history.limit, 200);
+                while s.history.undo.len() < s.history.limit {
+                    let step = s.history.undo.len();
+                    s.edit_merged("History step", &format!("history-{step}"), |project, _| {
+                        project.root.name = format!("History {step}");
+                        Ok(())
+                    })
+                    .unwrap();
+                }
+                assert_eq!(s.history.undo.len(), s.history.limit);
+                assert!(s.history.merge_key.is_some());
+                reject_duplicate_new_track_move(&mut s, v.id, insert, linked, new_first);
+                let oldest = s.history.undo.first().unwrap().1.clone();
+                for _ in 0..s.history.limit {
+                    s.execute("edit.undo", json!({})).unwrap();
+                }
+                assert_eq!(s.project, oldest, "every retained undo step remains usable");
+            }
+        }
+    }
+}
+
+#[test]
+fn unique_new_track_moves_keep_linked_partner_behavior() {
+    for insert in [false, true] {
+        for linked in [false, true] {
+            let mut s = demo();
+            let (_, v, a_track, a) = pair_in_an_empty_sequence(&mut s, 0.0);
+            let before = s.project.clone();
+            let undo = s.history.undo.len();
+            let to = s.sequence_rate().tick_of(48);
+            let result =
+                s.execute("timeline.move", json!({"moves": [{"clip": v.id.0, "track": "new", "time": to.0}], "insert": insert, "linked": linked})).unwrap();
+            let sequence = s.active_sequence().unwrap();
+            assert_eq!(sequence.video_tracks.len(), 3);
+            assert_eq!(state(&s, v.id), (sequence.video_tracks[2].id, to));
+            assert_eq!(state(&s, a.id), (a_track, if linked { to } else { a.start }));
+            assert_eq!(result["moved"], if linked { json!([v.id.0, a.id.0]) } else { json!([v.id.0]) });
+            assert_eq!(s.history.undo.len(), undo + 1);
+            sequence.check().unwrap();
+            let after = s.project.clone();
+            s.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(s.project, before);
+            s.execute("edit.redo", json!({})).unwrap();
+            assert_eq!(s.project, after);
+        }
+    }
+}
+
+#[test]
+fn repeated_new_track_copy_destinations_get_distinct_ids() {
+    for insert in [false, true] {
+        for linked in [false, true] {
+            for new_first in [false, true] {
+                let mut s = demo();
+                let (v_track, v, a_track, a) = pair_in_an_empty_sequence(&mut s, 0.0);
+                let before = s.project.clone();
+                let undo = s.history.undo.len();
+                let to = s.active_sequence().unwrap().duration() + s.sequence_rate().tick_of(48);
+                let tracks = if new_first { ["new", "V2"] } else { ["V2", "new"] };
+                let result = s
+                .execute(
+                    "timeline.move",
+                    json!({"moves": [{"clip": v.id.0, "track": tracks[0], "time": to.0}, {"clip": v.id.0, "track": tracks[1], "time": to.0}], "insert": insert, "linked": linked, "copy": true}),
+                )
+                .unwrap();
+                let copies: Vec<ClipId> = result["copied"].as_array().unwrap().iter().map(|c| ClipId(c.as_u64().unwrap())).collect();
+                assert_eq!(copies.len(), if linked { 3 } else { 2 });
+                assert_eq!(copies.iter().copied().collect::<std::collections::HashSet<_>>().len(), copies.len());
+                assert!(!copies.contains(&v.id) && !copies.contains(&a.id));
+                assert_eq!((state(&s, v.id), state(&s, a.id)), ((v_track, v.start), (a_track, a.start)));
+                assert_eq!(s.state.selection, copies);
+                let sequence = s.active_sequence().unwrap();
+                assert_eq!(sequence.video_tracks.len(), 3);
+                assert!(copies.iter().all(|c| sequence.find_item(*c).is_some()), "every reported copy exists");
+                assert!(copies.iter().any(|c| state(&s, *c) == (sequence.video_tracks[2].id, to)));
+                assert!(copies.iter().any(|c| state(&s, *c) == (sequence.video_tracks[1].id, to)));
+                assert_eq!(s.history.undo.len(), undo + 1);
+                sequence.check().unwrap();
+                let after = s.project.clone();
+                s.execute("edit.undo", json!({})).unwrap();
+                assert_eq!(s.project, before);
+                s.execute("edit.redo", json!({})).unwrap();
+                assert_eq!(s.project, after);
+            }
+        }
+    }
+}
+
 /// `timeline.move` of one clip left its linked sound behind although Linked Selection was on.
 #[test]
 fn move_takes_linked_partners_along() {
diff --git a/crates/engine/src/track_params_tests.rs b/crates/engine/src/track_params_tests.rs
index 6c243dfa5..707ad38cc 100644
--- a/crates/engine/src/track_params_tests.rs
+++ b/crates/engine/src/track_params_tests.rs
@@ -114,3 +114,38 @@ fn place_on_an_audio_track_places_the_sound_there_and_nothing_else() {
     s.execute("timeline.place", json!({"item": with_picture.0, "seconds": 600.0})).unwrap();
     assert_eq!(counts(&s), [2, 1, 2, 2]);
 }
+
+/// Track colour labels (#1186): set, shown by `sequence.inspect`, saved with the project,
+/// cleared with "" / null, one undo step each; unknown names are refused.
+#[test]
+fn a_track_carries_a_colour_label() {
+    let mut s = demo();
+    let label = |s: &mut Session, kind: &str| s.execute("sequence.inspect", json!({})).unwrap()[kind][0]["label"].clone();
+    assert_eq!(label(&mut s, "video"), json!(null));
+    s.execute("timeline.setTrack", json!({"track": "V1", "label": "Forest"})).unwrap();
+    s.execute("timeline.setTrack", json!({"track": "A1", "label": "Mango"})).unwrap();
+    assert_eq!(label(&mut s, "video"), json!("Forest"));
+    assert_eq!(label(&mut s, "audio"), json!("Mango"));
+    // saved with the project, and a project from before the field still loads
+    let text = serde_json::to_string(&*s.project).unwrap();
+    let back: filmcraft_project::Project = serde_json::from_str(&text).unwrap();
+    let q = back.sequence(s.state.active_sequence.unwrap()).unwrap();
+    assert_eq!(q.video_tracks[0].label, Some(filmcraft_project::Label::Forest));
+    let mut old = serde_json::to_value(&q.video_tracks[0]).unwrap();
+    old.as_object_mut().unwrap().remove("label");
+    let old: filmcraft_project::Track = serde_json::from_value(old).unwrap();
+    assert_eq!(old.label, None);
+    // a plain track does not write the key at all
+    assert!(serde_json::to_value(&q.video_tracks[1]).unwrap().get("label").is_none());
+    // clear, undo, refuse
+    s.execute("timeline.setTrack", json!({"track": "V1", "label": ""})).unwrap();
+    assert_eq!(label(&mut s, "video"), json!(null));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(label(&mut s, "video"), json!("Forest"));
+    s.execute("timeline.setTrack", json!({"track": "V1", "label": null})).unwrap();
+    assert_eq!(label(&mut s, "video"), json!(null));
+    assert!(matches!(s.execute("timeline.setTrack", json!({"track": "V1", "label": "Chartreuse"})), Err(EngineError::BadParams { .. })));
+    // other settings leave the label alone
+    s.execute("timeline.setTrack", json!({"track": "A1", "muted": true})).unwrap();
+    assert_eq!(label(&mut s, "audio"), json!("Mango"));
+}
diff --git a/crates/engine/src/trim.rs b/crates/engine/src/trim.rs
index f9bb63ec3..86ef185f6 100644
--- a/crates/engine/src/trim.rs
+++ b/crates/engine/src/trim.rs
@@ -3,7 +3,10 @@
 //! An edit point is one edge of a clip plus a trim kind. Trim and Ripple act on that edge; Roll acts
 //! on the edge shared with the adjacent clip on the same track. Trimming delegates to the
 //! `timeline.trim` / `timeline.roll` commands so linked partners and sync locks behave the same as
-//! with the mouse.
+//! with the mouse. Linked Selection adds unlocked partner edges to both explicit and nearest-edge
+//! selections. Shift-click toggles the linked group. A roll follows only linked cuts at the same
+//! time, preserving split edits; regular/ripple trims follow the corresponding In or Out edges.
+//! Each linked group is clamped and applied once, including when both partners were selected.
 //!
 //! **Trim Monitor** ([`monitor_info`]): while edit points are selected the Program monitor shows the
 //! outgoing clip's last frame and the incoming clip's first frame, with the Out/In shift counters
@@ -87,6 +90,29 @@ fn kind_p(p: &Value) -> Option<TrimKind> {
     serde_json::from_value(p.get("kind")?.clone()).ok()
 }
 
+/// The edges that the timeline command will edit together. Rolls follow only matching linked
+/// cuts; regular/ripple trims follow the same edge of linked clips, including split edits.
+fn linked_points(s: &Session, ep: EditPoint) -> Vec<EditPoint> {
+    let Some(seq) = s.active_sequence() else { return vec![ep] };
+    let clips = if ep.kind == TrimKind::Roll {
+        let Some((left, right)) = roll_pair(seq, &ep) else { return vec![ep] };
+        crate::commands::linked_roll_pairs(seq, left, right, s.state.linked_selection).into_iter().map(|(l, r)| if ep.out { l } else { r }).collect()
+    } else {
+        crate::commands::with_links(s, &[ep.clip])
+    };
+    clips
+        .into_iter()
+        .filter(|c| *c == ep.clip || seq.find_item(*c).is_some_and(|(t, _)| seq.track(t).is_some_and(|tr| !tr.locked)))
+        .map(|clip| EditPoint { clip, ..ep })
+        .collect()
+}
+
+/// Either side of a rolling cut denotes the same edit, even when selected separately.
+fn same_edge(seq: &Sequence, a: &EditPoint, b: &EditPoint) -> bool {
+    (a.clip == b.clip && a.out == b.out)
+        || (a.kind == TrimKind::Roll && b.kind == TrimKind::Roll && roll_pair(seq, a).is_some_and(|p| Some(p) == roll_pair(seq, b)))
+}
+
 /// `trim.selectEditPoint {clip, edge: "in"|"out", kind, add?}`
 pub fn select(s: &mut Session, p: &Value) -> Result<Value> {
     let clip = p.get("clip").and_then(Value::as_u64).map(ClipId).ok_or_else(|| EngineError::Other("need `clip`".into()))?;
@@ -94,14 +120,17 @@ pub fn select(s: &mut Session, p: &Value) -> Result<Value> {
     let kind = kind_p(p).unwrap_or(TrimKind::Trim);
     s.active_sequence().and_then(|q| q.find_item(clip)).ok_or_else(|| EngineError::Other(format!("no clip {}", clip.0)))?;
     let ep = EditPoint { clip, out, kind };
+    let points = linked_points(s, ep);
     if p.get("add").and_then(Value::as_bool).unwrap_or(false) {
-        if let Some(i) = s.state.edit_points.iter().position(|e| e.clip == clip && e.out == out) {
-            s.state.edit_points.remove(i);
-        } else {
-            s.state.edit_points.push(ep);
+        let seq = s.active_sequence().ok_or(EngineError::NoSequence)?;
+        let remove = s.state.edit_points.iter().any(|e| same_edge(seq, e, &ep));
+        let mut selected: Vec<_> = s.state.edit_points.iter().copied().filter(|e| !points.iter().any(|p| same_edge(seq, e, p))).collect();
+        if !remove {
+            selected.extend(points);
         }
+        s.state.edit_points = selected;
     } else {
-        s.state.edit_points = vec![ep];
+        s.state.edit_points = points;
     }
     s.state.selection.clear();
     s.state.gap_selection = None;
@@ -125,7 +154,7 @@ pub fn select_nearest(s: &mut Session, p: &Value) -> Result<Value> {
     let targeted = s.state.active_sequence.and_then(|id| s.state.targeting.get(&id)).map(|t| t.targeted.clone()).unwrap_or_default();
     let mut points = Vec::new();
     for tr in seq.video_tracks.iter().chain(seq.audio_tracks.iter()) {
-        if !targeted.is_empty() && !targeted.contains(&tr.id) {
+        if tr.locked || (!targeted.is_empty() && !targeted.contains(&tr.id)) {
             continue;
         }
         // nearest edge on this track
@@ -147,11 +176,11 @@ pub fn select_nearest(s: &mut Session, p: &Value) -> Result<Value> {
             }
         }
         if let Some((_, ep)) = best {
-            // one roll point per edge: skip the partner's mirror of an edge already chosen
-            if kind == TrimKind::Roll && points.iter().any(|e: &EditPoint| roll_pair(seq, e) == roll_pair(seq, &ep)) {
-                continue;
+            for point in linked_points(s, ep) {
+                if !points.iter().any(|e| same_edge(seq, e, &point)) {
+                    points.push(point);
+                }
             }
-            points.push(ep);
         }
     }
     s.state.edit_points = points;
@@ -204,19 +233,27 @@ fn trim_all_raw(s: &mut Session, delta_for: &dyn Fn(&Sequence, &EditPoint) -> Op
     }
     let pts = s.state.edit_points.clone();
     let mut applied = Vec::new();
+    let mut edited = Vec::new();
     for ep in &pts {
         let seq = s.active_sequence().ok_or(EngineError::NoSequence)?;
+        if edited.iter().any(|e| same_edge(seq, e, ep)) {
+            continue;
+        }
         let Some(delta) = delta_for(seq, ep) else { continue };
+        // Each timeline command clamps and edits its linked group together. Do not dispatch it
+        // again for the group's other selected edges (which would also ripple later clips twice).
+        let group = linked_points(s, *ep);
         let r = match ep.kind {
             TrimKind::Roll => {
                 let Some((l, r)) = roll_pair(seq, ep) else { continue };
-                s.execute("timeline.roll", json!({"left": l.0, "right": r.0, "delta": delta.0, "followLinks": false}))?
+                s.execute("timeline.roll", json!({"left": l.0, "right": r.0, "delta": delta.0}))?
             }
             k => s.execute(
                 "timeline.trim",
                 json!({"clip": ep.clip.0, "edge": if ep.out { "out" } else { "in" }, "mode": if k == TrimKind::Ripple { "ripple" } else { "regular" }, "delta": delta.0}),
             )?,
         };
+        edited.extend(group);
         applied.push(r.get("delta").cloned().unwrap_or(Value::Null));
     }
     Ok(applied)
diff --git a/crates/engine/src/trim_tests.rs b/crates/engine/src/trim_tests.rs
index cb3d32ccd..1ae2dc005 100644
--- a/crates/engine/src/trim_tests.rs
+++ b/crates/engine/src/trim_tests.rs
@@ -3,6 +3,185 @@
 use super::*;
 use serde_json::json;
 
+/// Two adjacent linked A/V clips with handles on both sides of their cut.
+fn linked_cut() -> (Session, [(ClipId, ClipId); 2]) {
+    let mut s = demo();
+    s.execute("file.newSequence", json!({"name": "Linked trim", "video": 1, "audio": 1})).unwrap();
+    let rate = s.sequence_rate();
+    let item = s.project.items.values().find(|i| i.has_video() && i.has_audio() && i.as_media().is_some()).unwrap().id;
+    for n in 0..2 {
+        s.execute("timeline.place", json!({"item": item.0, "frame": 48 * n, "sourceIn": rate.tick_of(48).0, "duration": rate.tick_of(48).0})).unwrap();
+    }
+    let q = s.active_sequence().unwrap();
+    let clips = [0, 1].map(|n| (q.video_tracks[0].items[n].id, q.audio_tracks[0].items[n].id));
+    (s, clips)
+}
+
+/// #3085: selecting either side of a picture cut also selects its linked sound edge.
+#[test]
+fn linked_edit_point_selection_and_shift_toggle() {
+    for kind in ["trim", "ripple", "roll"] {
+        for edge in ["in", "out"] {
+            let (mut s, clips) = linked_cut();
+            let (video, audio) = clips[usize::from(edge == "in")];
+            let p = json!({"clip": video.0, "edge": edge, "kind": kind});
+            s.execute("trim.selectEditPoint", p.clone()).unwrap();
+            assert_eq!(s.state.edit_points.iter().map(|e| e.clip).collect::<Vec<_>>(), vec![video, audio], "{kind} {edge}");
+            s.execute("trim.selectEditPoint", json!({"clip": audio.0, "edge": edge, "kind": kind, "add": true})).unwrap();
+            assert!(s.state.edit_points.is_empty(), "Shift-click removes the linked group");
+            s.execute("sequence.linkedSelection", json!({"on": false})).unwrap();
+            s.execute("trim.selectEditPoint", p).unwrap();
+            assert_eq!(s.state.edit_points.len(), 1);
+        }
+    }
+}
+
+/// #3085: Trim Monitor rolls picture and sound once, with one undo/redo step.
+#[test]
+fn trim_mode_roll_moves_linked_audio_once() {
+    for edge in ["in", "out"] {
+        let (mut s, clips) = linked_cut();
+        let selected = clips[usize::from(edge == "in")].0;
+        s.execute("trim.selectEditPoint", json!({"clip": selected.0, "edge": edge, "kind": "roll"})).unwrap();
+        let before = s.project.clone();
+        let undo = s.history.undo.len();
+        s.execute("trim.nudge", json!({"frames": 3})).unwrap();
+        let q = s.active_sequence().unwrap();
+        for clip in [clips[0].0, clips[0].1] {
+            assert_eq!(q.find_item(clip).unwrap().1.end(), s.sequence_rate().tick_of(51));
+        }
+        for clip in [clips[1].0, clips[1].1] {
+            assert_eq!(q.find_item(clip).unwrap().1.start, s.sequence_rate().tick_of(51));
+        }
+        assert_eq!(s.history.undo.len(), undo + 1);
+        let after = s.project.clone();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(*s.project, *before);
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(*s.project, *after);
+    }
+}
+
+/// Explicitly selected partners must not run the same linked trim twice, including ripple shifts.
+#[test]
+fn selected_linked_regular_and_ripple_edges_move_once() {
+    for kind in ["trim", "ripple"] {
+        for out in [false, true] {
+            let (mut s, clips) = linked_cut();
+            let pair = clips[usize::from(!out)];
+            s.execute("sequence.linkedSelection", json!({"on": false})).unwrap();
+            for (n, clip) in [pair.0, pair.1].into_iter().enumerate() {
+                s.execute("trim.selectEditPoint", json!({"clip": clip.0, "edge": if out { "out" } else { "in" }, "kind": kind, "add": n != 0})).unwrap();
+            }
+            s.execute("sequence.linkedSelection", json!({"on": true})).unwrap();
+            let before = s.project.clone();
+            s.execute("trim.nudge", json!({"frames": if out { -3 } else { 3 }})).unwrap();
+            let q = s.active_sequence().unwrap();
+            let f = |n| s.sequence_rate().tick_of(n);
+            for clip in [pair.0, pair.1] {
+                let it = q.find_item(clip).unwrap().1;
+                let expected = if out {
+                    (0, 45)
+                } else if kind == "ripple" {
+                    (48, 93)
+                } else {
+                    (51, 96)
+                };
+                assert_eq!((it.start, it.end()), (f(expected.0), f(expected.1)), "{kind} out={out}");
+            }
+            if out {
+                for clip in [clips[1].0, clips[1].1] {
+                    assert_eq!(q.find_item(clip).unwrap().1.start, f(if kind == "ripple" { 45 } else { 48 }), "{kind}");
+                }
+            }
+            let after = s.project.clone();
+            s.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(*s.project, *before);
+            s.execute("edit.redo", json!({})).unwrap();
+            assert_eq!(*s.project, *after);
+        }
+    }
+}
+
+/// Nearest-edge selection follows links even when only the video track is targeted, without
+/// duplicating the sound when it is targeted too. Dynamic trimming uses the same grouped edit.
+#[test]
+fn nearest_linked_roll_and_dynamic_trim() {
+    let (mut s, clips) = linked_cut();
+    let rate = s.sequence_rate();
+    s.execute("timeline.setTargeting", json!({"track": "A1", "targeted": false})).unwrap();
+    s.execute("playhead.set", json!({"frame": 48})).unwrap();
+    s.execute("trim.selectNearest", json!({"kind": "roll"})).unwrap();
+    assert_eq!(s.state.edit_points.len(), 2);
+    assert!(s.state.edit_points.iter().any(|e| e.clip == clips[0].1));
+    s.execute("timeline.setTargeting", json!({"track": "A1", "targeted": true})).unwrap();
+    s.execute("trim.selectNearest", json!({"kind": "roll"})).unwrap();
+    assert_eq!(s.state.edit_points.len(), 2);
+    let before = s.project.clone();
+    s.execute("trim.shuttle", json!({"direction": "forward", "clock": 0.0})).unwrap();
+    s.execute("trim.shuttleStop", json!({"clock": 0.25})).unwrap();
+    let expected = rate.tick_of(48 + frames(&s, 0.25));
+    for clip in [clips[0].0, clips[0].1] {
+        assert_eq!(s.active_sequence().unwrap().find_item(clip).unwrap().1.end(), expected);
+    }
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(*s.project, *before);
+}
+
+/// The shorter audio handle limits the picture too; separately applying the two cuts desyncs them.
+#[test]
+fn linked_trim_roll_uses_the_shortest_handle() {
+    let (mut s, clips) = linked_cut();
+    let rate = s.sequence_rate();
+    s.edit_sequence("Short audio handle", |q, _, _| {
+        q.find_item_mut(clips[1].1).unwrap().1.source_in = rate.tick_of(2);
+        Ok(())
+    })
+    .unwrap();
+    s.execute("trim.selectEditPoint", json!({"clip": clips[0].0.0, "edge": "out", "kind": "roll"})).unwrap();
+    s.execute("trim.nudge", json!({"frames": -10})).unwrap();
+    for clip in [clips[0].0, clips[0].1] {
+        assert_eq!(s.active_sequence().unwrap().find_item(clip).unwrap().1.end(), rate.tick_of(46));
+    }
+}
+
+/// Locked partners are neither selected nor changed; directly trimming a locked primary fails.
+#[test]
+fn linked_trim_respects_locked_tracks() {
+    for kind in ["trim", "ripple", "roll"] {
+        let (mut s, clips) = linked_cut();
+        s.execute("timeline.setTrack", json!({"track": "A1", "locked": true})).unwrap();
+        s.execute("trim.selectEditPoint", json!({"clip": clips[0].0.0, "edge": "out", "kind": kind})).unwrap();
+        assert_eq!(s.state.edit_points.len(), 1);
+        let audio = s.active_sequence().unwrap().audio_tracks[0].clone();
+        s.execute("trim.nudge", json!({"frames": -3})).unwrap();
+        assert_eq!(s.active_sequence().unwrap().audio_tracks[0], audio);
+        s.execute("trim.selectEditPoint", json!({"clip": clips[0].1.0, "edge": "out", "kind": kind})).unwrap();
+        let before = s.project.clone();
+        assert!(s.execute("trim.nudge", json!({"frames": -3})).is_err());
+        assert_eq!(*s.project, *before);
+    }
+}
+
+/// A split audio cut stays separate from a picture roll; linked selection off also edits one cut.
+#[test]
+fn split_or_disabled_linked_roll_leaves_audio_alone() {
+    for split in [false, true] {
+        let (mut s, clips) = linked_cut();
+        s.execute("sequence.linkedSelection", json!({"on": false})).unwrap();
+        if split {
+            s.execute("timeline.roll", json!({"left": clips[0].1.0, "right": clips[1].1.0, "deltaFrames": -4})).unwrap();
+            s.execute("sequence.linkedSelection", json!({"on": true})).unwrap();
+        }
+        let audio = s.active_sequence().unwrap().audio_tracks[0].clone();
+        s.execute("trim.selectEditPoint", json!({"clip": clips[0].0.0, "edge": "out", "kind": "roll"})).unwrap();
+        assert_eq!(s.state.edit_points.len(), 1);
+        s.execute("trim.nudge", json!({"frames": 3})).unwrap();
+        assert_eq!(s.active_sequence().unwrap().audio_tracks[0], audio);
+        assert_eq!(s.active_sequence().unwrap().find_item(clips[0].0).unwrap().1.end(), s.sequence_rate().tick_of(51));
+    }
+}
+
 fn demo() -> Session {
     let mut s = Session::default();
     s.execute("file.openDemoProject", json!({})).unwrap();
@@ -206,9 +385,10 @@ fn trim_monitor_sides_and_shift_counters() {
     assert_eq!(s.execute("trim.monitor", json!({})).unwrap()["inShift"], json!(0));
     // Apply Default Transitions to Selection at the edit point
     let r = s.execute("trim.applyDefaultTransition", json!({})).unwrap();
-    assert_eq!(r["transitions"].as_array().unwrap().len(), 1, "{r}");
+    assert_eq!(r["transitions"].as_array().unwrap().len(), 2, "picture and linked sound: {r}");
     let seq = s.execute("sequence.inspect", json!({})).unwrap();
     assert!(!seq["video"][0]["transitions"].as_array().unwrap().is_empty());
+    assert!(!seq["audio"][0]["transitions"].as_array().unwrap().is_empty());
 }
 
 #[test]
diff --git a/crates/engine/src/vfx_tests.rs b/crates/engine/src/vfx_tests.rs
index f1aeb5987..aa489e24c 100644
--- a/crates/engine/src/vfx_tests.rs
+++ b/crates/engine/src/vfx_tests.rs
@@ -96,6 +96,41 @@ fn every_video_effect_applies_by_id_and_name_and_renders() {
     }
 }
 
+/// #1545: `effects.apply` reports each instance it added (clip, index, effect id), like
+/// `timeline.place` reports its clips, so agents need no `sequence_inspect` round trip.
+#[test]
+fn effects_apply_reports_where_each_instance_landed() {
+    let mut s = demo();
+    let clip = first_v1_clip(&s);
+    let r = s.execute("effects.apply", json!({"clips": [clip], "effect": "gaussian_blur"})).unwrap();
+    let applied = r["applied"].as_array().unwrap();
+    assert_eq!(applied.len(), 1);
+    assert_eq!(applied[0]["clip"].as_u64(), Some(clip));
+    assert_eq!(applied[0]["effect"], "gaussian_blur");
+    let idx = applied[0]["index"].as_u64().unwrap() as usize;
+    let it = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap().1.clone();
+    assert_eq!(it.effects.get(idx).map(|e| e.effect.as_str()), Some("gaussian_blur"), "index addresses the new instance");
+    // the index is usable straight away
+    s.execute("effects.remove", json!({"clip": clip, "index": idx})).unwrap();
+    assert!(s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap().1.effects.iter().all(|e| e.effect != "gaussian_blur"));
+
+    // several clips: one entry per instance, each with its own clip id
+    let clips: Vec<u64> = s.active_sequence().unwrap().video_tracks[0].items.iter().map(|c| c.id.0).collect();
+    assert!(clips.len() >= 2, "demo project has several V1 clips");
+    let r = s.execute("effects.apply", json!({"clips": clips, "effect": "invert"})).unwrap();
+    let got: Vec<u64> = r["applied"].as_array().unwrap().iter().map(|a| a["clip"].as_u64().unwrap()).collect();
+    assert_eq!(got, clips);
+
+    // audio effects report the (retargeted) audio clip, not the video clip that was passed
+    let video = first_v1_clip(&s);
+    let r = s.execute("effects.apply", json!({"clips": [video], "effect": "parametric_eq"})).unwrap();
+    let a = &r["applied"].as_array().unwrap()[0];
+    let target = a["clip"].as_u64().unwrap();
+    let (track, item) = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(target)).unwrap();
+    assert_eq!(s.active_sequence().unwrap().track(track).unwrap().kind, filmcraft_project::TrackKind::Audio);
+    assert_eq!(item.effects.get(a["index"].as_u64().unwrap() as usize).map(|e| e.effect.as_str()), Some("parametric_eq"));
+}
+
 #[test]
 fn new_effect_params_are_settable_and_keyframable() {
     let mut s = demo();
@@ -128,3 +163,27 @@ fn ultra_key_setting_writes_aggressive_parameters() {
     assert_eq!(e.param("choke").unwrap().value.as_f64(), Some(10.0));
     assert_eq!(e.param("contrast").unwrap().value.as_f64(), Some(10.0));
 }
+
+/// #2679: a value outside a parameter's range (the `min`/`max` `effects.list` publishes) is
+/// refused with the range, not saved: gamma 1.1 meant as a factor turned the frame black.
+#[test]
+fn set_param_refuses_values_outside_the_range() {
+    let mut s = demo();
+    let clip = s.active_sequence().unwrap().video_tracks[0].items[0].id.0;
+    s.execute("effects.apply", json!({"clips": [clip], "effect": "levels"})).unwrap();
+    s.execute("effects.apply", json!({"clips": [clip], "effect": "lumetri"})).unwrap();
+    let before = s.project.to_json();
+    let undo = s.history.undo.len();
+    for (effect, param, value) in
+        [("levels", "gamma", 1.1), ("lumetri", "saturation", 500.0), ("lumetri", "vibrance", -300.0), ("opacity", "opacity", 250.0), ("motion", "scale", -50.0)]
+    {
+        let e = s.execute("effects.setParam", json!({"clip": clip, "effect": effect, "param": param, "value": value})).unwrap_err().to_string();
+        assert!(e.contains("must be between"), "{effect}.{param} = {value}: {e}");
+    }
+    assert_eq!(s.project.to_json(), before, "nothing was saved");
+    assert_eq!(s.history.undo.len(), undo);
+    // the ends of the range and values inside it still go in
+    s.execute("effects.setParam", json!({"clip": clip, "effect": "levels", "param": "gamma", "value": 110})).unwrap();
+    s.execute("effects.setParam", json!({"clip": clip, "effect": "opacity", "param": "opacity", "value": 100})).unwrap();
+    s.execute("effects.setParam", json!({"clip": clip, "effect": "opacity", "param": "opacity", "value": 0})).unwrap();
+}
diff --git a/crates/engine/src/work_area_tests.rs b/crates/engine/src/work_area_tests.rs
new file mode 100644
index 000000000..122cb9f7d
--- /dev/null
+++ b/crates/engine/src/work_area_tests.rs
@@ -0,0 +1,116 @@
+//! The work area bar: the Timeline panel menu's Work Area Bar shows and hides it, Set Work Area Bar
+//! In / Out Point (Alt+[ / Alt+] in the Timeline) move its ends to the playhead, `sequence.setWorkArea`
+//! sets both ends (a drag of the bar), and Export ▸ Range ▸ Work Area exports it.
+
+use filmcraft_time::{Tick, TimeRange};
+use serde_json::json;
+
+use crate::Session;
+use crate::shortcuts::{Chord, Platform};
+
+fn demo() -> Session {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s
+}
+
+fn area(s: &Session) -> Option<(Tick, Tick)> {
+    s.active_sequence().unwrap().work_area.map(|w| (w.start, w.end()))
+}
+
+#[test]
+fn the_work_area_bar_spans_the_sequence_when_shown_and_undoes() {
+    let mut s = demo();
+    let end = s.active_sequence().unwrap().duration();
+    assert!(end > Tick::ZERO);
+    assert_eq!(area(&s), None, "the bar starts hidden");
+    assert!(s.execute("export.resolve", json!({"range": "workArea"})).is_err(), "no work area to export");
+
+    assert_eq!(s.execute("sequence.workAreaBar", json!({})).unwrap(), json!({"show": true}));
+    assert_eq!(area(&s), Some((Tick::ZERO, end)));
+    assert_eq!(s.history.undo.last().map(|u| u.0.as_str()), Some("Work Area Bar"));
+    let frames = s.execute("export.resolve", json!({"preset": "PNG Sequence", "range": "workArea"})).unwrap()["frames"].as_i64().unwrap();
+    let whole = s.execute("export.resolve", json!({"preset": "PNG Sequence", "range": "entire"})).unwrap()["frames"].as_i64().unwrap();
+    assert_eq!(frames, whole, "the work area covers the whole sequence");
+
+    // asking for the state it is already in changes nothing
+    let steps = s.history.undo.len();
+    assert_eq!(s.execute("sequence.workAreaBar", json!({"show": true})).unwrap(), json!({"show": true}));
+    assert_eq!(s.history.undo.len(), steps);
+
+    assert_eq!(s.execute("sequence.workAreaBar", json!({})).unwrap(), json!({"show": false}));
+    assert_eq!(area(&s), None);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(area(&s), Some((Tick::ZERO, end)));
+}
+
+#[test]
+fn set_work_area_in_and_out_points_follow_the_playhead() {
+    let mut s = demo();
+    let rate = s.sequence_rate();
+    let f = |n: i64| rate.tick_of(n);
+    let end = s.active_sequence().unwrap().duration();
+
+    // with no bar yet, the In point runs to the end of the sequence
+    s.set_playhead(f(24));
+    assert_eq!(s.execute("sequence.setWorkAreaIn", json!({})).unwrap(), json!({"start": f(24).0, "end": end.0}));
+    assert_eq!(area(&s), Some((f(24), end)));
+    assert_eq!(s.history.undo.last().map(|u| u.0.as_str()), Some("Set Work Area Bar In Point"));
+
+    s.set_playhead(f(72));
+    s.execute("sequence.setWorkAreaOut", json!({})).unwrap();
+    assert_eq!(area(&s), Some((f(24), f(72))));
+    assert_eq!(s.history.undo.last().map(|u| u.0.as_str()), Some("Set Work Area Bar Out Point"));
+    let frames = s.execute("export.resolve", json!({"preset": "PNG Sequence", "range": "workArea"})).unwrap()["frames"].as_i64().unwrap();
+    assert!((47..=49).contains(&frames), "{frames}");
+
+    // an In point past the Out point moves the Out point to the end of the sequence
+    s.execute("sequence.setWorkAreaIn", json!({"frame": 96})).unwrap();
+    assert_eq!(area(&s), Some((f(96), end)));
+    // an Out point before the In point moves the In point to the start
+    s.execute("sequence.setWorkAreaOut", json!({"frame": 48})).unwrap();
+    assert_eq!(area(&s), Some((Tick::ZERO, f(48))));
+    // an In point at or past the end of the sequence keeps one frame
+    s.execute("sequence.setWorkAreaIn", json!({"time": end.0})).unwrap();
+    assert_eq!(area(&s), Some((end, end + rate.frame_duration())));
+
+    let before = area(&s);
+    assert!(s.execute("sequence.setWorkAreaOut", json!({"time": 0})).is_err(), "an Out point at 0 leaves no work area");
+    assert!(s.execute("sequence.setWorkAreaIn", json!({"time": -1})).is_err(), "negative times are refused");
+    assert_eq!(area(&s), before);
+}
+
+#[test]
+fn set_work_area_takes_both_ends_and_refuses_bad_ones() {
+    let mut s = demo();
+    let rate = s.sequence_rate();
+    let (a, b) = (rate.tick_of(10), rate.tick_of(20));
+    assert_eq!(s.execute("sequence.setWorkArea", json!({"start": a.0, "end": b.0})).unwrap(), json!({"start": a.0, "end": b.0}));
+    assert_eq!(s.active_sequence().unwrap().work_area, Some(TimeRange::from_bounds(a, b)));
+    for p in [
+        json!({"start": b.0, "end": a.0}),
+        json!({"start": a.0, "end": a.0}),
+        json!({"start": -1, "end": b.0}),
+        json!({"start": a.0}),
+        json!({"end": b.0}),
+        json!({"start": 0, "end": i64::MAX}),
+    ] {
+        assert!(s.execute("sequence.setWorkArea", p.clone()).is_err(), "{p}");
+        assert_eq!(s.active_sequence().unwrap().work_area, Some(TimeRange::from_bounds(a, b)), "{p}");
+    }
+    let mut empty = Session::default();
+    for id in ["sequence.workAreaBar", "sequence.setWorkAreaIn", "sequence.setWorkAreaOut", "sequence.setWorkArea"] {
+        assert!(empty.execute(id, json!({"start": 0, "end": 1})).is_err(), "{id} needs a sequence");
+    }
+}
+
+#[test]
+fn alt_brackets_set_the_work_area_in_the_timeline() {
+    let s = Session::default();
+    for p in [Platform::Mac, Platform::Windows] {
+        for (keys, cmd) in [("Alt+[", "sequence.setWorkAreaIn"), ("Alt+]", "sequence.setWorkAreaOut")] {
+            let chord = Chord::parse(keys).unwrap();
+            assert_eq!(s.shortcuts.resolve(&chord, Some("Timeline"), p).map(|b| b.command.as_str()), Some(cmd), "{keys} {p:?}");
+        }
+    }
+}
diff --git a/crates/export/src/determinism_tests.rs b/crates/export/src/determinism_tests.rs
index 2866cb9d4..44ff76daa 100644
--- a/crates/export/src/determinism_tests.rs
+++ b/crates/export/src/determinism_tests.rs
@@ -308,3 +308,77 @@ fn a_panic_while_rendering_ahead_is_an_error() {
         assert!(matches!(r, Err(ExportError::Encode(_))), "{:?}", r.map(|_| ()));
     });
 }
+
+// ------------------------------------------------------------------ max_threads
+
+/// A provider that notes how many threads the pool it is asked on has, and which threads ask.
+struct Noting<'a> {
+    inner: &'a SourceMap,
+    most: AtomicUsize,
+    threads: std::sync::Mutex<std::collections::HashSet<std::thread::ThreadId>>,
+}
+
+impl<'a> Noting<'a> {
+    fn new(inner: &'a SourceMap) -> Self {
+        Self { inner, most: AtomicUsize::new(0), threads: Default::default() }
+    }
+}
+
+impl SourceProvider for Noting<'_> {
+    fn source(&self, item: ItemId) -> Option<SharedSource> {
+        self.most.fetch_max(rayon::current_num_threads(), Ordering::SeqCst);
+        self.threads.lock().unwrap().insert(std::thread::current().id());
+        self.inner.source(item)
+    }
+}
+
+/// Export the test project from a pool of `outer` threads with `max_threads` set, and report the
+/// biggest pool a frame was asked on and how many different threads asked.
+fn threads_used(outer: usize, max_threads: u32, name: &str) -> (usize, usize) {
+    let (p, seq, m) = project();
+    let noting = Noting::new(&m);
+    let settings = ExportSettings { format: Format::Mjpeg, path: tmp(name), include_audio: false, max_threads, ..Default::default() };
+    pool(outer).install(|| export(&p, seq, &settings, &noting, &Progress::default())).unwrap();
+    (noting.most.load(Ordering::SeqCst), noting.threads.lock().unwrap().len())
+}
+
+#[test]
+fn max_threads_caps_the_threads_an_export_runs_on() {
+    // uncapped, it renders on the pool it is called in
+    let (most, threads) = threads_used(8, 0, "cap-0.mov");
+    assert_eq!(most, 8);
+    assert!(threads > 3, "{threads} threads asked for frames: the uncapped export should have used several");
+    // capped, on a pool of that size
+    for cap in [1u32, 3] {
+        let (most, threads) = threads_used(8, cap, &format!("cap-{cap}.mov"));
+        assert_eq!(most, cap as usize, "cap {cap}");
+        assert!(threads <= cap as usize, "cap {cap}: {threads} threads asked for frames");
+    }
+}
+
+#[test]
+fn max_threads_never_adds_threads() {
+    // a cap at or above the pool the export is called in changes nothing
+    assert_eq!(threads_used(4, 4, "cap-same.mov").0, 4);
+    assert_eq!(threads_used(4, 100, "cap-large.mov").0, 4);
+}
+
+#[test]
+fn max_threads_does_not_change_the_file() {
+    for (format, ext) in [(Format::ProRes, "mov"), (Format::H264, "mp4"), (Format::Mjpeg, "mov")] {
+        let settings = |name: &str, max_threads: u32| ExportSettings { format, path: tmp(&format!("{name}.{ext}")), max_threads, ..Default::default() };
+        let reference = export_with_cores(5, &settings(&format!("{}-uncapped", format.id()), 0));
+        for cap in [1u32, 3] {
+            let capped = export_with_cores(5, &settings(&format!("{}-cap{cap}", format.id()), cap));
+            assert!(reference == capped, "{}: a cap of {cap} thread(s) gives a different file", format.label());
+        }
+    }
+}
+
+#[test]
+fn max_threads_is_a_setting_of_the_json_interface() {
+    let s: ExportSettings = serde_json::from_str(r#"{"format":"mjpeg","maxThreads":2}"#).unwrap();
+    assert_eq!(s.max_threads, 2);
+    assert_eq!(ExportSettings::default().max_threads, 0, "all cores unless asked");
+    assert_eq!(serde_json::to_value(&s).unwrap()["maxThreads"], serde_json::json!(2));
+}
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 46956912f..cd8845908 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -35,7 +35,7 @@ pub use pipeline::limit_rgba8;
 pub use presets::{ExportPreset, builtin_presets};
 pub use settings::*;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::{Arc, Mutex, OnceLock, RwLock};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError, RwLock};
 
 use filmcraft_isobmff::SampleEntry;
 use filmcraft_project::{ItemId, Project};
@@ -325,6 +325,13 @@ pub struct ExportSettings {
     /// `progress.total`, `finished` and the final status; this call only adds to `done`.
     #[serde(default)]
     pub part_of_batch: bool,
+    /// Most CPU threads the export may use (0 = all of them, as before). Rendering, the software
+    /// encoders and the rest of the export's parallel work run on a pool of this size; a number
+    /// above what the machine has (or above the pool the export already runs in) changes nothing.
+    /// The output does not depend on it. Hardware encoders and the decoders' own threads are not
+    /// counted.
+    #[serde(default)]
+    pub max_threads: u32,
     /// ProRes flavour: `proxy`, `lt`, `standard`, `hq`, `4444` or `4444xq` (empty = HQ).
     #[serde(default)]
     pub prores_profile: String,
@@ -406,6 +413,10 @@ pub struct ExportSettings {
     /// writing `path` (hosts without a filesystem: the web app offers the file as a download).
     #[serde(skip)]
     pub sink: Option<OutputSink>,
+    /// An already-created primary output file. Internal callers use this to retain an exclusive
+    /// reservation made while choosing an output name, rather than reopening that path later.
+    #[serde(skip)]
+    pub output_file: Option<Arc<std::fs::File>>,
 }
 
 /// Receives in-memory export output: `(path, bytes)` per finished file.
@@ -432,6 +443,10 @@ enum Out {
 
 impl Out {
     fn create(settings: &ExportSettings) -> Result<Out> {
+        if let Some(file) = &settings.output_file {
+            let file = file.try_clone().map_err(|e| ExportError::Io(e.to_string()))?;
+            return Ok(Out::File(std::io::BufWriter::new(file)));
+        }
         Out::create_path(settings, &settings.path)
     }
 
@@ -440,6 +455,12 @@ impl Out {
         if settings.sink.is_some() {
             return Ok(Out::Mem(std::io::Cursor::new(Vec::new())));
         }
+        if path == settings.path
+            && let Some(file) = &settings.output_file
+        {
+            let file = file.try_clone().map_err(|e| ExportError::Io(e.to_string()))?;
+            return Ok(Out::File(std::io::BufWriter::new(file)));
+        }
         let f = std::fs::File::create(path).map_err(|e| ExportError::Io(format!("{path}: {e}")))?;
         Ok(Out::File(std::io::BufWriter::new(f)))
     }
@@ -557,6 +578,7 @@ impl Default for ExportSettings {
             bitrate_kbps: 20_000,
             burn_captions: false,
             part_of_batch: false,
+            max_threads: 0,
             prores_profile: String::new(),
             dnx_profile: String::new(),
             apv_profile: String::new(),
@@ -588,6 +610,7 @@ impl Default for ExportSettings {
             h264_pass: H264Pass::Single,
             signal: ColorSignal::default(),
             sink: None,
+            output_file: None,
         }
     }
 }
@@ -600,6 +623,42 @@ fn default_crf() -> f32 {
 }
 
 impl ExportSettings {
+    fn validate_audio_settings(&self) -> Result<()> {
+        if self.audio.sample_rate.is_some_and(|rate| rate == 0 || rate > 384_000) {
+            return Err(ExportError::Unsupported("output sample rate must be between 1 and 384000 Hz".into()));
+        }
+        if self.audio.float && self.audio.bits != 32 {
+            return Err(ExportError::Unsupported("floating-point audio is 32-bit: set the sample size to 32".into()));
+        }
+        let sample_format = self.audio.sample_format();
+        if (self.has_audio() || self.format.is_audio_only()) && self.audio_codec() != AudioCodec::Aac && !self.supports_sample_format(sample_format) {
+            let codec = if self.audio_codec() == AudioCodec::Flac { "FLAC" } else { self.format.label() };
+            return Err(ExportError::Unsupported(format!("{codec} audio has no {} samples: choose 16, 24 or 32 bit", sample_format.label())));
+        }
+        Ok(())
+    }
+
+    fn validate_bitrate_mode(&self) -> Result<()> {
+        if self.format == Format::Hevc && self.bitrate_mode == BitrateMode::Vbr2Pass {
+            return Err(ExportError::Unsupported("H.265 export has no two-pass mode: choose CBR or VBR, 1 pass".into()));
+        }
+        if self.format == Format::Av1 && self.bitrate_mode == BitrateMode::Vbr2Pass {
+            return Err(ExportError::Unsupported("AV1 export has no two-pass mode: choose CBR or VBR, 1 pass".into()));
+        }
+        if self.bitrate_mode == BitrateMode::Crf {
+            if self.format == Format::Hevc {
+                return Err(ExportError::Unsupported("H.265 export has no CRF mode: choose CBR or VBR, 1 pass".into()));
+            }
+            if self.format == Format::Av1 {
+                return Err(ExportError::Unsupported("AV1 export has no CRF mode: choose CBR or VBR, 1 pass".into()));
+            }
+            if !self.crf.is_finite() || !(0.0..=51.0).contains(&self.crf) {
+                return Err(ExportError::Unsupported("CRF must be between 0 and 51".into()));
+            }
+        }
+        Ok(())
+    }
+
     /// Reject settings the encoders cannot honour.
     pub fn validate(&self) -> Result<()> {
         if let Some(range) = self.range {
@@ -621,40 +680,14 @@ impl ExportSettings {
         {
             return Err(ExportError::Unsupported("output frame rate must be positive and at most 1000 fps".into()));
         }
-        if self.audio.sample_rate.is_some_and(|rate| rate == 0 || rate > 384_000) {
-            return Err(ExportError::Unsupported("output sample rate must be between 1 and 384000 Hz".into()));
-        }
-        if self.audio.float && self.audio.bits != 32 {
-            return Err(ExportError::Unsupported("floating-point audio is 32-bit: set the sample size to 32".into()));
-        }
-        let sample_format = self.audio.sample_format();
-        if (self.has_audio() || self.format.is_audio_only()) && self.audio_codec() != AudioCodec::Aac && !self.supports_sample_format(sample_format) {
-            let codec = if self.audio_codec() == AudioCodec::Flac { "FLAC" } else { self.format.label() };
-            return Err(ExportError::Unsupported(format!("{codec} audio has no {} samples: choose 16, 24 or 32 bit", sample_format.label())));
-        }
+        self.validate_audio_settings()?;
         if self.field_order != FieldOrder::Progressive && self.has_video() {
             return Err(ExportError::Unsupported(format!("{} field order: FilmCraft's encoders write progressive frames", self.field_order.label())));
         }
         if self.effects.image_overlay.enabled && self.effects.image_overlay.path.trim().is_empty() {
             return Err(ExportError::Unsupported("image overlay: no image file chosen".into()));
         }
-        if self.format == Format::Hevc && self.bitrate_mode == BitrateMode::Vbr2Pass {
-            return Err(ExportError::Unsupported("H.265 export has no two-pass mode: choose CBR or VBR, 1 pass".into()));
-        }
-        if self.format == Format::Av1 && self.bitrate_mode == BitrateMode::Vbr2Pass {
-            return Err(ExportError::Unsupported("AV1 export has no two-pass mode: choose CBR or VBR, 1 pass".into()));
-        }
-        if self.bitrate_mode == BitrateMode::Crf {
-            if self.format == Format::Hevc {
-                return Err(ExportError::Unsupported("H.265 export has no CRF mode: choose CBR or VBR, 1 pass".into()));
-            }
-            if self.format == Format::Av1 {
-                return Err(ExportError::Unsupported("AV1 export has no CRF mode: choose CBR or VBR, 1 pass".into()));
-            }
-            if !self.crf.is_finite() || !(0.0..=51.0).contains(&self.crf) {
-                return Err(ExportError::Unsupported("CRF must be between 0 and 51".into()));
-            }
-        }
+        self.validate_bitrate_mode()?;
         Ok(())
     }
 }
@@ -690,7 +723,7 @@ impl Progress {
     /// [`Progress::eta`] at a given time (tests, and hosts with a clock of their own).
     pub fn eta_at(&self, now: web_time::Instant) -> Option<std::time::Duration> {
         let (done, total) = (self.done.load(Ordering::Relaxed), self.total.load(Ordering::Relaxed));
-        let mut pace = self.pace.lock().unwrap_or_else(|e| e.into_inner());
+        let mut pace = self.pace.lock().unwrap_or_else(PoisonError::into_inner);
         pace.observe(now, done);
         if self.finished.load(Ordering::Relaxed) || done >= total {
             return None;
@@ -698,7 +731,7 @@ impl Progress {
         pace.eta(total - done)
     }
     fn set_status(&self, s: impl Into<String>) {
-        *self.status.lock().unwrap_or_else(|e| e.into_inner()) = s.into();
+        *self.status.lock().unwrap_or_else(PoisonError::into_inner) = s.into();
     }
 }
 
@@ -895,7 +928,7 @@ pub fn timed<T>(stage: Stage, f: impl FnOnce() -> T) -> T {
 /// Register a video encoder factory (tried before the built-in ones and those registered earlier).
 /// Registering the same factory twice is harmless.
 pub fn register_encoder(f: EncoderFactory) {
-    let mut g = video_factories().write().unwrap_or_else(|e| e.into_inner());
+    let mut g = video_factories().write().unwrap_or_else(PoisonError::into_inner);
     if !g.iter().any(|x| std::ptr::fn_addr_eq(*x, f)) {
         g.insert(0, f);
     }
@@ -903,7 +936,7 @@ pub fn register_encoder(f: EncoderFactory) {
 
 /// Whether `f` is among the registered video encoder factories (startup diagnostics, tests).
 pub fn encoder_registered(f: EncoderFactory) -> bool {
-    video_factories().read().unwrap_or_else(|e| e.into_inner()).iter().any(|x| std::ptr::fn_addr_eq(*x, f))
+    video_factories().read().unwrap_or_else(PoisonError::into_inner).iter().any(|x| std::ptr::fn_addr_eq(*x, f))
 }
 
 /// Renders one export frame on something other than the CPU reference renderer — today the GPU
@@ -933,7 +966,7 @@ fn frame_renderer_factories() -> &'static RwLock<Vec<FrameRendererFactory>> {
 /// Register a frame-renderer factory (tried before those registered earlier). Registering the
 /// same factory twice is harmless.
 pub fn register_frame_renderer(f: FrameRendererFactory) {
-    let mut g = frame_renderer_factories().write().unwrap_or_else(|e| e.into_inner());
+    let mut g = frame_renderer_factories().write().unwrap_or_else(PoisonError::into_inner);
     if !g.iter().any(|x| std::ptr::fn_addr_eq(*x, f)) {
         g.insert(0, f);
     }
@@ -941,21 +974,21 @@ pub fn register_frame_renderer(f: FrameRendererFactory) {
 
 /// Whether `f` is among the registered frame-renderer factories (startup diagnostics, tests).
 pub fn frame_renderer_registered(f: FrameRendererFactory) -> bool {
-    frame_renderer_factories().read().unwrap_or_else(|e| e.into_inner()).iter().any(|x| std::ptr::fn_addr_eq(*x, f))
+    frame_renderer_factories().read().unwrap_or_else(PoisonError::into_inner).iter().any(|x| std::ptr::fn_addr_eq(*x, f))
 }
 
 /// Clear the registered frame-renderer factories. Test-only: registration is a process-wide
 /// startup step and tests that register their own must not see each other's.
 #[cfg(test)]
 pub(crate) fn reset_frame_renderers_for_tests() {
-    frame_renderer_factories().write().unwrap_or_else(|e| e.into_inner()).clear();
+    frame_renderer_factories().write().unwrap_or_else(PoisonError::into_inner).clear();
     GPU_FRAMES.store(0, Ordering::Relaxed);
     GPU_FALLBACKS.store(0, Ordering::Relaxed);
 }
 
 /// Pick the first registered factory that can build a renderer for this host.
 pub(crate) fn build_frame_renderer() -> Option<Box<dyn FrameRenderer>> {
-    let g = frame_renderer_factories().read().unwrap_or_else(|e| e.into_inner());
+    let g = frame_renderer_factories().read().unwrap_or_else(PoisonError::into_inner);
     g.iter().filter_map(|f| f()).next()
 }
 
@@ -999,7 +1032,7 @@ pub fn gpu_render_stats() -> GpuRenderStats {
     GpuRenderStats { frames: GPU_FRAMES.load(Ordering::Relaxed), fallbacks: GPU_FALLBACKS.load(Ordering::Relaxed) }
 }
 pub fn register_audio_encoder(f: AudioEncoderFactory) {
-    audio_factories().write().unwrap_or_else(|e| e.into_inner()).insert(0, f);
+    audio_factories().write().unwrap_or_else(PoisonError::into_inner).insert(0, f);
 }
 
 type FormatProbe = (Format, fn() -> bool);
@@ -1013,7 +1046,7 @@ fn format_probes() -> &'static RwLock<Vec<FormatProbe>> {
 /// works on this machine: `probe` runs when [`available`] asks (it should cache its answer).
 /// Registering the same probe twice is harmless.
 pub fn register_format_probe(format: Format, probe: fn() -> bool) {
-    let mut g = format_probes().write().unwrap_or_else(|e| e.into_inner());
+    let mut g = format_probes().write().unwrap_or_else(PoisonError::into_inner);
     if !g.iter().any(|(f, p)| *f == format && std::ptr::fn_addr_eq(*p, probe)) {
         g.push((format, probe));
     }
@@ -1029,7 +1062,7 @@ fn hdr_probes() -> &'static RwLock<Vec<FormatProbe>> {
 /// one: its encoders are hardware-only and not all of them take 10-bit pictures, so an HDR sequence
 /// exports as tone-mapped SDR unless a probe says otherwise. Registering the same probe twice is harmless.
 pub fn register_hdr_probe(format: Format, probe: fn() -> bool) {
-    let mut g = hdr_probes().write().unwrap_or_else(|e| e.into_inner());
+    let mut g = hdr_probes().write().unwrap_or_else(PoisonError::into_inner);
     if !g.iter().any(|(f, p)| *f == format && std::ptr::fn_addr_eq(*p, probe)) {
         g.push((format, probe));
     }
@@ -1038,7 +1071,7 @@ pub fn register_hdr_probe(format: Format, probe: fn() -> bool) {
 /// Whether a registered probe says the encoder of `format` writes HDR here (false without one).
 pub fn hdr_available(format: Format) -> bool {
     // the probes run outside the lock: one may take a while
-    let probes: Vec<fn() -> bool> = hdr_probes().read().unwrap_or_else(|e| e.into_inner()).iter().filter(|(f, _)| *f == format).map(|(_, p)| *p).collect();
+    let probes: Vec<fn() -> bool> = hdr_probes().read().unwrap_or_else(PoisonError::into_inner).iter().filter(|(f, _)| *f == format).map(|(_, p)| *p).collect();
     probes.into_iter().any(|p| p())
 }
 
@@ -1048,7 +1081,7 @@ pub fn available(format: Format) -> bool {
     if !Format::ALL.contains(&format) {
         return false;
     }
-    format.has_builtin_encoder() || format_probes().read().unwrap_or_else(|e| e.into_inner()).iter().any(|(f, probe)| *f == format && probe())
+    format.has_builtin_encoder() || format_probes().read().unwrap_or_else(PoisonError::into_inner).iter().any(|(f, probe)| *f == format && probe())
 }
 
 struct MjpegEncoder {
@@ -1774,7 +1807,7 @@ struct SharedBuf(Arc<Mutex<Vec<u8>>>);
 
 impl Write for SharedBuf {
     fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        self.0.lock().unwrap_or_else(|e| e.into_inner()).extend_from_slice(buf);
+        self.0.lock().unwrap_or_else(PoisonError::into_inner).extend_from_slice(buf);
         Ok(buf.len())
     }
     fn flush(&mut self) -> std::io::Result<()> {
@@ -1784,12 +1817,11 @@ impl Write for SharedBuf {
 
 /// Encode straight sRGB RGBA8 pixels as a PNG file (thumbnails, previews).
 pub fn encode_png(rgba: Vec<u8>, w: u32, h: u32) -> Result<Vec<u8>> {
-    encode_still(Format::PngSequence, rgba, w, h, false)
+    encode_still(Format::PngSequence, rgba, w, h, true)
 }
 
-/// Encode one still of an image sequence (also Export Frame). PNG always carries the alpha
-/// channel it is given; `alpha` keeps it in TIFF, Targa and OpenEXR too, which are otherwise written
-/// as RGB.
+/// Encode one still of an image sequence (also Export Frame). `alpha` keeps the alpha channel in
+/// PNG, TIFF, Targa and OpenEXR, which are otherwise written as RGB.
 /// JPEG uses the default export quality ([`encode_still_with_quality`] picks another).
 pub fn encode_still(format: Format, rgba: Vec<u8>, w: u32, h: u32, alpha: bool) -> Result<Vec<u8>> {
     encode_still_with_quality(format, rgba, w, h, alpha, ExportSettings::default().quality)
@@ -1819,9 +1851,13 @@ pub fn encode_still_with(format: Format, rgba: Vec<u8>, w: u32, h: u32, alpha: b
         Format::TgaSequence => return raster::tga(&rgba, w, h, alpha),
         Format::DpxSequence => return raster::dpx(&rgba, w, h),
         Format::ExrSequence => return raster::exr(&rgba, w, h, alpha, exr),
-        Format::PngSequence => {
+        Format::PngSequence if alpha => {
             image::ImageEncoder::write_image(image::codecs::png::PngEncoder::new(&mut out), &rgba, w, h, image::ExtendedColorType::Rgba8).map_err(enc)?
         }
+        Format::PngSequence => {
+            let rgb = raster::rgb(&rgba, w, h)?;
+            image::ImageEncoder::write_image(image::codecs::png::PngEncoder::new(&mut out), &rgb, w, h, image::ExtendedColorType::Rgb8).map_err(enc)?
+        }
         Format::TiffSequence | Format::BmpSequence => {
             let img = image::RgbaImage::from_raw(w, h, rgba).ok_or_else(|| ExportError::Encode("frame size".into()))?;
             let f = if format == Format::TiffSequence { image::ImageFormat::Tiff } else { image::ImageFormat::Bmp };
@@ -1836,8 +1872,28 @@ pub fn encode_still_with(format: Format, rgba: Vec<u8>, w: u32, h: u32, alpha: b
     Ok(out.into_inner())
 }
 
-/// Run an export (blocking; call from a worker thread).
+/// A pool of `max_threads` threads to run an export on, or `None` when it should run where it is:
+/// no cap (0), a cap that is not below the pool the caller is in already, or no threads to spare
+/// (the browser).
+fn capped_pool(max_threads: u32) -> Option<rayon::ThreadPool> {
+    let cap = max_threads as usize;
+    if cap == 0 || cap >= rayon::current_num_threads() || cfg!(target_arch = "wasm32") {
+        return None;
+    }
+    rayon::ThreadPoolBuilder::new().num_threads(cap).thread_name(|i| format!("filmcraft-export-{i}")).build().ok()
+}
+
+/// Run an export (blocking; call from a worker thread). With `settings.max_threads` set it runs on
+/// a pool of that many threads, so its rendering and software encoding use at most that many cores.
 pub fn export(project: &Arc<Project>, seq: ItemId, settings: &ExportSettings, sources: &dyn SourceProvider, progress: &Progress) -> Result<Report> {
+    match capped_pool(settings.max_threads) {
+        Some(pool) => pool.install(|| export_here(project, seq, settings, sources, progress)),
+        None => export_here(project, seq, settings, sources, progress),
+    }
+}
+
+/// [`export`] on the threads it is called from.
+fn export_here(project: &Arc<Project>, seq: ItemId, settings: &ExportSettings, sources: &dyn SourceProvider, progress: &Progress) -> Result<Report> {
     settings.validate()?;
     if stepped(settings.format) {
         let mut ex = Exporter::new(project.clone(), seq, settings, progress)?;
@@ -1881,7 +1937,7 @@ pub fn export(project: &Arc<Project>, seq: ItemId, settings: &ExportSettings, so
                 progress.set_status(format!("Exporting audio ({})", settings.format.label()));
             }
             a.measure(settings, sources, &cancelled)?;
-            *progress.loudness.lock().unwrap_or_else(|e| e.into_inner()) = a.loudness;
+            *progress.loudness.lock().unwrap_or_else(PoisonError::into_inner) = a.loudness;
             let mut out = Out::create(settings)?;
             let io = |e: std::io::Error| ExportError::Io(e.to_string());
             out.write_all(&head).map_err(io)?;
@@ -1979,7 +2035,7 @@ pub fn export(project: &Arc<Project>, seq: ItemId, settings: &ExportSettings, so
             if let Some(enc) = gif {
                 let buf = gif_buf.clone();
                 drop(enc);
-                let data = std::mem::take(&mut *buf.0.lock().unwrap_or_else(|e| e.into_inner()));
+                let data = std::mem::take(&mut *buf.0.lock().unwrap_or_else(PoisonError::into_inner));
                 total = write_output(settings, &settings.path, data)?;
             }
             (total, count)
diff --git a/crates/export/src/pipeline.rs b/crates/export/src/pipeline.rs
index c47e5f7b8..c4c6f73ea 100644
--- a/crates/export/src/pipeline.rs
+++ b/crates/export/src/pipeline.rs
@@ -3,6 +3,7 @@
 //! apply the Export effects (image, name and timecode overlays, video limiter) and convert to the
 //! encoder's input (straight sRGB RGBA8, or encoded R'G'B' floats for HDR).
 
+use std::io::Cursor;
 use std::sync::Arc;
 
 use filmcraft_geom::Vec2;
@@ -14,6 +15,17 @@ use rayon::prelude::*;
 use crate::settings::{ExportEffects, Placement, Scaling, TextOverlay};
 use crate::{ExportError, ExportSettings, FrameRenderer, GpuRendering, Result, build_frame_renderer, note_gpu_fallback, note_gpu_frame};
 
+/// Image overlays originate outside the project and are expanded to f32 working images. This
+/// admits ordinary 4K artwork while keeping both source decode and resampling bounded.
+const MAX_OVERLAY_PIXELS: usize = 16 << 20;
+
+fn bounded_overlay_dimensions(w: usize, h: usize) -> Result<()> {
+    if w == 0 || h == 0 || w.checked_mul(h).is_none_or(|pixels| pixels > MAX_OVERLAY_PIXELS) {
+        return Err(ExportError::Unsupported("image overlay exceeds the pixel budget".into()));
+    }
+    Ok(())
+}
+
 /// Where the rendered picture lands in the output frame.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub(crate) struct Geometry {
@@ -392,8 +404,16 @@ fn composite(dst: &mut Image, src: &Image, x: i64, y: i64, opacity: f32) {
 /// Load a PNG / JPEG overlay as premultiplied linear light, `width` pixels wide.
 fn load_overlay(path: &str, width: f32) -> Result<Image> {
     let bytes = std::fs::read(path).map_err(|e| ExportError::Io(format!("image overlay {path}: {e}")))?;
-    let rgba = image::load_from_memory(&bytes).map_err(|e| ExportError::Unsupported(format!("image overlay {path}: {e}")))?.to_rgba8();
+    let mut reader = image::ImageReader::new(Cursor::new(bytes));
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(16_384);
+    limits.max_image_height = Some(16_384);
+    limits.max_alloc = Some((MAX_OVERLAY_PIXELS * 4) as u64);
+    reader.limits(limits);
+    let reader = reader.with_guessed_format().map_err(|e| ExportError::Unsupported(format!("image overlay {path}: {e}")))?;
+    let rgba = reader.decode().map_err(|e| ExportError::Unsupported(format!("image overlay {path}: {e}")))?.to_rgba8();
     let (iw, ih) = (rgba.width() as usize, rgba.height() as usize);
+    bounded_overlay_dimensions(iw, ih)?;
     let mut img = Image::new(iw, ih);
     for (o, p) in img.px.as_chunks_mut::<4>().0.iter_mut().zip(rgba.as_raw().as_chunks::<4>().0) {
         let a = p[3] as f32 / 255.0;
@@ -402,8 +422,12 @@ fn load_overlay(path: &str, width: f32) -> Result<Image> {
         }
         o[3] = a;
     }
+    if !width.is_finite() || width <= 0.0 {
+        return Err(ExportError::Unsupported("image overlay width is invalid".into()));
+    }
     let nw = width.round().max(1.0) as usize;
-    let nh = ((ih as f32 * nw as f32 / iw.max(1) as f32).round() as usize).max(1);
+    let nh = ((ih as f64 * nw as f64 / iw.max(1) as f64).round() as usize).max(1);
+    bounded_overlay_dimensions(nw, nh)?;
     Ok(if (nw, nh) == (iw, ih) { img } else { resample(&img, nw, nh) })
 }
 
@@ -498,3 +522,15 @@ fn limit_px(c: &mut [f32; 3], lo: f32, hi: f32) {
     }
     c.iter_mut().for_each(|v| *v = v.clamp(0.0, hi.max(lo)));
 }
+
+#[cfg(test)]
+mod overlay_budget_tests {
+    use super::*;
+
+    #[test]
+    fn overlay_pixel_budget_is_checked_without_overflow() {
+        assert!(bounded_overlay_dimensions(4096, 4096).is_ok());
+        assert!(bounded_overlay_dimensions(4097, 4096).is_err());
+        assert!(bounded_overlay_dimensions(usize::MAX, 2).is_err());
+    }
+}
diff --git a/crates/export/src/settings.rs b/crates/export/src/settings.rs
index ab954adc9..84ca5bacd 100644
--- a/crates/export/src/settings.rs
+++ b/crates/export/src/settings.rs
@@ -624,7 +624,7 @@ impl ExportSettings {
                 px * fps * bpp
             }
             Format::Mjpeg | Format::JpegSequence => px * 8.0 * (0.4 + self.quality as f64 / 100.0 * 2.0) * fps / 8.0,
-            Format::PngSequence => px * 4.0 * 0.45 * 8.0 * fps,
+            Format::PngSequence => px * if self.keeps_alpha() { 4.0 } else { 3.0 } * 0.45 * 8.0 * fps,
             Format::BmpSequence => px * 3.0 * 8.0 * fps,
             Format::TiffSequence => px * if self.keeps_alpha() { 4.0 } else { 3.0 } * 8.0 * fps,
             Format::TgaSequence => px * if self.keeps_alpha() { 4.0 } else { 3.0 } * 8.0 * fps,
diff --git a/crates/export/src/settings_tests.rs b/crates/export/src/settings_tests.rs
index 22be2d317..cfd028bf8 100644
--- a/crates/export/src/settings_tests.rs
+++ b/crates/export/src/settings_tests.rs
@@ -238,7 +238,8 @@ fn openexr_sequences_compress() {
     }
 }
 
-/// `alpha` keeps straight alpha in PNG and TIFF sequences; off (the default) flattens over black (#160).
+/// `alpha` keeps straight alpha in PNG and TIFF sequences; off (the default) flattens over black (#160)
+/// and writes RGB files without an alpha channel (#1863).
 #[test]
 fn image_sequences_keep_alpha_when_asked() {
     let (p, seq, m) = matte([0.0, 0.0, 1.0, 0.5], 64, 36, None);
@@ -248,16 +249,36 @@ fn image_sequences_keep_alpha_when_asked() {
             let mut s = ExportSettings { format: fmt, path: dir.path(&format!("a.{ext}")), alpha, ..Default::default() };
             s.range = Some(TimeRange::new(Tick::ZERO, FrameRate::FPS_24.tick_of(2)));
             export(&p, seq, &s, &m, &Progress::default()).unwrap();
-            let img = image::open(dir.0.join(format!("a000.{ext}"))).unwrap();
+            let file = dir.0.join(format!("a000.{ext}"));
+            if fmt == Format::PngSequence {
+                let colour_type = std::fs::read(&file).unwrap()[25];
+                assert_eq!(colour_type, if alpha { 6 } else { 2 }, "PNG colour type, alpha={alpha}");
+            }
+            let img = image::open(&file).unwrap();
             let px = img.to_rgba8().get_pixel(32, 18).0;
+            assert_eq!(img.color().has_alpha(), alpha, "{fmt:?} alpha channel written, alpha={alpha}");
             if alpha {
-                assert!(img.color().has_alpha(), "{fmt:?} must be written with an alpha channel");
                 assert!((100..=160).contains(&px[3]) && px[2] > 200 && px[0] < 15, "{fmt:?} straight alpha: {px:?}");
             } else {
                 assert!(px[3] == 255 && px[2] > 100 && px[2] < 240 && px[0] < 15, "{fmt:?} flattened over black: {px:?}");
             }
         }
     }
+    // the PNG size estimate counts the channels actually written, as TIFF's does
+    let rate = FrameRate::FPS_24;
+    let png = |alpha| ExportSettings { format: Format::PngSequence, alpha, ..Default::default() }.estimate_bytes(320, 180, rate, 48_000, rate.tick_of(1));
+    assert_eq!(png(false) * 4, png(true) * 3, "PNG estimate: {} RGB vs {} RGBA", png(false), png(true));
+}
+
+/// Thumbnails (`encode_png`) and an 8-bit PNG Export Frame keep the alpha they are given: only the
+/// sequence's `alpha` switch drops it (#1863).
+#[test]
+fn png_stills_keep_their_alpha_channel() {
+    let half = filmcraft_render::Image::filled(4, 2, [0.0, 0.0, 0.5, 0.5]);
+    let thumb = encode_png(half.to_rgba8(), 4, 2).unwrap();
+    assert_eq!(thumb[25], 6, "encode_png colour type");
+    let frame = still::encode(&half, still::StillFormat::Png, 8).unwrap();
+    assert_eq!(frame[25], 6, "Export Frame PNG colour type");
 }
 
 #[test]
diff --git a/crates/export/src/still.rs b/crates/export/src/still.rs
index c60c2159f..2af712461 100644
--- a/crates/export/src/still.rs
+++ b/crates/export/src/still.rs
@@ -77,8 +77,8 @@ pub fn encode(image: &Image, format: StillFormat, depth: u8) -> Result<Vec<u8>>
             StillFormat::Tiff => Format::TiffSequence,
             _ => Format::BmpSequence,
         };
-        // 8-bit TIFF stays RGB, as Export Frame wrote it before; 16-bit output keeps alpha.
-        return crate::encode_still(f, rgba, w, h, false);
+        // 8-bit TIFF and BMP stay RGB, as Export Frame wrote them before; PNG and 16-bit output keep alpha.
+        return crate::encode_still(f, rgba, w, h, format == StillFormat::Png);
     }
     let capacity = samples.checked_mul(2).ok_or_else(bad)?;
     let mut bytes = Vec::with_capacity(capacity);
diff --git a/crates/export/tests/it/main.rs b/crates/export/tests/it/main.rs
new file mode 100644
index 000000000..3452f185c
--- /dev/null
+++ b/crates/export/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod pool_trim;
+mod renderer_reentrancy;
diff --git a/crates/export/tests/pool_trim.rs b/crates/export/tests/it/pool_trim.rs
similarity index 100%
rename from crates/export/tests/pool_trim.rs
rename to crates/export/tests/it/pool_trim.rs
diff --git a/crates/export/tests/renderer_reentrancy.rs b/crates/export/tests/it/renderer_reentrancy.rs
similarity index 98%
rename from crates/export/tests/renderer_reentrancy.rs
rename to crates/export/tests/it/renderer_reentrancy.rs
index fc6c235bc..2c3a8bd8a 100644
--- a/crates/export/tests/renderer_reentrancy.rs
+++ b/crates/export/tests/it/renderer_reentrancy.rs
@@ -143,7 +143,7 @@ fn nested_rayon_renderers_finish_every_export_path() {
     }
     for case in ["png", "gif", "stepped", "overlap-audio"] {
         let mut child = std::process::Command::new(std::env::current_exe().unwrap())
-            .args(["--exact", "nested_rayon_renderers_finish_every_export_path", "--nocapture"])
+            .args(["--exact", "renderer_reentrancy::nested_rayon_renderers_finish_every_export_path", "--nocapture"])
             .env(CHILD, case)
             .spawn()
             .unwrap();
diff --git a/crates/flac/src/lib.rs b/crates/flac/src/lib.rs
index 0844b7c3c..10d8d28fa 100644
--- a/crates/flac/src/lib.rs
+++ b/crates/flac/src/lib.rs
@@ -111,7 +111,9 @@ impl Encoder {
             total_samples: 0,
             min_frame: 0,
             max_frame: 0,
-            md5: md5::Md5::default(),
+            // RFC 9639 requires an MD5 signature of the unencoded audio in STREAMINFO; this is an
+            // integrity checksum, not a password hash or a security boundary.
+            md5: md5::Md5::default(), // NOSONAR
         })
     }
 
diff --git a/crates/format/Cargo.toml b/crates/format/Cargo.toml
index f2c1e982e..87c6be25b 100644
--- a/crates/format/Cargo.toml
+++ b/crates/format/Cargo.toml
@@ -16,6 +16,10 @@ log = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+chrono = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+tempfile = "3.27"
 
 [dev-dependencies]
 filmcraft-time = { workspace = true }
diff --git a/crates/format/src/atomic.rs b/crates/format/src/atomic.rs
index 0f1044ca6..fc6d29dcd 100644
--- a/crates/format/src/atomic.rs
+++ b/crates/format/src/atomic.rs
@@ -28,11 +28,21 @@ fn parent_dir(path: &Path) -> PathBuf {
 /// `fsync` the directory so the rename itself survives a power cut. If anything fails the temp file
 /// is removed and `path` is untouched.
 pub fn atomic_write(path: &Path, data: &[u8]) -> io::Result<()> {
+    // `rename` replaces the inode, so a new staging file must inherit an existing project's
+    // access mode instead of silently broadening a private file to the process default.
+    let permissions = match fs::metadata(path) {
+        Ok(meta) => Some(meta.permissions()),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => None,
+        Err(e) => return Err(e),
+    };
     let tmp = temp_path(path);
     let r = (|| {
         {
             // closed before the rename
             let mut f = OpenOptions::new().write(true).create_new(true).open(&tmp)?;
+            if let Some(permissions) = permissions.as_ref() {
+                f.set_permissions(permissions.clone())?;
+            }
             f.write_all(data)?;
             f.sync_all()?;
         }
@@ -46,8 +56,38 @@ pub fn atomic_write(path: &Path, data: &[u8]) -> io::Result<()> {
     Ok(())
 }
 
-/// Best-effort directory fsync (persists the rename on POSIX; not possible on Windows, where
-/// `MoveFileEx` with write-through semantics is already durable enough).
+/// Publish a complete new file without replacing an occupied final path, including a symlink.
+/// Bytes are staged and synced in the destination directory before no-clobber publication.
+/// A write failure leaves no partial final file; temporary-file cleanup is best effort.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn atomic_write_new(path: &Path, data: &[u8]) -> io::Result<()> {
+    atomic_write_new_with(path, |file| file.write_all(data).and_then(|_| file.sync_all()))
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn atomic_write_new(_path: &Path, _data: &[u8]) -> io::Result<()> {
+    Err(io::Error::new(io::ErrorKind::Unsupported, "native exclusive file creation is unavailable in the browser"))
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn atomic_write_new_with(path: &Path, write: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
+    let dir = parent_dir(path);
+    #[cfg(unix)]
+    let mut staged = {
+        use std::os::unix::fs::PermissionsExt;
+        // Like an ordinary file creation: request 0666 and let the process umask decide the
+        // effective mode (0644 with the usual 022, 0664 with 002).
+        tempfile::Builder::new().permissions(fs::Permissions::from_mode(0o666)).tempfile_in(&dir)? // NOSONAR
+    };
+    #[cfg(not(unix))]
+    let mut staged = tempfile::NamedTempFile::new_in(&dir)?;
+    write(staged.as_file_mut())?;
+    let _published = staged.persist_noclobber(path).map_err(|e| e.error)?;
+    sync_dir(&dir);
+    Ok(())
+}
+
+/// Best-effort directory sync; directory handles are not uniformly readable or syncable.
 fn sync_dir(dir: &Path) {
     if let Ok(d) = File::open(dir) {
         let _ = d.sync_all();
@@ -92,6 +132,81 @@ mod tests {
         fs::remove_dir_all(&d).unwrap();
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn replacement_preserves_existing_file_permissions() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let d = tmpdir("permissions");
+        let p = d.join("private.fcproj");
+        fs::write(&p, b"before").unwrap();
+        fs::set_permissions(&p, fs::Permissions::from_mode(0o600)).unwrap();
+        atomic_write(&p, b"after").unwrap();
+        assert_eq!(fs::read(&p).unwrap(), b"after");
+        assert_eq!(fs::metadata(&p).unwrap().permissions().mode() & 0o777, 0o600);
+        fs::remove_dir_all(&d).unwrap();
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn new_file_is_published_complete_without_clobbering_or_temp_leaks() {
+        let d = tmpdir("new");
+        let p = d.join("audio.wav");
+        atomic_write_new(&p, b"complete").unwrap();
+        assert_eq!(fs::read(&p).unwrap(), b"complete");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let reference = d.join("normal-create");
+            OpenOptions::new().write(true).create_new(true).open(&reference).unwrap();
+            assert_eq!(fs::metadata(&p).unwrap().permissions().mode() & 0o777, fs::metadata(&reference).unwrap().permissions().mode() & 0o777);
+            fs::remove_file(reference).unwrap();
+        }
+        assert_eq!(atomic_write_new(&p, b"replacement").unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+        assert_eq!(fs::read(&p).unwrap(), b"complete");
+        #[cfg(unix)]
+        {
+            let link = d.join("link.wav");
+            std::os::unix::fs::symlink(&p, &link).unwrap();
+            assert_eq!(atomic_write_new(&link, b"replacement").unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+            assert_eq!(fs::read(&p).unwrap(), b"complete");
+        }
+        let expected = if cfg!(unix) { 2 } else { 1 };
+        assert_eq!(fs::read_dir(&d).unwrap().count(), expected, "staging file remained after publication");
+        fs::remove_dir_all(&d).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn new_file_can_publish_in_a_directory_without_read_permission() {
+        use std::os::unix::fs::PermissionsExt;
+        let d = tmpdir("write-only-directory");
+        let original_permissions = fs::metadata(&d).unwrap().permissions();
+        fs::set_permissions(&d, fs::Permissions::from_mode(0o300)).unwrap();
+        let p = d.join("audio.wav");
+        let result = atomic_write_new(&p, b"complete");
+        fs::set_permissions(&d, original_permissions).unwrap();
+        assert!(result.is_ok(), "{result:?}");
+        assert_eq!(fs::read(&p).unwrap(), b"complete");
+        fs::remove_dir_all(&d).unwrap();
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn failed_staging_leaves_no_partial_destination() {
+        let d = tmpdir("failed-new");
+        let p = d.join("audio.wav");
+        let error = atomic_write_new_with(&p, |file| {
+            file.write_all(b"partial")?;
+            Err(io::Error::other("simulated full disk"))
+        })
+        .unwrap_err();
+        assert_eq!(error.to_string(), "simulated full disk");
+        assert!(!p.exists());
+        assert_eq!(fs::read_dir(&d).unwrap().count(), 0);
+        fs::remove_dir_all(&d).unwrap();
+    }
+
     #[test]
     fn missing_directory_is_an_error() {
         let d = tmpdir("missing");
diff --git a/crates/format/src/autosave.rs b/crates/format/src/autosave.rs
index 4608c1061..54543749b 100644
--- a/crates/format/src/autosave.rs
+++ b/crates/format/src/autosave.rs
@@ -1,9 +1,10 @@
 //! Auto-save file naming and rotation (Premiere behaviour).
 //!
 //! Auto-saves go to an `Auto-Save` folder next to the project, named
-//! `<project name>-YYYY-MM-DD_HH-MM-SS.fcproj` (local wall-clock time). After each write the oldest
-//! files of that project beyond the "Maximum Project Versions" limit are deleted. Only files whose
-//! name is exactly `<name>-<timestamp>.fcproj` are ever touched.
+//! `<project name>-YYYY-MM-DD_HH-MM-SS-<unix seconds>.fcproj` (local wall-clock time, then the real
+//! time that orders the files). After each write the oldest files of that project beyond the "Maximum
+//! Project Versions" limit are deleted. Only files whose name is exactly `<name>-<timestamp>.fcproj`
+//! or `<name>-<timestamp>-<unix seconds>.fcproj` are ever touched.
 
 use std::fs;
 use std::io;
@@ -24,23 +25,37 @@ pub fn file_stem(name: &str) -> String {
     if s.is_empty() { "Untitled".into() } else { s }
 }
 
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// `i64` exact instead of collapsing out-of-range years to the epoch.
+fn utc_parts(secs: i64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = (secs.div_euclid(86_400), secs.rem_euclid(86_400));
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
 /// Civil date-time (proleptic Gregorian) of a unix timestamp shifted by `offset_secs`.
+/// Years far outside chrono's own range are preserved (the old hand-rolled conversion kept them);
+/// only an overflowing `unix + offset_secs` shift (which the old code wrapped to garbage) reads as
+/// the epoch.
 pub fn civil(unix: i64, offset_secs: i32) -> (i64, u32, u32, u32, u32, u32) {
-    let t = unix + offset_secs as i64;
-    let days = t.div_euclid(86_400);
-    let secs = t.rem_euclid(86_400);
-    // Howard Hinnant's days_from_civil inverse.
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let y = yoe + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;
-    let y = if m <= 2 { y + 1 } else { y };
-    (y, m, d, (secs / 3600) as u32, (secs % 3600 / 60) as u32, (secs % 60) as u32)
+    use chrono::{Datelike, Timelike};
+    let Some(s) = unix.checked_add(offset_secs as i64) else {
+        return (1970, 1, 1, 0, 0, 0);
+    };
+    let (y, t) = utc_parts(s);
+    (y, t.month(), t.day(), t.hour(), t.minute(), t.second())
 }
 
 /// `YYYY-MM-DD_HH-MM-SS` (the auto-save file-name stamp).
@@ -55,9 +70,10 @@ pub fn display_time(unix: i64, offset_secs: i32) -> String {
     format!("{y:04}-{mo:02}-{d:02} {h:02}:{mi:02}:{s:02}")
 }
 
-/// `<stem>-YYYY-MM-DD_HH-MM-SS.fcproj`.
+/// `<stem>-YYYY-MM-DD_HH-MM-SS-<unix seconds>.fcproj`. The local stamp is for people; the unix time
+/// orders the files (the local clock can go back, or repeat an hour, when daylight saving time ends).
 pub fn auto_save_name(name: &str, unix: i64, offset_secs: i32) -> String {
-    format!("{}-{}.fcproj", file_stem(name), timestamp(unix, offset_secs))
+    format!("{}-{}-{unix}.fcproj", file_stem(name), timestamp(unix, offset_secs))
 }
 
 fn is_stamp(s: &str) -> bool {
@@ -70,20 +86,33 @@ fn is_stamp(s: &str) -> bool {
         })
 }
 
-/// Auto-saves of project `name` in `dir`, oldest first.
+/// Parse `YYYY-MM-DD_HH-MM-SS` or `YYYY-MM-DD_HH-MM-SS-<unix>` into the stamp and the unix time
+/// (`None` for files written before the unix time was part of the name).
+fn parse_stamp(s: &str) -> Option<(&str, Option<i64>)> {
+    if is_stamp(s) {
+        return Some((s, None));
+    }
+    let stamp = s.get(..19).filter(|st| is_stamp(st))?;
+    let digits = s.get(19..)?.strip_prefix('-')?;
+    let unix: i64 = digits.parse().ok()?;
+    (unix.to_string() == digits).then_some((stamp, Some(unix)))
+}
+
+/// Auto-saves of project `name` in `dir`, oldest first (by real time, not by the local clock; files
+/// without a unix time in their name are older than those with one).
 pub fn list_auto_saves(dir: &Path, name: &str) -> Vec<PathBuf> {
     let prefix = format!("{}-", file_stem(name));
     let Ok(rd) = fs::read_dir(dir) else { return Vec::new() };
-    let mut v: Vec<(String, PathBuf)> = rd
+    let mut v: Vec<(Option<i64>, String, PathBuf)> = rd
         .filter_map(|e| e.ok())
         .filter_map(|e| {
             let f = e.file_name().to_string_lossy().into_owned();
-            let stamp = f.strip_prefix(&prefix)?.strip_suffix(".fcproj")?;
-            is_stamp(stamp).then(|| (stamp.to_string(), e.path()))
+            let (stamp, unix) = parse_stamp(f.strip_prefix(&prefix)?.strip_suffix(".fcproj")?)?;
+            Some((unix, stamp.to_string(), e.path()))
         })
         .collect();
     v.sort();
-    v.into_iter().map(|(_, p)| p).collect()
+    v.into_iter().map(|(_, _, p)| p).collect()
 }
 
 /// Delete the oldest auto-saves of `name` so at most `max` remain. Returns the deleted paths.
@@ -122,14 +151,60 @@ mod tests {
         assert_eq!(timestamp(-1, 0), "1969-12-31_23-59-59");
     }
 
+    #[test]
+    fn out_of_range_years_are_preserved_not_collapsed_to_the_epoch() {
+        // The old hand-rolled conversion kept years far outside chrono's own range; the refactor
+        // must too (reviewer FredApps). `10_000_000_000_000` s → 318857, not 1970.
+        assert_eq!(timestamp(10_000_000_000_000, 0), "318857-05-20_17-46-40");
+        assert_eq!(display_time(10_000_000_000_000, 0), "318857-05-20 17:46:40");
+        // chrono's own upper edge (year 10000) and a negative value far before it.
+        assert_eq!(timestamp(253_402_300_800, 0), "10000-01-01_00-00-00");
+        assert_eq!(display_time(-10_000_000_000_000, 0), "-314918-08-13 06:13:20");
+        // The input extremes the old code accepted (offset 0, so no shift overflow).
+        assert_eq!(display_time(i64::MAX, 0), "292277026596-12-04 15:30:07");
+        assert_eq!(display_time(i64::MIN, 0), "-292277022657-01-27 08:29:52");
+        // Only an overflowing `unix + offset_secs` shift (old code wrapped it to garbage) reads as
+        // the epoch; the separate overflow guard is kept.
+        assert_eq!(civil(i64::MAX, 3600), (1970, 1, 1, 0, 0, 0));
+        assert_eq!(civil(i64::MIN, -3600), (1970, 1, 1, 0, 0, 0));
+    }
+
     #[test]
     fn names_and_stems() {
-        assert_eq!(auto_save_name("My Film", 0, 0), "My Film-1970-01-01_00-00-00.fcproj");
+        assert_eq!(auto_save_name("My Film", 0, 0), "My Film-1970-01-01_00-00-00-0.fcproj");
         assert_eq!(file_stem("a/b:c"), "a_b_c");
         assert_eq!(file_stem("  "), "Untitled");
         assert_eq!(auto_save_dir(Path::new("/x/y/p.fcproj")), Path::new("/x/y/Auto-Save"));
     }
 
+    #[test]
+    fn rotation_survives_the_clock_going_back_at_the_end_of_dst() {
+        let d = std::env::temp_dir().join(format!("filmcraft-rotate-dst-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&d);
+        let t0 = 1_792_900_000;
+        // 02:30 at +02:00, then 40 minutes later the clock reads 02:10 at +01:00.
+        let old = write_auto_save(&d, "Cut", t0, 7200, b"old", 1).unwrap();
+        let new = write_auto_save(&d, "Cut", t0 + 2400, 3600, b"new", 1).unwrap();
+        assert!(new.exists(), "the newest auto-save was deleted by rotation");
+        assert!(!old.exists(), "the oldest auto-save should be rotated out");
+        fs::remove_dir_all(&d).unwrap();
+    }
+
+    #[test]
+    fn repeated_wall_clock_hour_does_not_overwrite_earlier_saves() {
+        let d = std::env::temp_dir().join(format!("filmcraft-rotate-dst2-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&d);
+        let t0 = 1_792_900_000;
+        // The same wall-clock second, one hour apart (+02:00 then +01:00).
+        let a = write_auto_save(&d, "Cut", t0, 7200, b"first", 5).unwrap();
+        let b = write_auto_save(&d, "Cut", t0 + 3600, 3600, b"second", 5).unwrap();
+        assert_ne!(a, b);
+        assert_eq!(fs::read(&a).unwrap(), b"first");
+        assert_eq!(fs::read(&b).unwrap(), b"second");
+        assert_eq!(list_auto_saves(&d, "Cut"), vec![a, b]);
+        fs::remove_dir_all(&d).unwrap();
+    }
+
     #[test]
     fn rotation_keeps_newest_and_ignores_other_files() {
         let d = std::env::temp_dir().join(format!("filmcraft-rotate-{}", std::process::id()));
@@ -142,8 +217,8 @@ mod tests {
         fs::write(d.join("notes.txt"), b"keep").unwrap();
         let left = list_auto_saves(&d, "Cut");
         assert_eq!(left.len(), 5);
-        assert!(left[0].to_string_lossy().ends_with(&format!("Cut-{}.fcproj", timestamp(1_790_000_120, 0))));
-        assert!(left[4].to_string_lossy().ends_with(&format!("Cut-{}.fcproj", timestamp(1_790_000_360, 0))));
+        assert!(left[0].to_string_lossy().ends_with(&format!("Cut-{}-1790000120.fcproj", timestamp(1_790_000_120, 0))));
+        assert!(left[4].to_string_lossy().ends_with(&format!("Cut-{}-1790000360.fcproj", timestamp(1_790_000_360, 0))));
         assert_eq!(list_auto_saves(&d, "Cut-Two").len(), 1);
         assert!(d.join("notes.txt").exists());
         rotate(&d, "Cut", 2).unwrap();
diff --git a/crates/format/src/lib.rs b/crates/format/src/lib.rs
index 70af3c747..b77968dd1 100644
--- a/crates/format/src/lib.rs
+++ b/crates/format/src/lib.rs
@@ -49,7 +49,7 @@ use filmcraft_project::{Project, ProjectView};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-pub use atomic::atomic_write;
+pub use atomic::{atomic_write, atomic_write_new};
 
 /// The `format` tag written in every envelope.
 pub const FORMAT_ID: &str = "filmcraft.project";
@@ -216,6 +216,20 @@ pub fn decode(bytes: &[u8]) -> Result<Loaded, FormatError> {
 /// Refuse only values that would overflow or exhaust memory later (`Sequence::check_bounds`);
 /// structural rules such as overlaps are left to the editor, so projects that open today still open.
 fn validate_loaded(mut loaded: Loaded) -> Result<Loaded, FormatError> {
+    // Graphic layers written before they carried a uid get a stable identity now, before any
+    // undo history exists. The field is optional in the schema, so this is not a schema upgrade.
+    loaded.project.ensure_graphic_layer_uids();
+    // Embedded LUT text is rendered on the hot path. Drop oversize entries at load time so a
+    // hostile project cannot retain an unrenderable multi-megabyte source or repeatedly offer it
+    // to renderers. Clips that refer to one simply have no LUT, like a deleted library entry.
+    let max_lut = filmcraft_project::MAX_LUT_TEXT_BYTES;
+    loaded.project.luts.retain(|lut| {
+        let keep = lut.text.len() <= max_lut;
+        if !keep {
+            log::warn!("LUT `{}`: {} bytes, dropping entry above {max_lut} byte limit", lut.name, lut.text.len());
+        }
+        keep
+    });
     // Out-of-range audio stream data is repaired, not refused: failing the load would lose the
     // whole project over one bad index. A media item keeps its first `MAX_AUDIO_STREAMS` streams; a
     // clip pointing past that plays stream 0.
@@ -223,9 +237,14 @@ fn validate_loaded(mut loaded: Loaded) -> Result<Loaded, FormatError> {
     for item in loaded.project.items.values_mut() {
         let name = item.name.clone();
         match &mut item.kind {
-            filmcraft_project::ItemKind::Media(m) if m.info.audio_streams.len() > max => {
-                log::warn!("media `{name}`: {} audio streams, keeping the first {max}", m.info.audio_streams.len());
-                m.info.audio_streams.truncate(max);
+            filmcraft_project::ItemKind::Media(m) => {
+                if let Some(video) = &m.info.video {
+                    filmcraft_project::validate_frame_size(video.width, video.height).map_err(|e| FormatError::Corrupt(format!("media `{name}`: {e}")))?;
+                }
+                if m.info.audio_streams.len() > max {
+                    log::warn!("media `{name}`: {} audio streams, keeping the first {max}", m.info.audio_streams.len());
+                    m.info.audio_streams.truncate(max);
+                }
             }
             filmcraft_project::ItemKind::Sequence(sequence) => {
                 let sequence = std::sync::Arc::make_mut(sequence);
@@ -244,6 +263,18 @@ fn validate_loaded(mut loaded: Loaded) -> Result<Loaded, FormatError> {
             sequence.check_bounds().map_err(|e| FormatError::Corrupt(format!("sequence `{}`: {e}", item.name)))?;
         }
     }
+    // Every new id is `next_id`, read from the file as is. One that lags behind the ids in it (an
+    // older build, a hand edit) would hand out an id in use, and the new item replace the old (#2809).
+    let project = &mut loaded.project;
+    let max = project.max_id();
+    let past = max.checked_add(1).ok_or_else(|| FormatError::Corrupt(format!("project ID space exhausted (id {max} in use)")))?;
+    if project.next_id < past {
+        log::warn!("next id {} is not past the largest id in the project, raised to {past}", project.next_id);
+        project.next_id = past;
+    }
+    if project.next_id > Project::MAX_NEXT_ID {
+        return Err(FormatError::Corrupt(format!("project ID space exhausted (next id {})", project.next_id)));
+    }
     Ok(loaded)
 }
 
@@ -409,6 +440,32 @@ mod tests {
         assert_eq!(loaded.project.sequence(seq).unwrap().video_tracks[0].items.len(), 3);
     }
 
+    /// Opening a project written before graphic layers had uids assigns stable, unique identities
+    /// without a schema upgrade. The old file still opens, and its two byte-identical layers (same
+    /// geometry, different text) can no longer be confused after a reorder.
+    #[test]
+    fn opening_a_legacy_project_assigns_unique_graphic_layer_uids() {
+        use filmcraft_project::graphic::{layer_indices, new_text_layer};
+        use filmcraft_project::{ItemKind, SequenceSettings, TrackKind};
+        use filmcraft_time::{FrameRate, Tick, TimeRange};
+        let mut p = Project::new("Legacy graphics");
+        let rate = FrameRate::FPS_25;
+        let seq = p.new_sequence("Sequence 01", SequenceSettings::default(), 1, 1, None);
+        let graphic = p.add_item("Graphic", filmcraft_project::Label::Rose, ItemKind::Graphic { width: 1920, height: 1080, rate }, None);
+        let mut item = p.make_track_item(graphic, TrackKind::Video, Tick::ZERO, TimeRange::new(Tick::ZERO, rate.tick_of(100)), rate).unwrap();
+        item.effects = vec![new_text_layer("one", Default::default(), 100.0), new_text_layer("two", Default::default(), 100.0)];
+        assert!(item.effects.iter().all(|e| filmcraft_project::gtemplate::layer_uid(e) == 0));
+        p.sequence_mut(seq).unwrap().video_tracks[0].items = vec![item];
+        let loaded = decode(&encode(&p, false)).expect("an old project still opens");
+        let item = &loaded.project.sequence(seq).unwrap().video_tracks[0].items[0];
+        let uids: Vec<u64> = layer_indices(&item.effects).into_iter().map(|i| filmcraft_project::gtemplate::layer_uid(&item.effects[i])).collect();
+        assert_eq!(uids.len(), 2);
+        assert!(uids.iter().all(|uid| *uid != 0), "opening assigned uids: {uids:?}");
+        assert_ne!(uids[0], uids[1], "identical geometry and different text still get distinct identities");
+        let again = decode(&encode(&loaded.project, false)).expect("the upgraded project round-trips");
+        assert_eq!(again.project, loaded.project, "assigned uids are stable across saves");
+    }
+
     #[test]
     fn roundtrip_current() {
         let p = Project::new("Round Trip");
@@ -422,6 +479,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn oversized_embedded_luts_are_dropped_on_load() {
+        let mut p = Project::new("LUT limit");
+        p.luts.push(filmcraft_project::ProjectLut {
+            id: "huge".into(),
+            name: "huge".into(),
+            source_path: None,
+            format: "cube".into(),
+            text: "#".repeat(filmcraft_project::MAX_LUT_TEXT_BYTES + 1).into(),
+        });
+        let loaded = decode(&encode(&p, false)).unwrap();
+        assert!(loaded.project.luts.is_empty());
+    }
+
     /// What is open is stored beside the project. A file without it, or with one that cannot be
     /// read, opens all the same.
     #[test]
diff --git a/crates/format/tests/fixtures.rs b/crates/format/tests/fixtures.rs
index e99a7853f..fa1b7027d 100644
--- a/crates/format/tests/fixtures.rs
+++ b/crates/format/tests/fixtures.rs
@@ -35,7 +35,8 @@ fn v1_edit_loads_with_defaults_for_later_fields() {
     assert_eq!(l.schema_version, 1);
     let p = &l.project;
     assert_eq!(p.name, "Legacy Edit");
-    assert_eq!(p.next_id, 48);
+    // the file says 48, but its sequence marker is 800000: new ids start past it (#2809)
+    assert_eq!(p.next_id, 800_001);
     let media = p.item(ItemId(5)).unwrap();
     assert_eq!(media.name, "Ocean_Sunset.mp4");
     assert!(media.metadata.is_empty());
@@ -84,6 +85,20 @@ fn hostile_audio_stream_counts_and_indices_are_repaired_not_rejected() {
     assert_eq!(loaded.item(ItemId(5)).unwrap().as_media().unwrap().info.audio_streams.len(), filmcraft_media::MAX_AUDIO_STREAMS);
 }
 
+/// Persisted media metadata is used to allocate synthetic and offline source frames, so it must
+/// have the same bounded dimensions as a sequence before the project is opened.
+#[test]
+fn hostile_media_video_dimensions_are_rejected() {
+    let mut p = decode(&fixture("v1-edit.fcproj")).unwrap().project;
+    let media = p.item_mut(ItemId(5)).unwrap().as_media_mut().unwrap();
+    let video = media.info.video.as_mut().unwrap();
+    video.width = u32::MAX;
+    video.height = 1;
+
+    let err = decode(&encode(&p, false)).unwrap_err();
+    assert!(matches!(err, FormatError::Corrupt(ref message) if message.contains("media `Ocean_Sunset.mp4`") && message.contains("frame size")), "{err}");
+}
+
 /// Schema 8 (before M3.10): no time interpolation / Hold Filters / Field Options / source channels
 /// on clips, no audio channel map, subclips without Restrict Trims.
 #[test]
@@ -219,6 +234,8 @@ fn v8_loads_without_transcripts_and_v9_roundtrips_them() {
     t.normalize();
     p.transcripts.insert(ItemId(7), std::sync::Arc::new(t));
     let again = decode(&encode(&p, true)).unwrap();
+    // the transcript's key is an id in use, so new ids start past it (#2809)
+    p.next_id = 8;
     assert!(!again.migrated());
     assert_eq!(again.project, p);
     assert_eq!(again.project.transcripts[&ItemId(7)].speakers[0].name, "Speaker 1");
@@ -259,3 +276,200 @@ fn v10_minimal_loads_with_m3_11_defaults() {
     assert_eq!(again.schema_version, SCHEMA_VERSION);
     assert_eq!(&again.project, p);
 }
+
+/// #2809: `next_id` is read from the file, and nothing raised it past the ids already in it. A file
+/// whose `next_id` lagged behind (an older build, a hand edit, a merge) handed out an id in use, and
+/// the new item silently replaced the old one. Each kind of id is raised past on its own, so a kind
+/// the loader forgets fails here.
+#[test]
+fn next_id_is_raised_past_every_id_in_the_file() {
+    use filmcraft_project::{
+        BinId, Camera, Caption, CaptionFormat, CaptionTrack, Label, Marker, MarkerId, MarkerKind, MergedClip, MulticamSource, Narration, ProjectLut, SearchBin,
+        Track, TrackId, TrackKind, TrackSend, Transition, TransitionId,
+    };
+    const BIG: u64 = 5_000_000;
+    let base = decode(&fixture("v1-edit.fcproj")).unwrap().project;
+    let seq = ItemId(21);
+    let marker = |id| Marker {
+        id: MarkerId(id),
+        start: Tick::ZERO,
+        duration: Tick::ZERO,
+        name: String::new(),
+        comment: String::new(),
+        kind: MarkerKind::Comment,
+        color: Label::Green,
+    };
+    let kinds: Vec<(&str, Box<dyn Fn(&mut Project)>)> = vec![
+        (
+            "item",
+            Box::new(|p| {
+                p.next_id = BIG;
+                p.add_item("Layer", Label::Iris, p.item(ItemId(5)).unwrap().kind.clone(), None);
+            }),
+        ),
+        (
+            "bin",
+            Box::new(|p| {
+                p.next_id = BIG;
+                p.add_bin("Bin", None);
+            }),
+        ),
+        ("search bin", Box::new(|p| p.search_bins.push(SearchBin { id: BinId(BIG), name: "Find".into(), query: Default::default() }))),
+        ("media marker", Box::new(move |p| p.item_mut(ItemId(5)).unwrap().as_media_mut().unwrap().markers.push(marker(BIG)))),
+        ("sequence marker", Box::new(move |p| p.sequence_mut(seq).unwrap().markers[0].id = MarkerId(BIG))),
+        ("track", Box::new(move |p| p.sequence_mut(seq).unwrap().audio_tracks[0].id = TrackId(BIG))),
+        ("submix track", Box::new(move |p| p.sequence_mut(seq).unwrap().submix_tracks.push(Track::new(TrackId(BIG), TrackKind::Audio, "Submix".into())))),
+        ("clip", Box::new(move |p| p.sequence_mut(seq).unwrap().video_tracks[0].items[0].id = ClipId(BIG))),
+        ("link", Box::new(move |p| p.sequence_mut(seq).unwrap().video_tracks[0].items[0].link = Some(BIG))),
+        ("group", Box::new(move |p| p.sequence_mut(seq).unwrap().video_tracks[0].items[0].group = Some(BIG))),
+        ("clip marker", Box::new(move |p| p.sequence_mut(seq).unwrap().video_tracks[0].items[0].markers.push(marker(BIG)))),
+        (
+            "transition",
+            Box::new(move |p| {
+                let s = p.sequence_mut(seq).unwrap();
+                let clip = s.video_tracks[0].items[0].clone();
+                let effect = clip.effects[0].clone();
+                s.video_tracks[0].transitions.push(Transition {
+                    id: TransitionId(BIG),
+                    effect,
+                    start: clip.start,
+                    duration: Tick::ZERO,
+                    from: None,
+                    to: Some(clip.id),
+                    align: Default::default(),
+                    reverse: false,
+                });
+            }),
+        ),
+        (
+            "caption track",
+            Box::new(move |p| p.sequence_mut(seq).unwrap().caption_tracks.push(CaptionTrack::new(TrackId(BIG), "Subtitle".into(), CaptionFormat::Subtitle))),
+        ),
+        (
+            "caption",
+            Box::new(move |p| {
+                let mut track = CaptionTrack::new(TrackId(7), "Subtitle".into(), CaptionFormat::Subtitle);
+                track.captions.push(Caption {
+                    id: ClipId(BIG),
+                    start: Tick::ZERO,
+                    duration: Tick(1),
+                    text: "Hi".into(),
+                    speaker: None,
+                    cue_id: None,
+                    settings: String::new(),
+                });
+                p.sequence_mut(seq).unwrap().caption_tracks.push(track);
+            }),
+        ),
+        (
+            "LUT",
+            Box::new(|p| p.luts.push(ProjectLut { id: format!("lut{BIG}"), name: "Look".into(), source_path: None, format: "cube".into(), text: "".into() })),
+        ),
+        // left behind by a deleted item: a new item must not take its id and inherit them
+        ("transcript", Box::new(|p| _ = p.transcripts.insert(ItemId(BIG), Default::default()))),
+        ("source graphic", Box::new(|p| _ = p.source_graphics.insert(ItemId(BIG), Default::default()))),
+        (
+            "narration",
+            Box::new(|p| {
+                let narration = Narration {
+                    text: "Hello".into(),
+                    language: "en-US".into(),
+                    voice: "basic-female".into(),
+                    pitch: Default::default(),
+                    pace: 1.0,
+                    speech_duration: Tick(1),
+                };
+                p.narrations.insert(ItemId(BIG), narration);
+            }),
+        ),
+        // only referenced, the target gone: a new item taking that id would be picked up by the reference
+        ("clip's item", Box::new(move |p| p.sequence_mut(seq).unwrap().video_tracks[0].items[0].item = ItemId(BIG))),
+        (
+            "subclip's parent",
+            Box::new(|p| {
+                let range = filmcraft_time::TimeRange::new(Tick::ZERO, Tick(1));
+                p.add_item("Subclip", Label::Iris, ItemKind::Subclip { parent: ItemId(BIG), range, restrict_trims: false }, None);
+            }),
+        ),
+        (
+            "transition's clip",
+            Box::new(move |p| {
+                let s = p.sequence_mut(seq).unwrap();
+                let clip = s.video_tracks[0].items[0].clone();
+                s.video_tracks[0].transitions.push(Transition {
+                    id: TransitionId(9),
+                    effect: clip.effects[0].clone(),
+                    start: clip.start,
+                    duration: Tick::ZERO,
+                    from: None,
+                    to: Some(ClipId(BIG)),
+                    align: Default::default(),
+                    reverse: false,
+                });
+            }),
+        ),
+        ("send target", Box::new(move |p| p.sequence_mut(seq).unwrap().audio_tracks[0].mixer.sends.push(TrackSend::new(TrackId(BIG))))),
+        ("track output", Box::new(move |p| p.sequence_mut(seq).unwrap().master_mixer.output = Some(TrackId(BIG)))),
+        (
+            "camera's source",
+            Box::new(move |p| {
+                let camera = Camera { name: "Cam 1".into(), video_track: None, audio_tracks: Vec::new(), enabled: true, source: Some(ItemId(BIG)) };
+                p.sequence_mut(seq).unwrap().multicam = Some(MulticamSource { cameras: vec![camera], ..Default::default() });
+            }),
+        ),
+        (
+            "camera's track",
+            Box::new(move |p| {
+                let camera = Camera { name: "Cam 1".into(), video_track: Some(TrackId(BIG)), audio_tracks: Vec::new(), enabled: true, source: None };
+                p.sequence_mut(seq).unwrap().multicam = Some(MulticamSource { cameras: vec![camera], ..Default::default() });
+            }),
+        ),
+        ("merged clip", Box::new(move |p| p.sequence_mut(seq).unwrap().merged = Some(MergedClip { audio: vec![ItemId(BIG)], ..Default::default() }))),
+    ];
+    for (kind, add) in &kinds {
+        let mut p = base.clone();
+        add(&mut p);
+        p.next_id = 1;
+        let loaded = decode(&encode(&p, false)).unwrap_or_else(|e| panic!("{kind}: {e}"));
+        assert_eq!(loaded.project.next_id, BIG + 1, "{kind}");
+    }
+}
+
+/// #2809: the case the issue describes. A file whose `next_id` names an item already in it: the next
+/// new item used to take that id and replace the item. It gets a fresh id, and both are still there
+/// after a save and a reload.
+#[test]
+fn a_new_item_never_replaces_one_from_a_file_with_a_stale_next_id() {
+    let mut p = decode(&fixture("v1-edit.fcproj")).unwrap().project;
+    p.next_id = 5;
+    let mut p = decode(&encode(&p, false)).unwrap().project;
+    let before = p.items.len();
+    let kind = p.item(ItemId(5)).unwrap().kind.clone();
+    let new = p.add_item("Copy", filmcraft_project::Label::Iris, kind, None);
+    assert_ne!(new, ItemId(5));
+    assert_eq!(p.items.len(), before + 1, "a new item replaced an old one");
+    assert_eq!(p.item(ItemId(5)).unwrap().name, "Ocean_Sunset.mp4");
+    let again = decode(&encode(&p, false)).unwrap().project;
+    assert_eq!(again, p, "the round trip keeps both items and the raised next_id");
+    assert!(again.next_id > new.0);
+}
+
+/// #2809: ids past what can ever be allocated. The largest possible id has no successor, and a
+/// `next_id` that high overflows `alloc_id`; such a file is refused instead of panicking (debug) or
+/// wrapping to 0 (release) on the first new item.
+#[test]
+fn an_exhausted_id_space_is_refused_on_load() {
+    use filmcraft_project::MarkerId;
+    let base = decode(&fixture("v1-edit.fcproj")).unwrap().project;
+    let mut p = base.clone();
+    p.sequence_mut(ItemId(21)).unwrap().markers[0].id = MarkerId(u64::MAX);
+    let e = decode(&encode(&p, false)).unwrap_err();
+    assert!(matches!(&e, FormatError::Corrupt(m) if m.contains("ID space exhausted")), "{e}");
+    let mut p = base.clone();
+    p.next_id = u64::MAX;
+    let e = decode(&encode(&p, false)).unwrap_err();
+    assert!(matches!(&e, FormatError::Corrupt(m) if m.contains("ID space exhausted")), "{e}");
+    let mut p = base;
+    p.next_id = Project::MAX_NEXT_ID;
+    assert_eq!(decode(&encode(&p, false)).unwrap().project.next_id, Project::MAX_NEXT_ID, "the last usable next_id still opens");
+}
diff --git a/crates/frame/src/lib.rs b/crates/frame/src/lib.rs
index 4be8cfb1f..9c8e643a2 100644
--- a/crates/frame/src/lib.rs
+++ b/crates/frame/src/lib.rs
@@ -139,6 +139,7 @@ impl VideoFrame {
     /// and bit depth unchanged. Reduced-resolution playback hands the GPU this instead of the full
     /// picture (a quarter / sixteenth of the upload). None for RGBA frames or `n` < 2.
     pub fn box_decimated(&self, n: usize) -> Option<VideoFrame> {
+        let n = self.bounded_decimation(n);
         if n < 2 {
             return None;
         }
@@ -285,7 +286,7 @@ impl VideoFrame {
     /// `decode` (a colour-managed curve: log, PQ, HLG scene light…) instead of the frame's
     /// transfer. Float frames are already linear and ignore it.
     pub fn to_linear_f32_decimated_with(&self, n: usize, decode: Option<&DecodeTable>) -> (usize, usize, Vec<f32>) {
-        let n = n.max(1);
+        let n = self.bounded_decimation(n);
         let (ow, oh) = self.decimated_size(n);
         // every element is written below, so a recycled buffer needs no zero-fill
         let mut out = pool::take_f32_overwritten(ow * oh * 4);
@@ -295,7 +296,7 @@ impl VideoFrame {
 
     /// The size of the picture after `n`×`n` box decimation.
     pub fn decimated_size(&self, n: usize) -> (usize, usize) {
-        let n = n.max(1);
+        let n = self.bounded_decimation(n);
         ((self.width as usize / n).max(1), (self.height as usize / n).max(1))
     }
 
@@ -304,7 +305,7 @@ impl VideoFrame {
     /// by row. Each pixel is exactly what the full conversion gives at that position. The buffer
     /// may come from the pool ([`pool::recycle_f32`] hands it back).
     pub fn to_linear_f32_region(&self, n: usize, decode: Option<&DecodeTable>, region: Region) -> (Region, Vec<f32>) {
-        let n = n.max(1);
+        let n = self.bounded_decimation(n);
         let (ow, oh) = self.decimated_size(n);
         let r = region.clip(ow, oh);
         let mut out = pool::take_f32_overwritten(r.w * r.h * 4);
@@ -323,6 +324,7 @@ impl VideoFrame {
             out.fill(0.0);
             return;
         }
+        let n = n.min(w.max(h)).max(1);
         if let PixelData::RgbaF32(d) = &self.data
             && n == 1
         {
@@ -343,7 +345,7 @@ impl VideoFrame {
             Some(t) => t.lookup(v),
             None => lin[(v.clamp(0.0, 1.0) * 4095.0 + 0.5) as usize],
         };
-        let inv = 1.0 / (n * n) as f32;
+        let inv = 1.0 / (n as f32 * n as f32);
         match &self.data {
             PixelData::RgbaF32(d) => {
                 out.par_chunks_mut(r.w * 4).enumerate().for_each(|(ry, row)| {
@@ -440,6 +442,13 @@ impl VideoFrame {
                 let cw = w.div_ceil(1 << sx);
                 let bits = *bits;
                 let amax = ((1u32 << bits) - 1) as f32;
+                // Per-code tables (exactly the values `normalize_*` returns) instead of two
+                // divisions per sample; a code past the table (a corrupt plane) is computed.
+                let codes = if bits <= 12 { 1usize << bits } else { 0 };
+                let ytab: Vec<f32> = (0..codes as u32).map(|v| normalize_y(v, bits, info.range)).collect();
+                let ctab: Vec<f32> = (0..codes as u32).map(|v| normalize_c(v, bits, info.range)).collect();
+                let ny = |v: u16| ytab.get(usize::from(v)).copied().unwrap_or_else(|| normalize_y(u32::from(v), bits, info.range));
+                let nc = |v: u16| ctab.get(usize::from(v)).copied().unwrap_or_else(|| normalize_c(u32::from(v), bits, info.range));
                 out.par_chunks_mut(r.w * 4).enumerate().for_each(|(ry, row)| {
                     let oy = r.y + ry;
                     for rx in 0..r.w {
@@ -451,9 +460,9 @@ impl VideoFrame {
                             for dx in 0..n {
                                 let x = (ox * n + dx).min(w - 1);
                                 let cx = x >> sx;
-                                let yy = normalize_y(planes[0][y * w + x] as u32, bits, info.range);
-                                let u = normalize_c(planes[1][cy * cw + cx] as u32, bits, info.range);
-                                let v = normalize_c(planes[2][cy * cw + cx] as u32, bits, info.range);
+                                let yy = ny(planes[0][y * w + x]);
+                                let u = nc(planes[1][cy * cw + cx]);
+                                let v = nc(planes[2][cy * cw + cx]);
                                 let rgb = ycbcr_to_rgb(yy, u, v, info.matrix);
                                 let a = alpha.as_ref().map_or(1.0, |al| al[y * w + x] as f32 / amax);
                                 acc[0] += q(rgb[0]) * a;
@@ -477,7 +486,7 @@ impl VideoFrame {
     /// or its alpha is not stored as integers), so nothing can be skipped. Pixels outside the
     /// rectangle have alpha exactly 0 and, in the premultiplied conversion, colour 0 as well.
     pub fn alpha_region(&self, n: usize) -> Option<Region> {
-        let n = n.max(1);
+        let n = self.bounded_decimation(n);
         let (w, h) = (self.width as usize, self.height as usize);
         let px = w.checked_mul(h)?;
         // the first and last x of non-transparent pixels in source row `y`
@@ -502,6 +511,12 @@ impl VideoFrame {
         Some(Region { x: rx0, y: ry0, w: rx1.saturating_sub(rx0), h: ry1.saturating_sub(ry0) }.clip(ow, oh))
     }
 
+    /// Keep hostile decimation requests from doing work beyond the source picture.  Larger boxes
+    /// only resample the edge pixels, so clamping them has no useful effect on the reduced output.
+    fn bounded_decimation(&self, n: usize) -> usize {
+        n.clamp(1, (self.width as usize).max(self.height as usize).max(1))
+    }
+
     /// Convert to straight-alpha sRGB RGBA8 for display (fast paths for 8-bit sources).
     pub fn to_rgba8(&self) -> Vec<u8> {
         let (w, h) = (self.width as usize, self.height as usize);
@@ -830,6 +845,24 @@ mod tests {
         assert!(f.box_decimated(1).is_none());
         assert!(VideoFrame::rgba8(2, 2, vec![0; 16]).box_decimated(2).is_none());
     }
+
+    #[test]
+    fn decimation_caps_hostile_factors_to_the_frame_size() {
+        let rgba = VideoFrame::rgba8(1, 1, vec![23, 42, 99, 255]);
+        let (w, h, pixels) = rgba.to_linear_f32_decimated(usize::MAX);
+        assert_eq!((w, h), (1, 1));
+        assert_eq!(pixels, rgba.to_linear_f32());
+
+        let yuv = VideoFrame {
+            width: 2,
+            height: 2,
+            data: PixelData::Yuv8 { planes: [Arc::new(vec![1, 2, 3, 4]), Arc::new(vec![128]), Arc::new(vec![128])], chroma: Chroma::C420, alpha: None },
+            color: ColorInfo::REC709,
+            par: (1, 1),
+            pts: Tick::ZERO,
+        };
+        assert_eq!(yuv.box_decimated(usize::MAX).expect("yuv").luma8(), vec![3]);
+    }
     use super::*;
 
     #[test]
diff --git a/crates/golden/Cargo.toml b/crates/golden/Cargo.toml
index fc14d15de..b5d01991f 100644
--- a/crates/golden/Cargo.toml
+++ b/crates/golden/Cargo.toml
@@ -24,5 +24,5 @@ filmcraft-media = { workspace = true }
 filmcraft-project = { workspace = true }
 filmcraft-render = { workspace = true }
 filmcraft-gpu = { workspace = true }
-pollster = "0.4"
+pollster = "1"
 wgpu = { version = "30", features = ["wgsl", "metal", "vulkan", "dx12", "gles"] }
diff --git a/crates/gpu/Cargo.toml b/crates/gpu/Cargo.toml
index 3f6137f5b..e8425b8bf 100644
--- a/crates/gpu/Cargo.toml
+++ b/crates/gpu/Cargo.toml
@@ -18,11 +18,11 @@ filmcraft-render = { workspace = true }
 filmcraft-time = { workspace = true }
 wgpu = { version = "30", default-features = false, features = ["wgsl"] }
 log = { workspace = true }
-pollster = "0.4"
+pollster = "1"
 rayon = { workspace = true }
 
 [dev-dependencies]
-pollster = "0.4"
+pollster = "1"
 filmcraft-export = { workspace = true }
 image = { version = "0.25", default-features = false, features = ["png"] }
 wgpu = { version = "30", features = ["wgsl", "metal", "vulkan", "dx12", "gles"] }
diff --git a/crates/gpu/src/blend_tests.rs b/crates/gpu/src/blend_tests.rs
index a21c5a2b7..028ceb5ec 100644
--- a/crates/gpu/src/blend_tests.rs
+++ b/crates/gpu/src/blend_tests.rs
@@ -151,7 +151,8 @@ fn gpu_blend_modes_match_cpu() {
         1.0,
         24,
         filmcraft_time::FrameRate::FPS_24,
-    );
+    )
+    .unwrap();
     let demo = Arc::new(VideoFrame::rgba8(320, 180, pixels));
     let base = ramp_layer(200, 180, 3);
     let top = ramp_layer(160, 120, 0);
diff --git a/crates/gpu/src/tests.rs b/crates/gpu/src/tests.rs
index 034333ee3..ff7dc97c3 100644
--- a/crates/gpu/src/tests.rs
+++ b/crates/gpu/src/tests.rs
@@ -116,7 +116,8 @@ fn gpu_matches_cpu_plan() {
         1.0,
         24,
         filmcraft_time::FrameRate::FPS_24,
-    );
+    )
+    .unwrap();
     let rgba = Arc::new(VideoFrame::rgba8(320, 180, pixels));
     let (w, h) = (320usize, 180usize);
     let plan = FramePlan::Layers {
@@ -464,7 +465,8 @@ fn gpu_draws_yuv_alpha_plane_like_the_cpu() {
         1.0,
         24,
         filmcraft_time::FrameRate::FPS_24,
-    );
+    )
+    .unwrap();
     let background = Arc::new(VideoFrame::rgba8(320, 180, pixels));
     for bits in [8, 10, 12] {
         let mut c = GpuCompositor::new(&dev, &q);
diff --git a/crates/h264/README.md b/crates/h264/README.md
index 21e7a10f1..634a2977f 100644
--- a/crates/h264/README.md
+++ b/crates/h264/README.md
@@ -108,7 +108,7 @@ with ffmpeg + libx264; tests print a message and skip when `/opt/homebrew/bin/ff
   explicit bi-prediction. The expected output is known exactly and is also checked against ffmpeg.
 - Robustness: avcC input with pts round trip; randomly corrupted, truncated and garbage input never
   panics or deadlocks (single- and multi-threaded).
-- Conformance (`tests/conformance.rs`): every fixture is decoded single-threaded, with 3 threads
+- Conformance (`tests/it/conformance.rs`): every fixture is decoded single-threaded, with 3 threads
   and with every core, and compared byte-for-byte with `ffmpeg -f rawvideo -pix_fmt yuv420p`; on
   mismatch the first differing frame, plane, sample position and macroblock are reported. Output
   pts/POC order is checked too, and that no picture is flagged draft without draft mode. Draft
@@ -164,12 +164,12 @@ encoder is unavailable.
 | vt_high | testsrc2+noise 640x360 | VideoToolbox, High |
 | vt_high_1080p | testsrc2 1920x1080 | VideoToolbox, High 8 Mbit/s |
 
-`cargo test --release -p filmcraft-h264 --test conformance coverage_report -- --ignored --nocapture`
+`cargo test --release -p filmcraft-h264 --test it conformance::coverage_report -- --ignored --nocapture`
 prints which coding tools each fixture exercises.
 
 ## Performance
 
-`cargo test --release -p filmcraft-h264 --test perf -- --ignored --nocapture` (1080p High profile,
+`cargo test --release -p filmcraft-h264 --test it perf:: -- --ignored --nocapture` (1080p High profile,
 CABAC, B-pyramid, 120 frames, 8.8 Mbit/s; bit-exactness is verified first). Measured on an Apple M4
 Pro (14 cores) while the machine was heavily shared (load average 40-180), so these are lower bounds:
 
diff --git a/crates/h264/src/deblock.rs b/crates/h264/src/deblock.rs
index ba50be414..063e83e8f 100644
--- a/crates/h264/src/deblock.rs
+++ b/crates/h264/src/deblock.rs
@@ -232,7 +232,7 @@ fn filter_vertical<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y: u
     let mut w = [0u64; N];
     for (i, w) in w.iter_mut().enumerate() {
         let o = (y + i) * stride + x - 4;
-        let Some(&b) = pix.get(o..).and_then(|p| p.first_chunk::<8>()) else {
+        let Some(&b) = pix.get(o..).and_then(<[u8]>::first_chunk::<8>) else {
             return;
         };
         *w = u64::from_le_bytes(b);
@@ -259,7 +259,7 @@ fn filter_horizontal<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y:
     let base = (y - 4) * stride + x;
     let mut s = [[0i16; N]; 8];
     for (k, row) in s.iter_mut().enumerate() {
-        let Some(src) = pix.get(base + k * stride..).and_then(|p| p.first_chunk::<N>()) else {
+        let Some(src) = pix.get(base + k * stride..).and_then(<[u8]>::first_chunk::<N>) else {
             return;
         };
         for i in 0..N {
@@ -269,7 +269,7 @@ fn filter_horizontal<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y:
     filter_lanes(&mut s, ep, chroma);
     let (k0, k1) = if chroma { (3, 5) } else { (1, 7) };
     for (k, row) in s.iter().enumerate().take(k1).skip(k0) {
-        let Some(dst) = pix.get_mut(base + k * stride..).and_then(|p| p.first_chunk_mut::<N>()) else {
+        let Some(dst) = pix.get_mut(base + k * stride..).and_then(<[u8]>::first_chunk_mut::<N>) else {
             return;
         };
         for i in 0..N {
diff --git a/crates/h264/src/decoder.rs b/crates/h264/src/decoder.rs
index 59070d359..135ebfa59 100644
--- a/crates/h264/src/decoder.rs
+++ b/crates/h264/src/decoder.rs
@@ -18,6 +18,10 @@ use filmcraft_bitstream::{BitReader, annexb_nals, length_prefixed_nals, unescape
 use std::collections::VecDeque;
 use std::sync::{Arc, Mutex};
 
+/// The decoder supports at most 16 reference pictures, so constructing more
+/// inferred gap pictures cannot improve a usable reference list.
+const MAX_INFERRED_GAP_FRAMES: u32 = 16;
+
 /// One slice of a picture job.
 struct SliceJob {
     sh: SliceHeader,
@@ -234,7 +238,7 @@ impl Decoder {
             }
         }
         // The access unit is complete: hand its picture to a decoding job.
-        self.submit_pending();
+        self.submit_pending()?;
         if let Some(e) = self.take_error() {
             result = result.and(Err(e));
         }
@@ -254,7 +258,7 @@ impl Decoder {
 
     /// Output all remaining pictures (end of stream).
     pub fn flush(&mut self) -> Vec<Picture> {
-        self.submit_pending();
+        let _ = self.submit_pending();
         let mut outs = Vec::new();
         self.dpb.flush(&mut outs);
         self.emit(outs);
@@ -304,7 +308,7 @@ impl Decoder {
             nal_type::SLICE_DPA | nal_type::SLICE_DPB | nal_type::SLICE_DPC => {
                 return unsupported("data partitioning (Extended profile)");
             }
-            nal_type::END_SEQ | nal_type::END_STREAM => self.submit_pending(),
+            nal_type::END_SEQ | nal_type::END_STREAM => self.submit_pending()?,
             // SEI, AUD, filler, SPS extension, prefix NAL, subset SPS, auxiliary and extension slices: skipped.
             _ => {}
         }
@@ -353,7 +357,7 @@ impl Decoder {
             Some(p) => is_new_picture(&p.first, &sh, &sps) || sh.first_mb_in_slice == 0 || !Arc::ptr_eq(&p.sps, &sps),
         };
         if new_pic {
-            self.submit_pending();
+            self.submit_pending()?;
             if sh.first_mb_in_slice != 0 && self.active_sps.is_none() {
                 return invalid("stream does not start with the first slice of a picture");
             }
@@ -425,6 +429,10 @@ impl Decoder {
         } else {
             let max = sps.max_frame_num();
             if sh.frame_num != self.prev_ref_frame_num && sh.frame_num != (self.prev_ref_frame_num + 1) % max {
+                let gap = (sh.frame_num + max - self.prev_ref_frame_num - 1) % max;
+                if gap > MAX_INFERRED_GAP_FRAMES {
+                    return Err(Error::Invalid("frame number gap exceeds the supported reference limit".into()));
+                }
                 // frame_num gap (8.2.5.2): insert "non-existing" frames. Their samples are never used by
                 // conforming streams; copy the latest decoded frame for concealment.
                 let meta = Arc::new(output_meta(sps, pts, false));
@@ -464,8 +472,8 @@ impl Decoder {
     }
 
     /// Start decoding the pending picture and do its reference marking / DPB insertion.
-    fn submit_pending(&mut self) {
-        let Some(p) = self.pending.take() else { return };
+    fn submit_pending(&mut self) -> Result<()> {
+        let Some(p) = self.pending.take() else { return Ok(()) };
         let PendingPic { frame, sps, first, poc, pts, key, slices } = p;
         let draft = self.draft && first.nal_ref_idc == 0;
         self.dispatch(frame.clone(), slices, draft);
@@ -476,8 +484,9 @@ impl Decoder {
         let meta = Arc::new(OutputMeta { draft, ..output_meta(&sps, pts, key) });
         let mut outs = Vec::new();
         let fpoc = frame.poc;
-        self.dpb.store_picture(&first, frame, fpoc, sps.max_frame_num(), sps.max_num_ref_frames as usize, meta, &mut outs);
+        self.dpb.store_picture(&first, frame, fpoc, sps.max_frame_num(), sps.max_num_ref_frames as usize, meta, &mut outs)?;
         self.emit(outs);
+        Ok(())
     }
 
     fn dispatch(&mut self, frame: FrameRef, slices: Vec<SliceJob>, draft: bool) {
diff --git a/crates/h264/src/dpb.rs b/crates/h264/src/dpb.rs
index 657aa411a..c712b0424 100644
--- a/crates/h264/src/dpb.rs
+++ b/crates/h264/src/dpb.rs
@@ -138,8 +138,19 @@ impl<F: Clone> Dpb<F> {
         poc_state: &mut dyn FnMut(u32),
     ) {
         let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
+        // Missing frames before the last `max_num_ref_frames` would be dropped by the sliding window
+        // (oldest FrameNumWrap first) before the gap ends, so only their POC / frame_num bookkeeping
+        // runs; building pictures for them would cost up to max_frame_num frames per access unit.
+        let gap = if frame_num >= unused { frame_num - unused } else { (frame_num % max_frame_num) + max_frame_num - unused };
+        let skip = gap.saturating_sub(max_num_ref_frames.max(1).try_into().unwrap_or(u32::MAX));
         let mut guard = 0;
         while unused != frame_num && guard < max_frame_num {
+            if guard < skip {
+                poc_state(unused);
+                unused = (unused + 1) % max_frame_num;
+                guard += 1;
+                continue;
+            }
             self.sliding_window(unused, max_frame_num, max_num_ref_frames);
             let (frame, poc, meta) = make_frame(unused);
             poc_state(unused);
@@ -260,7 +271,7 @@ impl<F: Clone> Dpb<F> {
     }
 
     /// Adaptive memory control (8.2.5.4). Returns true if MMCO 5 was executed.
-    fn apply_mmcos(&mut self, mmcos: &[Mmco], cur_frame_num: u32, max_frame_num: u32, cur_long: &mut Option<u32>) -> bool {
+    fn apply_mmcos(&mut self, mmcos: &[Mmco], cur_frame_num: u32, max_frame_num: u32, cur_long: &mut Option<u32>) -> Result<bool> {
         let mut had5 = false;
         let curr_pic_num = cur_frame_num as i32;
         for m in mmcos {
@@ -281,6 +292,7 @@ impl<F: Clone> Dpb<F> {
                     }
                 }
                 3 => {
+                    ensure!(self.max_long_term_frame_idx.is_some_and(|max| m.long_term_frame_idx <= max), "MMCO long-term index exceeds the configured limit");
                     let pn = curr_pic_num - (m.difference_of_pic_nums_minus1 as i32 + 1);
                     for e in &mut self.entries {
                         if e.mark == RefMark::Long && e.long_term_frame_idx == m.long_term_frame_idx {
@@ -311,6 +323,7 @@ impl<F: Clone> Dpb<F> {
                     had5 = true;
                 }
                 6 => {
+                    ensure!(self.max_long_term_frame_idx.is_some_and(|max| m.long_term_frame_idx <= max), "MMCO long-term index exceeds the configured limit");
                     for e in &mut self.entries {
                         if e.mark == RefMark::Long && e.long_term_frame_idx == m.long_term_frame_idx {
                             e.mark = RefMark::Unused;
@@ -322,7 +335,7 @@ impl<F: Clone> Dpb<F> {
             }
         }
         self.prune();
-        had5
+        Ok(had5)
     }
 
     /// Reference marking for the just-decoded picture and insertion into the DPB with output bumping.
@@ -337,7 +350,7 @@ impl<F: Clone> Dpb<F> {
         max_num_ref_frames: usize,
         meta: Arc<OutputMeta>,
         out: &mut Vec<Output<F>>,
-    ) {
+    ) -> Result<()> {
         let mut mark = RefMark::Unused;
         let mut long_idx = 0;
         let mut had5 = false;
@@ -353,7 +366,7 @@ impl<F: Clone> Dpb<F> {
             } else {
                 let mut cur_long = None;
                 if sh.adaptive_ref_pic_marking {
-                    had5 = self.apply_mmcos(&sh.mmcos, sh.frame_num, max_frame_num, &mut cur_long);
+                    had5 = self.apply_mmcos(&sh.mmcos, sh.frame_num, max_frame_num, &mut cur_long)?;
                 } else {
                     self.sliding_window(sh.frame_num, max_frame_num, max_num_ref_frames);
                 }
@@ -369,6 +382,9 @@ impl<F: Clone> Dpb<F> {
                 }
             }
         }
+        if mark == RefMark::Long {
+            ensure!(self.num_refs() < max_num_ref_frames.max(1), "long-term reference exceeds max_num_ref_frames");
+        }
         if had5 {
             // All earlier pictures are output before the current one (C.4.4).
             self.flush(out);
@@ -385,7 +401,7 @@ impl<F: Clone> Dpb<F> {
                 let min_poc = self.entries.iter().filter(|e| e.needed_for_output).map(|e| e.poc).min();
                 if min_poc.is_none_or(|m| poc < m) {
                     out.push(Output { frame, poc, meta });
-                    return;
+                    return Ok(());
                 }
                 if !self.bump(out) {
                     break;
@@ -405,6 +421,7 @@ impl<F: Clone> Dpb<F> {
                 break;
             }
         }
+        Ok(())
     }
 }
 
@@ -413,3 +430,68 @@ impl<F: Clone> Default for Dpb<F> {
         Self::new()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn meta() -> Arc<OutputMeta> {
+        Arc::new(OutputMeta {
+            pts: 0,
+            key: false,
+            crop: (0, 0, 0, 0),
+            full_range: false,
+            colour_primaries: 2,
+            transfer_characteristics: 2,
+            matrix_coefficients: 2,
+            sar: (1, 1),
+            draft: false,
+        })
+    }
+
+    /// A huge frame_num jump must only materialise the frames the sliding window keeps (#2779).
+    #[test]
+    fn frame_num_gap_materialises_at_most_max_num_ref_frames() {
+        let mut dpb: Dpb<u32> = Dpb::new();
+        let m = meta();
+        let mut made = 0u32;
+        let mut make = |f: u32| {
+            made += 1;
+            (f, 0, m.clone())
+        };
+        let mut updated = Vec::new();
+        let mut upd = |f: u32| updated.push(f);
+        dpb.fill_frame_num_gap(0, 32768, 1 << 16, 4, &mut make, &mut upd);
+        assert!(made <= 4, "gap fill materialised {made} frames, expected <= 4");
+        assert_eq!(updated, (1..32768).collect::<Vec<u32>>());
+        let mut refs: Vec<u32> = dpb.entries.iter().filter(|e| e.mark == RefMark::Short).map(|e| e.frame_num).collect();
+        refs.sort_unstable();
+        assert_eq!(refs, vec![32764, 32765, 32766, 32767]);
+        assert!(dpb.entries.iter().all(|e| e.frame == e.frame_num));
+    }
+
+    /// Existing short-term references are still evicted by a gap no longer than the window.
+    #[test]
+    fn short_frame_num_gap_keeps_sliding_window_semantics() {
+        let mut dpb: Dpb<u32> = Dpb::new();
+        let m = meta();
+        for f in 0..2 {
+            dpb.entries.push(DpbEntry {
+                frame: f,
+                poc: 0,
+                frame_num: f,
+                long_term_frame_idx: 0,
+                mark: RefMark::Short,
+                needed_for_output: false,
+                non_existing: false,
+                meta: m.clone(),
+            });
+        }
+        let mut make = |f: u32| (f, 0, m.clone());
+        let mut upd = |_f: u32| {};
+        dpb.fill_frame_num_gap(1, 5, 16, 4, &mut make, &mut upd);
+        let mut refs: Vec<u32> = dpb.entries.iter().filter(|e| e.mark == RefMark::Short).map(|e| e.frame_num).collect();
+        refs.sort_unstable();
+        assert_eq!(refs, vec![1, 2, 3, 4]);
+    }
+}
diff --git a/crates/h264/src/params.rs b/crates/h264/src/params.rs
index 5b92a6055..236b7b928 100644
--- a/crates/h264/src/params.rs
+++ b/crates/h264/src/params.rs
@@ -4,6 +4,10 @@ use crate::error::{Result, ensure, unsupported};
 use crate::tables::*;
 use filmcraft_bitstream::BitReader;
 
+/// Maximum supported reconstructed luma area. 8K UHD fits comfortably while
+/// hostile SPS dimensions cannot allocate full pictures and decoder work state.
+const MAX_LUMA_SAMPLES: u64 = 1 << 25;
+
 /// Scaling matrices after applying fall-back rules, stored in raster order (weightScale).
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ScalingMatrices {
@@ -516,6 +520,9 @@ impl Sps {
     }
 
     pub fn check_supported(&self) -> Result<()> {
+        if u64::from(self.width()).saturating_mul(u64::from(self.height())) > MAX_LUMA_SAMPLES {
+            return unsupported("picture dimensions exceed the decoder memory limit");
+        }
         if !self.frame_mbs_only {
             return unsupported("interlaced (field / MBAFF) coding");
         }
diff --git a/crates/h264/src/slicedec.rs b/crates/h264/src/slicedec.rs
index da0af3316..2d6e3c6da 100644
--- a/crates/h264/src/slicedec.rs
+++ b/crates/h264/src/slicedec.rs
@@ -888,7 +888,7 @@ impl<'a> SliceDecoder<'a> {
         let stride = self.pic.planes.width;
         let px = self.mb_x * 16 + (raster & 3) * 4;
         let py = self.mb_y * 16 + (raster >> 2) * 4;
-        let Some(blk) = self.s.coef.get_mut(raster * 16..).and_then(|c| c.first_chunk_mut::<16>()) else {
+        let Some(blk) = self.s.coef.get_mut(raster * 16..).and_then(<[i32]>::first_chunk_mut::<16>) else {
             return;
         };
         transform::idct4_add(blk, &mut self.pic.planes.y[py * stride + px..], stride);
@@ -902,7 +902,7 @@ impl<'a> SliceDecoder<'a> {
         let stride = self.pic.planes.width;
         let px = self.mb_x * 16 + (b8 & 1) * 8;
         let py = self.mb_y * 16 + (b8 >> 1) * 8;
-        let Some(blk) = self.s.coef.get_mut(b8 * 64..).and_then(|c| c.first_chunk_mut::<64>()) else {
+        let Some(blk) = self.s.coef.get_mut(b8 * 64..).and_then(<[i32]>::first_chunk_mut::<64>) else {
             return;
         };
         transform::idct8_add(blk, &mut self.pic.planes.y[py * stride + px..], stride);
@@ -921,7 +921,7 @@ impl<'a> SliceDecoder<'a> {
                 }
                 let px = self.mb_x * 8 + (b & 1) * 4;
                 let py = self.mb_y * 8 + (b >> 1) * 4;
-                let Some(blk) = self.s.coef_c[c].get_mut(b * 16..).and_then(|c| c.first_chunk_mut::<16>()) else {
+                let Some(blk) = self.s.coef_c[c].get_mut(b * 16..).and_then(<[i32]>::first_chunk_mut::<16>) else {
                     continue;
                 };
                 let plane = if c == 0 { &mut self.pic.planes.cb } else { &mut self.pic.planes.cr };
diff --git a/crates/h264/tests/fuzz_hostile.rs b/crates/h264/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..476683a39
--- /dev/null
+++ b/crates/h264/tests/fuzz_hostile.rs
@@ -0,0 +1,202 @@
+//! Hostile-input robustness: header-region sweeps (SPS/PPS/first slice headers), truncation and
+//! random mutation of small libx264 streams must never panic or run away. Skips without ffmpeg.
+
+#[path = "it/common/mod.rs"]
+mod common;
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::{Command, Stdio};
+
+use filmcraft_h264::Decoder;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+/// (name, extra x264 args, pix_fmt)
+const SEEDS: &[(&str, &str, &str)] = &[
+    ("h264_fz_cabac_b", "-profile:v high -bf 2 -g 8 -x264-params cabac=1:weightp=2:8x8dct=1", "yuv420p"),
+    ("h264_fz_cavlc", "-profile:v baseline -g 6 -x264-params cabac=0", "yuv420p"),
+    ("h264_fz_interlaced", "-profile:v high -flags +ildct+ilme -bf 1 -g 6 -x264-params tff=1:interlaced=1", "yuv420p"),
+    ("h264_fz_10bit_422", "-profile:v high422 -bf 1 -g 6", "yuv422p10le"),
+    ("h264_fz_multislice", "-profile:v main -g 6 -x264-params slices=3:cabac=1", "yuv420p"),
+];
+
+fn make(ff: &std::path::Path, name: &str, args: &str, pix: &str) -> Option<Vec<u8>> {
+    let out = filmcraft_testkit::fixtures_dir("h264").join(format!("{name}.h264"));
+    let p = filmcraft_testkit::fixtures::generate(&out, |tmp| {
+        let a: Vec<&str> = args.split_whitespace().collect();
+        matches!(
+            Command::new(ff)
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=25", "-frames:v", "7", "-pix_fmt", pix, "-c:v", "libx264"])
+                .args(a)
+                .args(["-f", "h264"])
+                .arg(tmp)
+                .stdin(Stdio::null())
+                .status(),
+            Ok(s) if s.success()
+        )
+    })?;
+    std::fs::read(p).ok()
+}
+
+static PANICS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+/// Decoder worker threads catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(std::sync::atomic::Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for threads in [1, 3] {
+            let mut dec = Decoder::with_threads(threads);
+            for au in common::split_access_units(d) {
+                let _ = dec.decode(au, 0);
+            }
+            let _ = dec.decode(d, 1);
+            let _ = dec.flush();
+            let _ = dec.take_error();
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(std::sync::atomic::Ordering::SeqCst) == before, "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+/// CI runs a rotating share of every part of the sweep; `FILMCRAFT_FUZZ_ITERS=400` runs all of it (see [`Depth`]).
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("h264 fuzz") else { return };
+    let depth = Depth::from_env();
+    for &(name, args, pix) in SEEDS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, "libx264") {
+            filmcraft_testkit::skip("h264 fuzz", &format!("this ffmpeg has no libx264 encoder (seed {name})"));
+            continue;
+        }
+        let Some(seed) = make(&ff, name, args, pix) else {
+            panic!("ffmpeg has libx264 but could not encode the {name} seed");
+        };
+        for n in depth.truncations(seed.len()) {
+            run_all(&seed[..n], &format!("{name} truncate {n}"));
+        }
+        header_flips(&depth, &seed, name);
+        random_rounds(&depth, &seed, name);
+    }
+}
+
+/// SPS/PPS/first slice header region: every byte to a few values, every bit.
+fn header_flips(depth: &Depth, seed: &[u8], name: &str) {
+    for p in 0..seed.len().min(120) {
+        for (i, v) in VALUES.into_iter().enumerate() {
+            if !depth.value(p, i) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] = v;
+            run_all(&d, &format!("{name} byte {p}={v:#x}"));
+        }
+        for b in 0..8 {
+            if !depth.bit(p, b) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] ^= 1 << b;
+            run_all(&d, &format!("{name} flip {p}.{b}"));
+        }
+    }
+}
+
+fn random_rounds(depth: &Depth, seed: &[u8], name: &str) {
+    let mut rng = Rng(0x9e3779b97f4a7c15 ^ name.len() as u64);
+    // Skipped rounds still draw their mutations, so round i matches round i of a full run.
+    for i in 0..depth.rounds {
+        let mut d = seed.to_vec();
+        for _ in 0..1 + rng.below(6) {
+            let p = rng.below(d.len());
+            if rng.below(2) == 0 {
+                d[p] ^= 1 << rng.below(8);
+            } else {
+                d[p] = rng.next() as u8;
+            }
+        }
+        if depth.round(i) {
+            run_all(&d, &format!("{name} random {i}"));
+        }
+    }
+}
+
+const VALUES: [u8; 5] = [0, 0xff, 0x80, 0x01, 0x7f];
+
+/// How much of the sweep runs. `FILMCRAFT_FUZZ_ITERS=N` runs all of it (about 300 truncation
+/// points spread over each seed, every header byte, overwrite value and bit flip) plus N random
+/// rounds per seed: 400 is the full depth, more hunts longer. Unset, CI runs a third of the
+/// truncation points and of the full depth's random rounds and, for each header byte, one value
+/// and two bits. A rotation offset shifts which share runs (`FILMCRAFT_FUZZ_SEED`, else the UTC
+/// day number), so every case of the full sweep runs within a few days, and a random round's
+/// mutations match the same round of a full run.
+struct Depth {
+    full: bool,
+    truncations: usize,
+    rounds: usize,
+    rotation: usize,
+}
+
+impl Depth {
+    fn from_env() -> Self {
+        match std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()) {
+            Some(rounds) => Depth { full: true, truncations: 300, rounds, rotation: 0 },
+            None => {
+                let rotation = rotation();
+                eprintln!("fuzz subset rotation {rotation} (FILMCRAFT_FUZZ_SEED={rotation} replays it; FILMCRAFT_FUZZ_ITERS=400 runs everything)");
+                Depth { full: false, truncations: 300, rounds: 400, rotation }
+            }
+        }
+    }
+    /// Truncation lengths for a `len`-byte input: every point of the full sweep, or every third one.
+    fn truncations(&self, len: usize) -> std::iter::StepBy<std::ops::Range<usize>> {
+        let stride = (len / self.truncations).max(1);
+        let (start, step) = if self.full { (0, stride) } else { ((self.rotation % 3) * stride, 3 * stride) };
+        (start..len).step_by(step)
+    }
+    fn value(&self, p: usize, i: usize) -> bool {
+        self.full || i == (p + self.rotation % VALUES.len()) % VALUES.len()
+    }
+    fn bit(&self, p: usize, b: usize) -> bool {
+        self.full || (b + p + self.rotation % 4).is_multiple_of(4)
+    }
+    fn round(&self, i: usize) -> bool {
+        self.full || i % 3 == self.rotation % 3
+    }
+}
+
+/// The default subset's rotation offset: `FILMCRAFT_FUZZ_SEED`, else days since the Unix epoch (UTC).
+fn rotation() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or_else(|| {
+        let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        usize::try_from(secs / 86_400).unwrap_or(0)
+    })
+}
diff --git a/crates/h264/tests/common/mod.rs b/crates/h264/tests/it/common/mod.rs
similarity index 99%
rename from crates/h264/tests/common/mod.rs
rename to crates/h264/tests/it/common/mod.rs
index e100c3289..2de4d62d2 100644
--- a/crates/h264/tests/common/mod.rs
+++ b/crates/h264/tests/it/common/mod.rs
@@ -64,7 +64,7 @@ pub const FIXTURES: &[Fixture] = &[
         filter: "",
         args: &["-c:v", "h264_videotoolbox", "-profile:v", "high", "-b:v", "8M"],
     },
-    // performance reference stream (see tests/perf.rs)
+    // performance reference stream (see tests/it/perf.rs)
     Fixture {
         name: "bench_1080p",
         source: "testsrc2",
diff --git a/crates/h264/tests/conformance.rs b/crates/h264/tests/it/conformance.rs
similarity index 99%
rename from crates/h264/tests/conformance.rs
rename to crates/h264/tests/it/conformance.rs
index c06694b79..a55d9fe40 100644
--- a/crates/h264/tests/conformance.rs
+++ b/crates/h264/tests/it/conformance.rs
@@ -1,6 +1,6 @@
 //! Bit-exactness against ffmpeg's decoder on libx264-generated fixtures (skipped when ffmpeg is absent).
 
-mod common;
+use crate::common;
 
 macro_rules! fixture_tests {
     ($($name:ident),* $(,)?) => {
diff --git a/crates/h264/tests/headers.rs b/crates/h264/tests/it/headers.rs
similarity index 99%
rename from crates/h264/tests/headers.rs
rename to crates/h264/tests/it/headers.rs
index f0f7a59e3..f27a7ed01 100644
--- a/crates/h264/tests/headers.rs
+++ b/crates/h264/tests/it/headers.rs
@@ -1,6 +1,6 @@
 //! Parameter set / slice header / POC parsing over the fixture streams.
 
-mod common;
+use crate::common;
 
 use filmcraft_bitstream::{annexb_nals, unescape_rbsp};
 use filmcraft_h264::params::{Pps, Sps};
diff --git a/crates/h264/tests/it/main.rs b/crates/h264/tests/it/main.rs
new file mode 100644
index 000000000..ceefd95be
--- /dev/null
+++ b/crates/h264/tests/it/main.rs
@@ -0,0 +1,6 @@
+mod common;
+mod conformance;
+mod headers;
+mod perf;
+mod pps_validation;
+mod robustness;
diff --git a/crates/h264/tests/perf.rs b/crates/h264/tests/it/perf.rs
similarity index 91%
rename from crates/h264/tests/perf.rs
rename to crates/h264/tests/it/perf.rs
index c8ed4beb8..da744c24b 100644
--- a/crates/h264/tests/perf.rs
+++ b/crates/h264/tests/it/perf.rs
@@ -1,7 +1,7 @@
 //! Decode speed on a 1080p High-profile stream (ignored by default; run with
-//! `cargo test --release -p filmcraft-h264 --test perf -- --ignored --nocapture`).
+//! `cargo test --release -p filmcraft-h264 --test it perf:: -- --ignored --nocapture`).
 
-mod common;
+use crate::common;
 
 use filmcraft_h264::Decoder;
 use std::time::Instant;
diff --git a/crates/h264/tests/pps_validation.rs b/crates/h264/tests/it/pps_validation.rs
similarity index 100%
rename from crates/h264/tests/pps_validation.rs
rename to crates/h264/tests/it/pps_validation.rs
diff --git a/crates/h264/tests/robustness.rs b/crates/h264/tests/it/robustness.rs
similarity index 99%
rename from crates/h264/tests/robustness.rs
rename to crates/h264/tests/it/robustness.rs
index 902ab191d..898d50bef 100644
--- a/crates/h264/tests/robustness.rs
+++ b/crates/h264/tests/it/robustness.rs
@@ -1,6 +1,6 @@
 //! avcC / length-prefixed input and resilience against damaged streams.
 
-mod common;
+use crate::common;
 
 use filmcraft_bitstream::annexb_nals;
 use filmcraft_h264::Decoder;
diff --git a/crates/h264enc/examples/h264enc_synth.rs b/crates/h264enc/examples/h264enc_synth.rs
index 15ab55fd9..3d1b25f4c 100644
--- a/crates/h264enc/examples/h264enc_synth.rs
+++ b/crates/h264enc/examples/h264enc_synth.rs
@@ -2,7 +2,7 @@
 //!
 //! `cargo run --release -p filmcraft-h264enc --example h264enc_synth -- W H FRAMES [profile] [preset] [bframes] [rate] [slices] [src]`
 //! profile: baseline|main|high, preset: speed|balanced|quality, rate: qpN | crfN | cbrN | vbrN
-#[path = "../tests/common/mod.rs"]
+#[path = "../tests/it/common/mod.rs"]
 mod common;
 
 use filmcraft_h264enc::*;
diff --git a/crates/h264enc/src/ratecontrol.rs b/crates/h264enc/src/ratecontrol.rs
index 9f77a6813..0fb27216c 100644
--- a/crates/h264enc/src/ratecontrol.rs
+++ b/crates/h264enc/src/ratecontrol.rs
@@ -81,7 +81,7 @@ pub enum RcKind {
     Qp(u8),
     Crf(f32),
     Abr { kbps: u32 },
-    TwoPass { kbps: u32, plan: Vec<f64>, planned_bits: Vec<f64> },
+    TwoPass { kbps: u32, plan: Vec<f64>, planned_bits: Vec<f64>, planned_total: f64, remaining_bits: Vec<f64> },
 }
 
 pub struct RateControl {
@@ -153,8 +153,15 @@ impl RateControl {
             }
         }
         let plan = qs((0.5 * (lo + hi)).exp());
-        let planned_bits = stats.frames.iter().zip(&plan).map(|(f, &q)| f.bits as f64 * f.qscale / q).collect();
-        RcKind::TwoPass { kbps, plan, planned_bits }
+        let planned_bits: Vec<f64> = stats.frames.iter().zip(&plan).map(|(f, &q)| f.bits as f64 * f.qscale / q).collect();
+        let planned_total = planned_bits.iter().sum();
+        // `remaining_bits[i]` is the inclusive suffix for frame `i`; retain an
+        // empty suffix so callers can index it without a special case.
+        let mut remaining_bits = vec![0.0; planned_bits.len() + 1];
+        for i in (0..planned_bits.len()).rev() {
+            remaining_bits[i] = remaining_bits[i + 1] + planned_bits[i];
+        }
+        RcKind::TwoPass { kbps, plan, planned_bits, planned_total, remaining_bits }
     }
 
     /// Choose the frame QP (fractional) for frame `index` (display order) of `t` with lookahead complexity `cplx`.
@@ -198,17 +205,17 @@ impl RateControl {
                 let q = rf * cplx.powf(1.0 - QCOMP) * type_factor(t);
                 qscale2qp(q)
             }
-            RcKind::TwoPass { kbps, plan, planned_bits } => {
+            RcKind::TwoPass { kbps, plan, planned_bits, planned_total, remaining_bits } => {
                 // Closed-loop second pass: `m` measures how far real frame sizes deviate from the first-pass model
                 // (bits ∝ 1/qscale) at the qscales actually used; the remaining plan is rescaled so its predicted
                 // size fits the remaining budget.
                 let i = index_in_coding_order.min(plan.len().saturating_sub(1));
                 let bpf = *kbps as f64 * 1000.0 / self.fps;
-                let target_total: f64 = planned_bits.iter().sum();
+                let target_total = *planned_total;
                 let smooth = 0.5 * bpf * self.fps.max(1.0);
                 let m = ((self.total_bits + smooth) / (self.model_done + smooth)).clamp(0.3, 3.0);
                 let inflight: f64 = self.inflight.iter().sum();
-                let remaining_plan: f64 = planned_bits[i..].iter().sum();
+                let remaining_plan = remaining_bits[i];
                 let remaining_budget = (target_total - self.total_bits - m * inflight).max(0.05 * remaining_plan.max(1.0));
                 let f = (m * remaining_plan / remaining_budget).clamp(0.25, 4.0);
                 let q = plan[i] * f;
@@ -271,3 +278,31 @@ impl RateControl {
         self.pass1.push(FrameStat { slice_type: t, qscale: qp2qscale(qp), bits, cplx });
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn two_pass_plan_caches_total_and_inclusive_suffixes() {
+        let stats = PassStats {
+            fps: 24.0,
+            frames: vec![
+                FrameStat { slice_type: SliceType::I, qscale: 1.0, bits: 2_000, cplx: 20.0 },
+                FrameStat { slice_type: SliceType::P, qscale: 1.5, bits: 1_000, cplx: 10.0 },
+                FrameStat { slice_type: SliceType::B, qscale: 2.0, bits: 500, cplx: 5.0 },
+            ],
+        };
+
+        let RcKind::TwoPass { planned_bits, planned_total, remaining_bits, .. } = RateControl::plan_two_pass(&stats, 1_000) else {
+            panic!("two-pass planning must return a two-pass rate-control plan");
+        };
+
+        assert_eq!(remaining_bits.len(), planned_bits.len() + 1);
+        assert!((planned_total - planned_bits.iter().sum::<f64>()).abs() < f64::EPSILON);
+        for i in 0..planned_bits.len() {
+            assert!((remaining_bits[i] - planned_bits[i..].iter().sum::<f64>()).abs() < f64::EPSILON);
+        }
+        assert_eq!(remaining_bits[planned_bits.len()], 0.0);
+    }
+}
diff --git a/crates/h264enc/tests/common/mod.rs b/crates/h264enc/tests/it/common/mod.rs
similarity index 100%
rename from crates/h264enc/tests/common/mod.rs
rename to crates/h264enc/tests/it/common/mod.rs
diff --git a/crates/h264enc/tests/crf_level_and_note.rs b/crates/h264enc/tests/it/crf_level_and_note.rs
similarity index 98%
rename from crates/h264enc/tests/crf_level_and_note.rs
rename to crates/h264enc/tests/it/crf_level_and_note.rs
index b93ebf66b..58306c073 100644
--- a/crates/h264enc/tests/crf_level_and_note.rs
+++ b/crates/h264enc/tests/it/crf_level_and_note.rs
@@ -1,7 +1,7 @@
 //! Constant quality has no bitrate cap, so the level must allow what low factors spend; and every
 //! stream says which settings made it.
 
-mod common;
+use crate::common;
 
 use common::synth;
 use filmcraft_h264enc::*;
diff --git a/crates/h264enc/tests/ffmpeg_oracle.rs b/crates/h264enc/tests/it/ffmpeg_oracle.rs
similarity index 99%
rename from crates/h264enc/tests/ffmpeg_oracle.rs
rename to crates/h264enc/tests/it/ffmpeg_oracle.rs
index e19cfc49b..409bf4102 100644
--- a/crates/h264enc/tests/ffmpeg_oracle.rs
+++ b/crates/h264enc/tests/it/ffmpeg_oracle.rs
@@ -3,7 +3,7 @@
 //! Every stream must decode with zero errors, with the exact frame count, and the decoder's output must be
 //! bit-identical to the encoder's own reconstruction (catches prediction/transform/deblocking mismatches).
 
-mod common;
+use crate::common;
 
 use common::{Yuv, annexb_nals, ffmpeg, ffmpeg_decode, ffmpeg_source, ffprobe, out_dir, psnr, synth};
 use filmcraft_h264enc::*;
diff --git a/crates/h264enc/tests/it/main.rs b/crates/h264enc/tests/it/main.rs
new file mode 100644
index 000000000..f673a96da
--- /dev/null
+++ b/crates/h264enc/tests/it/main.rs
@@ -0,0 +1,3 @@
+mod common;
+mod crf_level_and_note;
+mod ffmpeg_oracle;
diff --git a/crates/hevc/README.md b/crates/hevc/README.md
index 43c266eda..347037d02 100644
--- a/crates/hevc/README.md
+++ b/crates/hevc/README.md
@@ -1,7 +1,7 @@
 # filmcraft-hevc
 
 Clean-room, pure-Rust (no `unsafe`) H.265 / HEVC decoder, implemented from the public ITU-T
-Rec. H.265 (ISO/IEC 23008-2) specification. It is an L0 crate: it depends only on
+Rec. H.265 (08/2021, ISO/IEC 23008-2) specification. It is an L0 crate: it depends only on
 `filmcraft-bitstream`, `thiserror`, and optionally `rayon` (default feature `threads`), and builds
 for `wasm32-unknown-unknown`.
 
@@ -69,6 +69,11 @@ the memory traffic in prediction reads, in-loop filters and output) and as `u16`
 slice decoder and the filters are generic over the sample type (`picture::Sample`), monomorphised
 once per type.
 
+Unavailable references keep distinct frame IDs and POCs while sharing one immutable gray backing
+for the active picture format. This backing is created only when a reference is missing, replaced
+on geometry or plane-depth changes, and released on flush. Jobs still reading an older format keep
+its rows alive. Each backing retains the full coded picture dimensions.
+
 Draft mode (`Decoder::set_draft(true)`; FilmCraft enables it with Settings ▸ Playback ▸ Draft
 decoding while the Program monitor plays at 1/2 or 1/4): sub-layer non-reference pictures
 (TRAIL_N, RASL_N, ...) of the highest temporal sub-layer — no later picture predicts from them,
@@ -96,7 +101,7 @@ with ffmpeg; tests print a message and skip when ffmpeg is absent).
   ffmpeg.
 - Robustness: hvcC input with pts round trip; randomly corrupted, truncated and garbage input never
   panics or deadlocks (single- and multi-threaded).
-- Conformance (`tests/conformance.rs`): every fixture is decoded with 1 thread, 3 threads and every
+- Conformance (`tests/it/conformance.rs`): every fixture is decoded with 1 thread, 3 threads and every
   core and compared sample-exactly with `ffmpeg -f rawvideo -pix_fmt yuv420p / yuv420p10le`; on mismatch
   the first differing frame, plane, sample, CTB and 8x8 block are reported. Output pts/POC order is
   checked too, and that no picture is flagged draft without draft mode. `compare_detects_mismatch`
@@ -135,12 +140,12 @@ libx265 unless noted (x265 enables WPP by default, so most streams carry entry p
 | vt_main / vt_main10 | 640x360 | Apple VideoToolbox (hevc_videotoolbox), macOS only |
 | synthetic (7 streams) | 96x64 | tiles, PCM, slices, dependent segments, LTR, list modification |
 
-`cargo test -p filmcraft-hevc --test conformance coverage_report -- --ignored --nocapture` prints the
+`cargo test -p filmcraft-hevc --test it conformance::coverage_report -- --ignored --nocapture` prints the
 decoder statistics per fixture.
 
 ## Performance
 
-`cargo test --release -p filmcraft-hevc --test perf -- --ignored --nocapture` (bit-exactness is
+`cargo test --release -p filmcraft-hevc --test it perf:: -- --ignored --nocapture` (bit-exactness is
 verified first). Apple M4 Pro (14 cores), measured while the machine was heavily shared (load
 average 50-100), so these are lower bounds:
 
diff --git a/crates/hevc/src/decoder.rs b/crates/hevc/src/decoder.rs
index 97a0fb7f9..f3a56f2d7 100644
--- a/crates/hevc/src/decoder.rs
+++ b/crates/hevc/src/decoder.rs
@@ -77,6 +77,8 @@ pub struct Decoder {
     pending: Option<PendingPic>,
     next_id: u32,
     active_sps: Option<Arc<Sps>>,
+    /// One lazily allocated gray backing for unavailable references in the active format.
+    gray_reference: Option<Frame>,
     first_picture: bool,
     after_eos: bool,
     /// RASL pictures associated with the last IRAP are skipped (it had NoRaslOutputFlag = 1).
@@ -132,6 +134,7 @@ impl Decoder {
             pending: None,
             next_id: 1,
             active_sps: None,
+            gray_reference: None,
             first_picture: true,
             after_eos: false,
             skip_rasl: false,
@@ -225,6 +228,7 @@ impl Decoder {
             f.wait_complete();
         }
         self.first_picture = true;
+        self.gray_reference = None;
         pics
     }
 
@@ -340,6 +344,9 @@ impl Decoder {
         )?;
         sps.check_supported()?;
         pps.check_supported()?;
+        // `start_picture` creates the frame and DPB state. Do not allocate those for a NAL that
+        // contains only a syntactically valid slice header and no CABAC payload.
+        ensure!(sh.data_offset < rbsp.len(), "empty slice segment data");
         if first {
             self.start_picture(&sh, &sps, &pps, pts)?;
         } else {
@@ -389,6 +396,9 @@ impl Decoder {
         if changed && self.active_sps.is_some() {
             self.dpb.flush(&mut outs);
         }
+        if changed {
+            self.gray_reference = None;
+        }
         self.active_sps = Some(sps.clone());
         self.dpb.max_dec_pic_buffering = sps.max_dec_pic_buffering as usize;
         self.dpb.max_num_reorder = sps.max_num_reorder as usize;
@@ -409,12 +419,14 @@ impl Decoder {
         let (w, h) = (sps.width as usize, sps.height as usize);
         let template = Frame::new(0, 0, w, h, sps.log2_ctb, sps.bit_depth_luma, sps.bit_depth_chroma);
         let next_id = &mut self.next_id;
+        let gray_reference = &mut self.gray_reference;
         let mut missing = 0u64;
         let mut make_missing = |p: i32| -> FrameRef {
             missing += 1;
             let id = *next_id;
             *next_id += 1;
-            Arc::new(Frame::gray(id, p, &template))
+            let gray = gray_reference.get_or_insert_with(|| Frame::gray(0, 0, &template));
+            Arc::new(gray.with_identity(id, p))
         };
         let rps = self.dpb.apply_rps(sh, poc, max_lsb, irap_no_rasl, &mut make_missing)?;
         if missing > 0 {
@@ -632,6 +644,141 @@ fn make_picture(o: &Output<FrameRef>) -> Picture {
 mod tests {
     use super::*;
 
+    fn missing_refs(decoder: &mut Decoder, poc: u32, deltas: &[i32]) -> Vec<FrameRef> {
+        let stream = crate::synth_tests::missing_reference_picture(poc, deltas);
+        for nal in annexb_nals(&stream) {
+            decoder.handle_nal(nal, i64::from(poc)).unwrap();
+        }
+        decoder.pending.as_ref().unwrap().rps.st_curr_before.iter().map(|r| r.frame.clone()).collect()
+    }
+
+    fn assert_shared_gray_rows(a: &Frame, b: &Frame) {
+        fn check<S: Sample>(a: &Frame, b: &Frame) {
+            let (gy, gc) = (1u16 << (a.bit_depth - 1), 1u16 << (a.bit_depth_c - 1));
+            for row in 0..a.num_rows() {
+                let a = a.row::<S>(row).unwrap();
+                let b = b.row::<S>(row).unwrap();
+                assert!(a.y.iter().all(|v| v.to_u16() == gy));
+                assert!(a.cb.iter().chain(a.cr.iter()).all(|v| v.to_u16() == gc));
+                assert!(a.col.iter().all(|v| v.flags == 0));
+                assert!(std::ptr::eq(a.y.as_ref(), b.y.as_ref()), "missing references duplicated luma row {row}");
+                assert!(std::ptr::eq(a.cb.as_ref(), b.cb.as_ref()), "missing references duplicated Cb row {row}");
+                assert!(std::ptr::eq(a.cr.as_ref(), b.cr.as_ref()), "missing references duplicated Cr row {row}");
+                assert!(std::ptr::eq(a.col.as_ref(), b.col.as_ref()), "missing references duplicated motion row {row}");
+            }
+        }
+        assert_eq!(a.num_rows(), b.num_rows());
+        assert!(a.is_complete() && b.is_complete());
+        assert_eq!((a.width, a.height, a.log2_ctb, a.bit_depth, a.bit_depth_c), (b.width, b.height, b.log2_ctb, b.bit_depth, b.bit_depth_c));
+        if stores_u8(a.bit_depth, a.bit_depth_c) {
+            check::<u8>(a, b);
+        } else {
+            check::<u16>(a, b);
+        }
+    }
+
+    fn backing(frame: &Frame) -> usize {
+        if stores_u8(frame.bit_depth, frame.bit_depth_c) {
+            frame.row::<u8>(0).unwrap().y.as_ptr() as usize
+        } else {
+            frame.row::<u16>(0).unwrap().y.as_ptr() as usize
+        }
+    }
+
+    #[test]
+    /// Missing references keep their identities while sharing one small immutable gray backing.
+    fn missing_reference_rows_are_shared_with_distinct_identities() {
+        for threads in [1, 4] {
+            let mut decoder = Decoder::with_threads(threads);
+            let refs = missing_refs(&mut decoder, 4, &[-1, -2]);
+            assert_eq!(refs.len(), 2);
+            assert_eq!((refs[0].poc, refs[1].poc), (3, 2));
+            assert_ne!(refs[0].id, refs[1].id);
+            assert_shared_gray_rows(&refs[0], &refs[1]);
+        }
+    }
+
+    #[test]
+    /// Concurrent/pending pictures must not each allocate their own full gray samples.
+    fn missing_reference_rows_are_shared_across_pictures() {
+        for threads in [1, 4] {
+            let mut decoder = Decoder::with_threads(threads);
+            let first = missing_refs(&mut decoder, 4, &[-1, -2]);
+            let second = missing_refs(&mut decoder, 5, &[-2, -3]);
+            assert_eq!((first.len(), second.len()), (2, 2));
+            assert_eq!((second[0].poc, second[1].poc), (3, 2));
+            let ids: std::collections::HashSet<_> = first.iter().chain(second.iter()).map(|f| f.id).collect();
+            assert_eq!(ids.len(), 4);
+            for frame in first.iter().chain(second.iter()) {
+                assert_shared_gray_rows(&first[0], frame);
+            }
+            let pictures = decoder.flush();
+            assert_eq!(pictures.len(), 2);
+            for picture in pictures {
+                assert!(picture.y.as_u8().unwrap().iter().chain(picture.u.as_u8().unwrap()).chain(picture.v.as_u8().unwrap()).all(|&v| v == 128));
+            }
+            assert!(decoder.take_error().is_none());
+            assert_eq!(decoder.stats().missing_refs, 4);
+        }
+    }
+
+    #[test]
+    /// Geometry and independent plane-depth changes replace the cache without invalidating readers.
+    fn missing_reference_cache_tracks_format_and_keeps_old_rows_alive() {
+        let mut decoder = Decoder::with_threads(1);
+        let mut held = missing_refs(&mut decoder, 4, &[-1, -2]);
+        let original = decoder.pending.take().unwrap();
+        let mut previous = (96, 64, 4, 8, 8);
+        let formats = [
+            (96, 64, 4, 8, 8),
+            (128, 64, 4, 8, 8),
+            (128, 32, 4, 8, 8),
+            (128, 32, 5, 8, 8),
+            (128, 32, 5, 10, 8),
+            (128, 32, 5, 10, 10),
+            (128, 32, 5, 8, 10),
+            (128, 32, 5, 8, 8),
+        ];
+        for format in formats {
+            let mut sps = (*original.sps).clone();
+            (sps.width, sps.height, sps.log2_ctb, sps.bit_depth_luma, sps.bit_depth_chroma) = format;
+            decoder.start_picture(&original.first_sh, &Arc::new(sps), &original.pps, 0).unwrap();
+            let pending = decoder.pending.take().unwrap();
+            let refs: Vec<_> = pending.rps.st_curr_before.iter().map(|r| r.frame.clone()).collect();
+            assert_shared_gray_rows(&refs[0], &refs[1]);
+            if format == previous {
+                assert_eq!(backing(held.last().unwrap()), backing(&refs[0]));
+            } else {
+                assert_ne!(backing(held.last().unwrap()), backing(&refs[0]));
+            }
+            assert_ne!(held.last().unwrap().id, refs[0].id);
+            held.extend(refs);
+            previous = format;
+        }
+        for frame in held {
+            assert_shared_gray_rows(&frame, &frame);
+        }
+    }
+
+    #[test]
+    /// Ordinary streams allocate no gray cache; flush releases it even with retained reference rows.
+    fn missing_reference_cache_is_lazy_and_released_on_flush() {
+        let mut decoder = Decoder::with_threads(1);
+        let stream = crate::synth_tests::missing_reference_picture(0, &[]);
+        let mut pictures = decoder.decode(&stream, 0).unwrap();
+        assert!(decoder.gray_reference.is_none());
+        pictures.extend(decoder.flush());
+        assert_eq!(pictures.len(), 1);
+        let refs = missing_refs(&mut decoder, 4, &[-1, -2]);
+        assert!(decoder.gray_reference.is_some());
+        assert_eq!(decoder.flush().len(), 1);
+        assert!(decoder.gray_reference.is_none());
+        let next = missing_refs(&mut decoder, 7, &[-1, -2]);
+        assert_ne!(backing(&refs[0]), backing(&next[0]));
+        assert_shared_gray_rows(&refs[0], &refs[1]);
+        assert_shared_gray_rows(&next[0], &next[1]);
+    }
+
     /// The branch-free block counts classify every flag combination as the if / else-if chain did.
     #[test]
     fn block_counts_match_the_classification_chain() {
diff --git a/crates/hevc/src/inter.rs b/crates/hevc/src/inter.rs
index 1f55a5b1d..5292b65b7 100644
--- a/crates/hevc/src/inter.rs
+++ b/crates/hevc/src/inter.rs
@@ -56,7 +56,7 @@ fn filt_w<'a, P: Px + 'a, const T: usize, const W: usize>(tap: impl Fn(usize) ->
     let mut acc = [0i32; W];
     for k in 0..T {
         let c = f[k] as i32;
-        let Some(p) = tap(k).and_then(|s| s.first_chunk::<W>()) else {
+        let Some(p) = tap(k).and_then(<[P]>::first_chunk::<W>) else {
             return;
         };
         for j in 0..W {
@@ -80,7 +80,7 @@ fn filt16_w<'a, P: Px + 'a, const T: usize, const W: usize>(tap: impl Fn(usize)
     let mut acc = [0i16; W];
     for k in 0..T {
         let c = f[k] as i16;
-        let Some(p) = tap(k).and_then(|s| s.first_chunk::<W>()) else {
+        let Some(p) = tap(k).and_then(<[P]>::first_chunk::<W>) else {
             return;
         };
         for j in 0..W {
diff --git a/crates/hevc/src/params.rs b/crates/hevc/src/params.rs
index a7f7daf0b..9b24d433b 100644
--- a/crates/hevc/src/params.rs
+++ b/crates/hevc/src/params.rs
@@ -6,6 +6,16 @@ use crate::spec_tables::{DEFAULT_SCALING_INTER, DEFAULT_SCALING_INTRA};
 use crate::tables::scan_diag;
 use filmcraft_bitstream::BitReader;
 
+/// HEVC picture state includes several per-pixel and per-block work buffers. This permits 8K
+/// pictures while rejecting dimensions that could exhaust memory during decode.
+pub const MAX_LUMA_SAMPLES: u64 = 1 << 26;
+
+fn check_picture_size(width: u32, height: u32) -> Result<()> {
+    ensure!(width > 0 && height > 0 && width <= 16888 && height <= 16888, "picture size {width}x{height} out of range");
+    ensure!(u64::from(width) * u64::from(height) <= MAX_LUMA_SAMPLES, "picture size {width}x{height} exceeds the decoded-frame budget");
+    Ok(())
+}
+
 /// General profile / tier / level information.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ProfileTierLevel {
@@ -478,7 +488,7 @@ impl Sps {
         let separate_colour_plane = if chroma_format_idc == 3 { r.read_flag()? } else { false };
         let width = r.read_ue()?;
         let height = r.read_ue()?;
-        ensure!(width > 0 && height > 0 && width <= 16888 && height <= 16888, "picture size {width}x{height} out of range");
+        check_picture_size(width, height)?;
         let mut conf_win = (0, 0, 0, 0);
         if r.read_flag()? {
             conf_win = (r.read_ue()?, r.read_ue()?, r.read_ue()?, r.read_ue()?);
@@ -921,3 +931,15 @@ impl Layout {
         self.tile_id[self.rs_to_ts[rs as usize] as usize]
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn picture_size_has_an_aggregate_pixel_budget() {
+        check_picture_size(8192, 8192).unwrap();
+        let err = check_picture_size(8192, 8193).unwrap_err();
+        assert!(err.to_string().contains("decoded-frame budget"));
+    }
+}
diff --git a/crates/hevc/src/picture.rs b/crates/hevc/src/picture.rs
index ffc7ee077..c87f919f5 100644
--- a/crates/hevc/src/picture.rs
+++ b/crates/hevc/src/picture.rs
@@ -61,7 +61,7 @@ impl Sample for u8 {
         }
     }
     fn wrap_rows(rows: Box<[OnceLock<FrameRow<u8>>]>) -> Rows {
-        Rows::U8(rows)
+        Rows::U8(rows.into())
     }
 }
 
@@ -94,7 +94,7 @@ impl Sample for u16 {
         }
     }
     fn wrap_rows(rows: Box<[OnceLock<FrameRow<u16>>]>) -> Rows {
-        Rows::U16(rows)
+        Rows::U16(rows.into())
     }
 }
 
@@ -114,9 +114,10 @@ pub struct FrameRow<S> {
 }
 
 /// The CTB rows of a frame, in its storage type.
+#[derive(Clone)]
 pub enum Rows {
-    U8(Box<[OnceLock<FrameRow<u8>>]>),
-    U16(Box<[OnceLock<FrameRow<u16>>]>),
+    U8(Arc<[OnceLock<FrameRow<u8>>]>),
+    U16(Arc<[OnceLock<FrameRow<u16>>]>),
 }
 
 /// A decoded (or in-progress) picture as stored in the DPB and referenced by later pictures.
@@ -391,6 +392,23 @@ impl Frame {
         f
     }
 
+    /// A distinct logical frame sharing this frame's rows. Used for fully published, immutable
+    /// gray references: deblocking needs a unique frame ID even when their samples are identical.
+    pub fn with_identity(&self, id: u32, poc: i32) -> Frame {
+        Frame {
+            id,
+            poc,
+            width: self.width,
+            height: self.height,
+            cwidth: self.cwidth,
+            cheight: self.cheight,
+            log2_ctb: self.log2_ctb,
+            bit_depth: self.bit_depth,
+            bit_depth_c: self.bit_depth_c,
+            rows: self.rows.clone(),
+        }
+    }
+
     /// A frame with every row published from full-picture planes and no motion.
     #[cfg(test)]
     pub fn from_planes(id: u32, poc: i32, like: &Frame, y: &[u16], cb: &[u16], cr: &[u16]) -> Frame {
diff --git a/crates/hevc/src/synth_tests.rs b/crates/hevc/src/synth_tests.rs
index aee0419fe..839810183 100644
--- a/crates/hevc/src/synth_tests.rs
+++ b/crates/hevc/src/synth_tests.rs
@@ -457,6 +457,28 @@ fn whole(n: usize) -> Vec<Segment> {
     vec![Segment { start: 0, len: n, dependent: false }]
 }
 
+/// Tiny parsed-picture fixture for missing-reference storage regressions in the decoder.
+pub(crate) fn missing_reference_picture(poc: u32, deltas: &[i32]) -> Vec<u8> {
+    let mut stream = Vec::new();
+    stream.extend(vps());
+    stream.extend(sps(true));
+    stream.extend(pps(0, &None, false));
+    let picture = PicDesc {
+        nal_type: 1,
+        poc,
+        intra: deltas.is_empty(),
+        cu: if deltas.is_empty() { Cu::Pcm } else { Cu::Skip },
+        pps_id: 0,
+        st: deltas.iter().map(|&d| (d, true)).collect(),
+        lt: vec![],
+        num_ref: deltas.len() as u32,
+        list_entry: None,
+        segments: whole(WC * HC),
+    };
+    encode_picture(&picture, &None, &content(0), &mut stream, &mut None);
+    stream
+}
+
 /// Encode the test sequence; returns the stream and the exact expected pictures (when the PCM samples
 /// are not filtered).
 fn sequence(tiles: &Tiles, pcm_lf_disabled: bool, segments: Vec<Segment>) -> (Vec<u8>, Vec<Planes>) {
diff --git a/crates/hevc/tests/fuzz_hostile.rs b/crates/hevc/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..3ba49a261
--- /dev/null
+++ b/crates/hevc/tests/fuzz_hostile.rs
@@ -0,0 +1,203 @@
+//! Hostile-input robustness: header-region sweeps (SPS/PPS/first slice headers), truncation and
+//! random mutation of small libx265 streams must never panic or run away. Skips without ffmpeg.
+
+#[path = "it/common/mod.rs"]
+mod common;
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::{Command, Stdio};
+
+use filmcraft_hevc::Decoder;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+/// (name, encoder, extra encoder args, pix_fmt)
+const SEEDS: &[(&str, &str, &str, &str)] = &[
+    ("hevc_fz_main_b", "libx265", "-x265-params log-level=error:bframes=2:keyint=8:min-keyint=8:sao=1:amp=1", "yuv420p"),
+    ("hevc_fz_main10", "libx265", "-x265-params log-level=error:bframes=1:keyint=6:min-keyint=6", "yuv420p10le"),
+    ("hevc_fz_wpp_slices", "libx265", "-x265-params log-level=error:keyint=6:min-keyint=6:wpp=1:slices=3", "yuv420p"),
+    // x265 cannot encode tiles; kvazaar can, at 256 x 64 luma per tile at least (Main profile)
+    ("hevc_fz_tiles_kvazaar", "libkvazaar", "-s 512x128 -kvazaar-params tiles=2x2,gop=0,period=6,qp=40", "yuv420p"),
+    ("hevc_fz_422_10", "libx265", "-x265-params log-level=error:keyint=6:min-keyint=6", "yuv422p10le"),
+];
+
+fn make(ff: &std::path::Path, name: &str, enc: &str, args: &str, pix: &str) -> Option<Vec<u8>> {
+    let out = filmcraft_testkit::fixtures_dir("hevc").join(format!("{name}.hevc"));
+    let p = filmcraft_testkit::fixtures::generate(&out, |tmp| {
+        let a: Vec<&str> = args.split_whitespace().collect();
+        matches!(
+            Command::new(ff)
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=25", "-frames:v", "7", "-pix_fmt", pix, "-c:v", enc])
+                .args(a)
+                .args(["-f", "hevc"])
+                .arg(tmp)
+                .stdin(Stdio::null())
+                .status(),
+            Ok(s) if s.success()
+        )
+    })?;
+    std::fs::read(p).ok()
+}
+
+static PANICS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+/// Decoder worker threads catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(std::sync::atomic::Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for threads in [1, 3] {
+            let mut dec = Decoder::with_threads(threads);
+            for au in common::split_access_units(d) {
+                let _ = dec.decode(au, 0);
+            }
+            let _ = dec.decode(d, 1);
+            let _ = dec.flush();
+            let _ = dec.take_error();
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(std::sync::atomic::Ordering::SeqCst) == before, "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+/// CI runs a rotating share of every part of the sweep; `FILMCRAFT_FUZZ_ITERS=400` runs all of it (see [`Depth`]).
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("hevc fuzz") else { return };
+    let depth = Depth::from_env();
+    for &(name, enc, args, pix) in SEEDS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, enc) {
+            filmcraft_testkit::skip("hevc fuzz", &format!("this ffmpeg has no {enc} encoder (seed {name})"));
+            continue;
+        }
+        let Some(seed) = make(&ff, name, enc, args, pix) else {
+            panic!("ffmpeg has {enc} but could not encode the {name} seed");
+        };
+        for n in depth.truncations(seed.len()) {
+            run_all(&seed[..n], &format!("{name} truncate {n}"));
+        }
+        header_flips(&depth, &seed, name);
+        random_rounds(&depth, &seed, name);
+    }
+}
+
+/// SPS/PPS/first slice header region: every byte to a few values, every bit.
+fn header_flips(depth: &Depth, seed: &[u8], name: &str) {
+    for p in 0..seed.len().min(120) {
+        for (i, v) in VALUES.into_iter().enumerate() {
+            if !depth.value(p, i) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] = v;
+            run_all(&d, &format!("{name} byte {p}={v:#x}"));
+        }
+        for b in 0..8 {
+            if !depth.bit(p, b) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] ^= 1 << b;
+            run_all(&d, &format!("{name} flip {p}.{b}"));
+        }
+    }
+}
+
+fn random_rounds(depth: &Depth, seed: &[u8], name: &str) {
+    let mut rng = Rng(0x9e3779b97f4a7c15 ^ name.len() as u64);
+    // Skipped rounds still draw their mutations, so round i matches round i of a full run.
+    for i in 0..depth.rounds {
+        let mut d = seed.to_vec();
+        for _ in 0..1 + rng.below(6) {
+            let p = rng.below(d.len());
+            if rng.below(2) == 0 {
+                d[p] ^= 1 << rng.below(8);
+            } else {
+                d[p] = rng.next() as u8;
+            }
+        }
+        if depth.round(i) {
+            run_all(&d, &format!("{name} random {i}"));
+        }
+    }
+}
+
+const VALUES: [u8; 5] = [0, 0xff, 0x80, 0x01, 0x7f];
+
+/// How much of the sweep runs. `FILMCRAFT_FUZZ_ITERS=N` runs all of it (about 300 truncation
+/// points spread over each seed, every header byte, overwrite value and bit flip) plus N random
+/// rounds per seed: 400 is the full depth, more hunts longer. Unset, CI runs a third of the
+/// truncation points and of the full depth's random rounds and, for each header byte, one value
+/// and two bits. A rotation offset shifts which share runs (`FILMCRAFT_FUZZ_SEED`, else the UTC
+/// day number), so every case of the full sweep runs within a few days, and a random round's
+/// mutations match the same round of a full run.
+struct Depth {
+    full: bool,
+    truncations: usize,
+    rounds: usize,
+    rotation: usize,
+}
+
+impl Depth {
+    fn from_env() -> Self {
+        match std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()) {
+            Some(rounds) => Depth { full: true, truncations: 300, rounds, rotation: 0 },
+            None => {
+                let rotation = rotation();
+                eprintln!("fuzz subset rotation {rotation} (FILMCRAFT_FUZZ_SEED={rotation} replays it; FILMCRAFT_FUZZ_ITERS=400 runs everything)");
+                Depth { full: false, truncations: 300, rounds: 400, rotation }
+            }
+        }
+    }
+    /// Truncation lengths for a `len`-byte input: every point of the full sweep, or every third one.
+    fn truncations(&self, len: usize) -> std::iter::StepBy<std::ops::Range<usize>> {
+        let stride = (len / self.truncations).max(1);
+        let (start, step) = if self.full { (0, stride) } else { ((self.rotation % 3) * stride, 3 * stride) };
+        (start..len).step_by(step)
+    }
+    fn value(&self, p: usize, i: usize) -> bool {
+        self.full || i == (p + self.rotation % VALUES.len()) % VALUES.len()
+    }
+    fn bit(&self, p: usize, b: usize) -> bool {
+        self.full || (b + p + self.rotation % 4).is_multiple_of(4)
+    }
+    fn round(&self, i: usize) -> bool {
+        self.full || i % 3 == self.rotation % 3
+    }
+}
+
+/// The default subset's rotation offset: `FILMCRAFT_FUZZ_SEED`, else days since the Unix epoch (UTC).
+fn rotation() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or_else(|| {
+        let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        usize::try_from(secs / 86_400).unwrap_or(0)
+    })
+}
diff --git a/crates/hevc/tests/common/mod.rs b/crates/hevc/tests/it/common/mod.rs
similarity index 99%
rename from crates/hevc/tests/common/mod.rs
rename to crates/hevc/tests/it/common/mod.rs
index a8dcb8da2..61c1033f9 100644
--- a/crates/hevc/tests/common/mod.rs
+++ b/crates/hevc/tests/it/common/mod.rs
@@ -73,7 +73,7 @@ pub const FIXTURES: &[Fixture] = &[
     fx!("odd_1918x1078", "testsrc2", 1918, 1078, 3, NOISE, 8, ["-preset", "veryfast", "-x265-params", "log-level=error"]),
     fx!("hd_1080p", "testsrc2", 1920, 1080, 3, "", 8, ["-preset", "fast", "-x265-params", "log-level=error"]),
     fx!("uhd_4k_main10", "testsrc2", 3840, 2160, 2, "", 10, ["-preset", "ultrafast", "-x265-params", "log-level=error"]),
-    // performance reference streams (tests/perf.rs)
+    // performance reference streams (tests/it/perf.rs)
     fx!("bench_1080p", "testsrc2", 1920, 1080, 60, "noise=alls=3:allf=t", 8, ["-preset", "medium", "-crf", "24", "-x265-params", "log-level=error"]),
     fx!("bench_4k", "testsrc2", 3840, 2160, 20, "noise=alls=3:allf=t", 10, ["-preset", "fast", "-crf", "26", "-x265-params", "log-level=error"]),
     // Apple VideoToolbox (hardware encoder, macOS only)
diff --git a/crates/hevc/tests/conformance.rs b/crates/hevc/tests/it/conformance.rs
similarity index 99%
rename from crates/hevc/tests/conformance.rs
rename to crates/hevc/tests/it/conformance.rs
index 4fa8b8cbe..7b50cbaf0 100644
--- a/crates/hevc/tests/conformance.rs
+++ b/crates/hevc/tests/it/conformance.rs
@@ -1,7 +1,7 @@
 //! Bit-exactness against ffmpeg's decoder on libx265 / VideoToolbox fixtures (skipped when ffmpeg is
 //! absent).
 
-mod common;
+use crate::common;
 
 macro_rules! fixture_tests {
     ($($name:ident),* $(,)?) => {
diff --git a/crates/hevc/tests/it/main.rs b/crates/hevc/tests/it/main.rs
new file mode 100644
index 000000000..be033f189
--- /dev/null
+++ b/crates/hevc/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod common;
+mod conformance;
+mod perf;
+mod robustness;
diff --git a/crates/hevc/tests/perf.rs b/crates/hevc/tests/it/perf.rs
similarity index 91%
rename from crates/hevc/tests/perf.rs
rename to crates/hevc/tests/it/perf.rs
index 4091166b6..ab8144a12 100644
--- a/crates/hevc/tests/perf.rs
+++ b/crates/hevc/tests/it/perf.rs
@@ -1,7 +1,7 @@
 //! Decode speed (ignored by default; run with
-//! `cargo test --release -p filmcraft-hevc --test perf -- --ignored --nocapture`).
+//! `cargo test --release -p filmcraft-hevc --test it perf:: -- --ignored --nocapture`).
 
-mod common;
+use crate::common;
 
 use filmcraft_hevc::Decoder;
 use std::time::Instant;
diff --git a/crates/hevc/tests/robustness.rs b/crates/hevc/tests/it/robustness.rs
similarity index 99%
rename from crates/hevc/tests/robustness.rs
rename to crates/hevc/tests/it/robustness.rs
index 075d5fde2..50f35b0d4 100644
--- a/crates/hevc/tests/robustness.rs
+++ b/crates/hevc/tests/it/robustness.rs
@@ -1,6 +1,6 @@
 //! hvcC / length-prefixed input and resilience against damaged streams.
 
-mod common;
+use crate::common;
 
 use filmcraft_bitstream::annexb_nals;
 use filmcraft_hevc::Decoder;
diff --git a/crates/hevc/tools/extract_tables.py b/crates/hevc/tools/extract_tables.py
index 8b9fa3979..7d6cbc89f 100644
--- a/crates/hevc/tools/extract_tables.py
+++ b/crates/hevc/tools/extract_tables.py
@@ -13,8 +13,18 @@ initType following Table 9-4, default scaling lists (Table 7-6), intraPredAngle
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read().replace("−", "-").replace("–", "-")
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read().replace("−", "-").replace("–", "-")
 lines = text.split("\n")
 
 
@@ -34,7 +44,7 @@ def body_after(title_regex, stop_regex=r"^\s*(Table \d+-\d+ - |\d+\s+Rec\. ITU|R
 def init_values(table):
     vals = []
     for l in body_after(r"Table %s - Values of initValue" % re.escape(table)):
-        m = re.match(r"^\s*initValue\s+(.*)$", l)
+        m = re.match(r"^\s*initValue\s+(\S.*)$", l)
         if m:
             vals += [int(v) for v in m.group(1).split()]
     return vals
@@ -108,7 +118,7 @@ w("")
 # Table 7-6: default 8x8 scaling lists (intra matrixId 0..2, inter 3..5)
 intra, inter = [], []
 for l in body_after(r"Table 7-6 - Specification of default values of ScalingList"):
-    m = re.match(r"^\s*ScalingList\[ 1\.\.3 \]\[ (0\.\.2|3\.\.5) \]\[ i \]\s+(.*)$", l)
+    m = re.match(r"^\s*ScalingList\[ 1\.\.3 \]\[ (0\.\.2|3\.\.5) \]\[ i \]\s+(\S.*)$", l)
     if m:
         (intra if m.group(1) == "0..2" else inter).extend(int(v) for v in m.group(2).split())
 assert len(intra) == 64 and len(inter) == 64
@@ -177,7 +187,9 @@ w("")
 def taps(eq_no, var, n):
     for l in lines:
         if "(%s)" % eq_no in l:
-            expr = l.split("=", 1)[1].split(">>")[0]
+            expr = " ".join(l.split("=", 1)[1].split(">>")[0].split())
+            if len(expr) > 8192:
+                raise SystemExit("equation %s is unexpectedly long" % eq_no)
             coef = {}
             for sign, c, k in re.findall(r"([+-]?)\s*(?:(\d+)\s*\*\s*)?%s0,\s*(-?\d)" % var, expr):
                 coef[int(k)] = (-1 if sign == "-" else 1) * (int(c) if c else 1)
diff --git a/crates/interchange/README.md b/crates/interchange/README.md
index edaff851f..61eb4cfc3 100644
--- a/crates/interchange/README.md
+++ b/crates/interchange/README.md
@@ -25,7 +25,7 @@ read off files it exports, never from the application itself.
 The other formats' editions are listed in the module docs (`edl`, `fcp7`, `fcpxml`, `otio`, `ale`).
 
 **Invariant — Unicode media URLs:** file URL prefix probes must not panic when their byte boundary
-falls inside a UTF-8 character. Timeline importers use the shared converter; `tests/file_urls.rs`
+falls inside a UTF-8 character. Timeline importers use the shared converter; `tests/it/file_urls.rs`
 checks expected Unicode paths through the public converter, resolver and EDL importer.
 
 ## AAF and OMF
@@ -76,7 +76,7 @@ none of the exports brings one back. Each such clip is named in the export `Repo
 | Format | Written as | On import into FilmCraft |
 |---|---|---|
 | FCP7 XML | a clip item without media (its layers as FilmCraft filter ids) | not read back; the import report names the skipped clip item |
-| FCPXML | a clip without media | not read back |
+| FCPXML | a gap on V1; left out on other tracks (a gap exists only in the primary storyline) | not read back |
 | OTIO | a clip with a `MissingReference` (effects in the `filmcraft` metadata) | offline media |
 | EDL | an ordinary event with the reel the reel mode gives | an ordinary clip |
 | AAF | a gap | nothing |
@@ -85,7 +85,11 @@ OMF carries no video at all.
 
 ## Tests
 
-- `tests/aaf_omf.rs`: AAF round trips at 25, 29.97 DF, 23.976 and 59.94 DF (clips, gaps,
+- `src/otio.rs` (unit tests): OTIO repeats a nested sequence for every use, so compound clips that each hold
+  several uses of the next are exponential (a 3 KB FCPXML nested 12 deep made the export run for minutes and grow to
+  gigabytes). After 25 000 clips written inside nested sequences the rest are gaps, with one warning; an ordinary
+  project is far below that and unchanged.
+- `tests/it/aaf_omf.rs`: AAF round trips at 25, 29.97 DF, 23.976 and 59.94 DF (clips, gaps,
   two-sided and one-sided transitions, links, markers, start timecodes, constant and keyframed
   gain, media markers and timecode); 512-byte sectors; breakout to mono; embedded trimmed audio
   (sample data and source offsets); separate consolidated files with a video mixdown; OMF round
@@ -93,7 +97,7 @@ OMF carries no video at all.
   random corruption never panic. Nested sequences: AAF round trips as compositions (nests in
   nests, a nest used twice, another frame and sample rate, breakout to mono), OMF with the
   rendered sound, the audio needs of nests, a sequence inside itself.
-- `tests/uncarried_clips.rs`: every format's export report names each graphic clip and adjustment
+- `tests/it/uncarried_clips.rs`: every format's export report names each graphic clip and adjustment
   layer once, as a warning; a sequence without them reports nothing; what a re-import gives back
   matches the report; the FCP7 XML import names a clip item whose file is not defined.
 - `src/aaf/tests.rs`: written files checked against the required properties of every class
diff --git a/crates/interchange/src/aaf/store.rs b/crates/interchange/src/aaf/store.rs
index 02234c463..e9ef2e0e1 100644
--- a/crates/interchange/src/aaf/store.rs
+++ b/crates/interchange/src/aaf/store.rs
@@ -359,10 +359,12 @@ struct R<'a> {
     cf: CompoundFile<'a>,
     paths: Vec<Vec<u16>>,
     objects: usize,
+    materialized_stream_bytes: usize,
 }
 
 const MAX_DEPTH: usize = 200;
 const MAX_OBJECTS: usize = 2_000_000;
+const MAX_MATERIALIZED_STREAM_BYTES: usize = 256 << 20;
 
 /// Parse the object tree of an AAF compound file (the root object).
 pub(crate) fn read(bytes: &[u8]) -> Result<Obj, String> {
@@ -385,7 +387,7 @@ pub(crate) fn read(bytes: &[u8]) -> Result<Obj, String> {
             }
         }
     }
-    let mut r = R { cf, paths, objects: 0 };
+    let mut r = R { cf, paths, objects: 0, materialized_stream_bytes: 0 };
     r.obj(0, 0)
 }
 
@@ -401,9 +403,15 @@ impl R<'_> {
         self.cf.child(parent, name).ok_or_else(|| bad(format!("missing storage or stream \"{name}\"")))
     }
 
-    fn stream(&self, parent: usize, name: &str) -> Result<Vec<u8>, String> {
+    fn stream(&mut self, parent: usize, name: &str) -> Result<Vec<u8>, String> {
         let id = self.child(parent, name)?;
-        self.cf.read(id).map_err(|e| e.to_string())
+        let data = self.cf.read(id).map_err(|e| e.to_string())?;
+        self.materialized_stream_bytes = self
+            .materialized_stream_bytes
+            .checked_add(data.len())
+            .filter(|&n| n <= MAX_MATERIALIZED_STREAM_BYTES)
+            .ok_or_else(|| bad("AAF materialized stream data exceeds the memory limit"))?;
+        Ok(data)
     }
 
     fn obj(&mut self, entry: usize, depth: usize) -> Result<Obj, String> {
@@ -435,6 +443,9 @@ impl R<'_> {
             let (Some(pid), Some(sf), Some(len)) = (rd_u16(&props, 4 + i * 6), rd_u16(&props, 6 + i * 6), rd_u16(&props, 8 + i * 6)) else {
                 return Err(bad("truncated property index"));
             };
+            if o.props.iter().any(|(previous, _)| *previous == pid) {
+                return Err(bad("duplicate property id"));
+            }
             let v = props.get(at..at + len as usize).ok_or_else(|| bad("truncated property value"))?;
             at += len as usize;
             let value = match sf {
diff --git a/crates/interchange/src/common.rs b/crates/interchange/src/common.rs
index 2823ff755..be47a4317 100644
--- a/crates/interchange/src/common.rs
+++ b/crates/interchange/src/common.rs
@@ -13,6 +13,11 @@ use filmcraft_time::{FrameRate, Tick};
 
 use crate::{Imported, Report};
 
+/// A timeline import may not materialise an unbounded number of sparse track
+/// labels. This remains well above common editorial timelines while keeping
+/// hostile lane/channel numbers from allocating every intervening track.
+pub(crate) const MAX_IMPORTED_TRACKS: usize = 256;
+
 // ---------------------------------------------------------------------------------------------
 // Paths and URLs
 // ---------------------------------------------------------------------------------------------
@@ -65,7 +70,9 @@ pub fn file_url_to_path(url: &str) -> String {
         return url.to_string();
     }
     let rest = &url[7..];
-    let rest = if rest.get(..9).is_some_and(|s| s.eq_ignore_ascii_case("localhost")) { &rest[9..] } else { rest };
+    let is_localhost =
+        rest.get(..9).is_some_and(|s| s.eq_ignore_ascii_case("localhost")) && rest.get(9..).is_some_and(|after| after.is_empty() || after.starts_with('/'));
+    let rest = if is_localhost { &rest[9..] } else { rest };
     let decoded = percent_decode(rest);
     // file:///C:/x -> C:/x
     if decoded.len() >= 3 && decoded.starts_with('/') && is_windows_abs(&decoded[1..]) {
@@ -408,12 +415,18 @@ impl Builder {
         Track::new(id, kind, name)
     }
 
-    pub fn ensure_tracks(&mut self, seq: &mut Sequence, kind: TrackKind, n: usize) {
+    /// Ensure `n` tracks of one kind exist. Returns false when an imported
+    /// label would exceed the supported per-kind track count.
+    pub fn ensure_tracks(&mut self, seq: &mut Sequence, kind: TrackKind, n: usize) -> bool {
+        if n > MAX_IMPORTED_TRACKS {
+            return false;
+        }
         while seq.tracks(kind).len() < n {
             let i = seq.tracks(kind).len();
             let t = self.track(kind, i);
             seq.tracks_mut(kind).push(t);
         }
+        true
     }
 
     pub fn link_id(&mut self) -> u64 {
@@ -463,15 +476,17 @@ impl Builder {
 
     /// Place `item` on the first track at or after `preferred` where it does not overlap anything,
     /// creating tracks as needed. Returns the track index.
-    pub fn place(&mut self, seq: &mut Sequence, kind: TrackKind, preferred: usize, item: TrackItem) -> usize {
+    pub fn place(&mut self, seq: &mut Sequence, kind: TrackKind, preferred: usize, item: TrackItem) -> Option<usize> {
         let mut i = preferred;
         loop {
-            self.ensure_tracks(seq, kind, i + 1);
+            if i >= MAX_IMPORTED_TRACKS || !self.ensure_tracks(seq, kind, i + 1) {
+                return None;
+            }
             let t = &mut seq.tracks_mut(kind)[i];
             if !t.items.iter().any(|o| o.start < item.end() && item.start < o.end()) {
                 t.items.push(item);
                 t.sort();
-                return i;
+                return Some(i);
             }
             i += 1;
         }
@@ -692,6 +707,14 @@ mod tests {
         }
     }
 
+    #[test]
+    fn file_url_localhost_prefix_host_is_kept() {
+        assert_eq!(file_url_to_path("file://localhost-nas/share/a.mov"), "//localhost-nas/share/a.mov");
+        assert_eq!(file_url_to_path("file://LOCALHOSTX/a"), "//LOCALHOSTX/a");
+        assert_eq!(file_url_to_path("file://localhost/a/b"), "/a/b");
+        assert_eq!(file_url_to_path("file://LocalHost/a"), "/a");
+    }
+
     #[test]
     fn paths() {
         assert_eq!(resolve_path("media/a.mov", Some("/proj")), "/proj/media/a.mov");
@@ -713,4 +736,14 @@ mod tests {
         assert_eq!(rate_from_f64(48000.0), FrameRate::new(48000, 1));
         assert_eq!(frames_round(FrameRate::FPS_24, FrameRate::FPS_24.tick_of(5) + Tick(10)), 5);
     }
+
+    #[test]
+    fn imported_tracks_are_bounded() {
+        let mut b = Builder::new("tracks");
+        let mut seq = empty_sequence(Default::default());
+        assert!(b.ensure_tracks(&mut seq, TrackKind::Video, MAX_IMPORTED_TRACKS));
+        assert_eq!(seq.video_tracks.len(), MAX_IMPORTED_TRACKS);
+        assert!(!b.ensure_tracks(&mut seq, TrackKind::Video, MAX_IMPORTED_TRACKS + 1));
+        assert_eq!(seq.video_tracks.len(), MAX_IMPORTED_TRACKS);
+    }
 }
diff --git a/crates/interchange/src/comp.rs b/crates/interchange/src/comp.rs
index 2ade96bcc..32c8698f2 100644
--- a/crates/interchange/src/comp.rs
+++ b/crates/interchange/src/comp.rs
@@ -698,7 +698,10 @@ pub(crate) fn to_project(doc: Document, opts: &ImportOptions, report: &mut Repor
             None => groups.push((k, vec![i])),
         }
     }
-    let doc_stem = opts.name.clone().unwrap_or_else(|| "Imported".into());
+    // This becomes a directory name for embedded AAF/OMF audio. `ImportOptions::name` normally
+    // comes from the document filename, where backslashes are ordinary Unix filename characters;
+    // `resolve_path` deliberately treats them as separators, so retain only one safe component.
+    let doc_stem = safe_path_component(opts.name.as_deref().unwrap_or("Imported"));
     let mut used_paths = std::collections::HashSet::new();
     for ((_, path), members) in &groups {
         let srcs: Vec<&Source> = members.iter().map(|&i| &doc.sources[i]).collect();
@@ -788,6 +791,13 @@ pub(crate) fn to_project(doc: Document, opts: &ImportOptions, report: &mut Repor
     Ok((b.finish(), extracted))
 }
 
+/// A display name used as a generated path component, never a caller-selected path fragment.
+fn safe_path_component(name: &str) -> String {
+    let safe: String = name.chars().map(|c| if c.is_alphanumeric() || " -_.".contains(c) { c } else { '_' }).collect();
+    let safe = safe.trim();
+    if safe.is_empty() || matches!(safe, "." | "..") { "Imported".into() } else { safe.into() }
+}
+
 fn build_sequence(
     b: &mut Builder,
     comp: &Composition,
@@ -1004,3 +1014,15 @@ pub(crate) fn ticks_to_units(t: Tick, num: i64, den: i64) -> (i64, bool) {
     let n = q + if r * 2 >= d { 1 } else { 0 };
     (n.clamp(i64::MIN as i128, i64::MAX as i128) as i64, r == 0)
 }
+
+#[cfg(test)]
+mod path_tests {
+    use super::safe_path_component;
+
+    #[test]
+    fn generated_embedded_audio_folder_is_one_safe_component() {
+        for (input, expected) in [(r"..\escape", ".._escape"), ("../escape", ".._escape"), ("..", "Imported"), ("", "Imported")] {
+            assert_eq!(safe_path_component(input), expected, "{input:?}");
+        }
+    }
+}
diff --git a/crates/interchange/src/edl.rs b/crates/interchange/src/edl.rs
index ecee03914..5f114254c 100644
--- a/crates/interchange/src/edl.rs
+++ b/crates/interchange/src/edl.rs
@@ -375,7 +375,9 @@ impl Ctx<'_> {
                 }
             }
             let id = ti.id;
-            self.b.ensure_tracks(&mut self.seq, kind, idx + 1);
+            if !self.b.ensure_tracks(&mut self.seq, kind, idx + 1) {
+                continue;
+            }
             let mut next = self.b.p.next_id;
             let track = &mut self.seq.tracks_mut(kind)[idx];
             overwrite(track, ti, &mut || {
@@ -487,7 +489,9 @@ fn import_event(ctx: &mut Ctx, ev: &Event, report: &mut Report) {
             let chans: BTreeSet<Ch> = l2.chans.iter().copied().collect();
             for ch in chans {
                 let (kind, idx) = ctx.track_index(ch, 0);
-                ctx.b.ensure_tracks(&mut ctx.seq, kind, idx + 1);
+                if !ctx.b.ensure_tracks(&mut ctx.seq, kind, idx + 1) {
+                    continue;
+                }
                 let to = placed.iter().find(|(k, i, _)| *k == kind && *i == idx).map(|p| p.2);
                 let track = &mut ctx.seq.tracks_mut(kind)[idx];
                 let from = if from_black { None } else { track.items.iter().find(|i| i.end() == t0).map(|i| i.id) };
diff --git a/crates/interchange/src/fcp7.rs b/crates/interchange/src/fcp7.rs
index e0e9075d9..2bc67d9e7 100644
--- a/crates/interchange/src/fcp7.rs
+++ b/crates/interchange/src/fcp7.rs
@@ -27,9 +27,9 @@ use filmcraft_time::{FrameRate, Tick, format_timecode_frames};
 use roxmltree::Node;
 
 use crate::common::{
-    Builder, MediaSpec, base_item, db_to_gain, empty_sequence, file_name, frames_round, gain_to_db, item_media, item_path, kind_from_ext, label_from, on_frame,
-    param, param_modified, path_to_file_url, rate_from_timebase, resolve_path, set_param, settings_for, standard_effects, timebase, transition_effect,
-    transition_name, unscaled,
+    Builder, MAX_IMPORTED_TRACKS, MediaSpec, base_item, db_to_gain, empty_sequence, file_name, frames_round, gain_to_db, item_media, item_path, kind_from_ext,
+    label_from, on_frame, param, param_modified, path_to_file_url, rate_from_timebase, resolve_path, set_param, settings_for, standard_effects, timebase,
+    transition_effect, transition_name, unscaled,
 };
 use crate::xml::{XmlWriter, bool_str, child, child_bool, child_f64, child_i64, child_text, children, elements, num, path_text};
 use crate::{Error, ExportOptions, Format, ImportOptions, Imported, Report, Result};
@@ -343,7 +343,10 @@ impl<'a, 'i> Imp<'a, 'i, '_> {
         for (kind, tag) in [(TrackKind::Video, "video"), (TrackKind::Audio, "audio")] {
             let Some(m) = media.and_then(|m| child(m, tag)) else { continue };
             for (ti, tn) in children(m, "track").enumerate() {
-                self.b.ensure_tracks(&mut seq, kind, ti + 1);
+                if !self.b.ensure_tracks(&mut seq, kind, ti + 1) {
+                    self.report.warn(format!("FCP7 {kind:?} tracks beyond {MAX_IMPORTED_TRACKS} were skipped"));
+                    break;
+                }
                 self.track(&mut seq, id, kind, ti, tn, rate, (w, h));
             }
         }
@@ -378,7 +381,9 @@ impl<'a, 'i> Imp<'a, 'i, '_> {
                         let t = &mut seq.tracks_mut(kind)[ti];
                         if t.items.iter().any(|o| o.start < ti_item.end() && ti_item.start < o.end()) {
                             self.report.warn("overlapping clip items on one track; the later one was moved to a new track");
-                            self.b.place(seq, kind, ti + 1, ti_item);
+                            if self.b.place(seq, kind, ti + 1, ti_item).is_none() {
+                                self.report.warn(format!("FCP7 {kind:?} track exceeds the {MAX_IMPORTED_TRACKS}-track import limit; clip was skipped"));
+                            }
                         } else {
                             t.items.push(ti_item);
                         }
diff --git a/crates/interchange/src/fcpxml.rs b/crates/interchange/src/fcpxml.rs
index e231fff5e..571ad82d0 100644
--- a/crates/interchange/src/fcpxml.rs
+++ b/crates/interchange/src/fcpxml.rs
@@ -14,7 +14,7 @@
 //!   clip markers. Transitions are supported on the primary storyline (and read from secondary
 //!   storylines); transitions elsewhere are reported.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use filmcraft_geom::Vec2;
 use filmcraft_media::MediaKind;
@@ -26,8 +26,8 @@ use filmcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
 use roxmltree::Node;
 
 use crate::common::{
-    Builder, MediaSpec, base_item, db_to_gain, empty_sequence, file_name, gain_to_db, generator_of, item_media, item_path, kind_from_ext, param,
-    param_modified, path_to_file_url, resolve_path, scaled, set_param, settings_for, standard_effects, transition_effect, transition_name,
+    Builder, MAX_IMPORTED_TRACKS, MediaSpec, base_item, db_to_gain, empty_sequence, file_name, gain_to_db, generator_of, item_media, item_path, kind_from_ext,
+    param, param_modified, path_to_file_url, resolve_path, scaled, set_param, settings_for, standard_effects, transition_effect, transition_name,
 };
 use crate::xml::{child, children, elements, num};
 use crate::{Error, ExportOptions, Format, ImportOptions, Imported, Report, Result};
@@ -105,10 +105,11 @@ fn audio_rate_str(sr: u32) -> String {
 
 fn parse_audio_rate(s: &str) -> Option<u32> {
     let s = s.trim();
-    match s.strip_suffix('k') {
+    let r = match s.strip_suffix('k') {
         Some(k) => k.parse::<f64>().ok().map(|v| (v * 1000.0).round() as u32),
         None => s.parse().ok(),
-    }
+    };
+    r.filter(|&sr| sr > 0 && sr <= 384_000)
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -132,6 +133,7 @@ struct Imp<'a, 'i, 'r> {
     assets: HashMap<String, Asset>,
     media_nodes: HashMap<String, Node<'a, 'i>>,
     media_items: HashMap<String, ItemId>,
+    media_active: HashSet<String>,
     effects: HashMap<String, String>,
 }
 
@@ -163,6 +165,7 @@ pub(crate) fn import(text: &str, opts: &ImportOptions, report: &mut Report) -> R
         assets: HashMap::new(),
         media_nodes: HashMap::new(),
         media_items: HashMap::new(),
+        media_active: HashSet::new(),
         effects: HashMap::new(),
     };
     if let Some(res) = child(root, "resources") {
@@ -281,9 +284,15 @@ impl<'a, 'i> Imp<'a, 'i, '_> {
         }
         let n = *self.media_nodes.get(id)?;
         let s = child(n, "sequence")?;
-        // Reserve first so recursion terminates.
+        if !self.media_active.insert(id.into()) {
+            self.report.warn(format!("recursive FCPXML media resource {id:?} ignored"));
+            return None;
+        }
+        // Mark the resource before descending: a compound clip can reference itself through a
+        // ref-clip before a completed sequence is available to cache.
         let name = n.attribute("name").unwrap_or("Compound Clip").to_string();
         let item = self.sequence(s, &name, None);
+        self.media_active.remove(id);
         self.media_items.insert(id.into(), item);
         Some(item)
     }
@@ -437,14 +446,17 @@ impl<'a, 'i> Imp<'a, 'i, '_> {
                     TrackKind::Video => lane.max(0) as usize,
                     TrackKind::Audio => {
                         if lane < 0 {
-                            (-lane - 1) as usize
+                            lane.unsigned_abs() as usize - 1
                         } else {
                             lane as usize
                         }
                     }
                 };
                 let id = ti.id;
-                self.b.place(seq, kind, pref, ti);
+                if self.b.place(seq, kind, pref, ti).is_none() {
+                    self.report.warn(format!("FCPXML {kind:?} lane exceeds the {MAX_IMPORTED_TRACKS}-track import limit; clip was skipped"));
+                    continue;
+                }
                 placed.push((kind, id));
                 if kind == TrackKind::Video {
                     vclip = Some(id);
@@ -462,7 +474,7 @@ impl<'a, 'i> Imp<'a, 'i, '_> {
             let Some(l) = c.attribute("lane").and_then(|l| l.parse::<i32>().ok()) else { continue };
             let off = attr_time(c, "offset").unwrap_or(Tick::ZERO);
             let ct0 = t0 + (off - local_start);
-            let clane = if lane > 0 && l > 0 { lane + l } else { l };
+            let clane = if lane > 0 && l > 0 { lane.saturating_add(l) } else { l };
             if c.has_tag_name("spine") {
                 // Secondary storyline: children offsets are in the storyline's local time.
                 let first = elements(c).filter(|x| !x.has_tag_name("transition")).find_map(|x| attr_time(x, "offset")).unwrap_or(Tick::ZERO);
@@ -673,8 +685,8 @@ pub(crate) fn export(p: &Project, seq_id: ItemId, opts: &ExportOptions, report:
         out.push_str(r);
     }
     out.push_str("  </resources>\n");
-    out.push_str(&format!("  <library>\n    <event name=\"{}\">\n", crate::xml::escape(&p.name)));
-    out.push_str(&format!("      <project name=\"{}\">\n", crate::xml::escape(&name)));
+    out.push_str(&format!("  <library>\n    <event name=\"{}\">\n", crate::xml::escape_attr(&p.name)));
+    out.push_str(&format!("      <project name=\"{}\">\n", crate::xml::escape_attr(&name)));
     out.push_str(&body);
     out.push_str("      </project>\n    </event>\n  </library>\n</fcpxml>\n");
     Ok(out)
@@ -728,7 +740,7 @@ impl Exp<'_, '_> {
         let start = m.info.start_timecode.map(|f| mrate.tick_of(f)).unwrap_or(Tick::ZERO);
         let mut a = format!(
             "    <asset id=\"{id}\" name=\"{}\" start=\"{}\" duration=\"{}\" hasVideo=\"{}\" hasAudio=\"{}\"",
-            crate::xml::escape(&name),
+            crate::xml::escape_attr(&name),
             fmt_time(start, mrate),
             fmt_time(m.info.duration, mrate),
             m.info.video.is_some() as u8,
@@ -742,7 +754,7 @@ impl Exp<'_, '_> {
         }
         let path = item_path(self.p, item).unwrap_or("");
         let src = if crate::common::is_absolute(path) { path_to_file_url(path, false) } else { path.to_string() };
-        a.push_str(&format!(">\n      <media-rep kind=\"original-media\" src=\"{}\"/>\n    </asset>\n", crate::xml::escape(&src)));
+        a.push_str(&format!(">\n      <media-rep kind=\"original-media\" src=\"{}\"/>\n    </asset>\n", crate::xml::escape_attr(&src)));
         self.res_out.push(a);
         self.assets.insert(item, Res { id: id.clone() });
         let _ = file_name;
@@ -764,7 +776,7 @@ impl Exp<'_, '_> {
         let body = self.sequence_xml(item, &fmt, 3);
         self.building.pop();
         let name = self.p.item(item).map(|i| i.name.clone()).unwrap_or_default();
-        self.res_out.push(format!("    <media id=\"{id}\" name=\"{}\">\n{body}    </media>\n", crate::xml::escape(&name)));
+        self.res_out.push(format!("    <media id=\"{id}\" name=\"{}\">\n{body}    </media>\n", crate::xml::escape_attr(&name)));
         id
     }
 
@@ -773,7 +785,11 @@ impl Exp<'_, '_> {
             return r.id.clone();
         }
         let id = self.rid();
-        self.res_out.push(format!("    <effect id=\"{id}\" name=\"{}\" uid=\"filmcraft.{}\"/>\n", crate::xml::escape(name), crate::xml::escape(id_hint)));
+        self.res_out.push(format!(
+            "    <effect id=\"{id}\" name=\"{}\" uid=\"filmcraft.{}\"/>\n",
+            crate::xml::escape_attr(name),
+            crate::xml::escape_attr(id_hint)
+        ));
         self.effects.insert(name.to_string(), Res { id: id.clone() });
         id
     }
@@ -871,6 +887,10 @@ impl Exp<'_, '_> {
                     if merged_audio.contains(&it.id) {
                         continue;
                     }
+                    if let Some(what) = self.unsupported(it, rate) {
+                        self.report.warn(format!("{what}: it is left out and is not read back on import"));
+                        continue;
+                    }
                     let Some(pi) = els.iter().position(|e| e.start <= it.start && it.start < e.end) else {
                         self.report.warn("a connected clip could not be attached and was dropped");
                         continue;
@@ -934,34 +954,33 @@ impl Exp<'_, '_> {
             "<transition name=\"{n}\" offset=\"{}\" duration=\"{}\"><filter-video ref=\"{r}\" name=\"{n}\"/></transition>",
             fmt_time(tc0 + tr.start, rate),
             fmt_time(tr.duration, rate),
-            n = crate::xml::escape(&name)
+            n = crate::xml::escape_attr(&name)
         )
     }
 
+    /// How the report names a clip FCPXML cannot carry (a generator, a title, an adjustment layer); `None` for any
+    /// other clip. Such a clip has no asset to reference, and an empty `ref` is not a valid IDREF: Final Cut Pro
+    /// rejects the whole file. A `<gap>` exists only in a spine, so a connected one is left out instead.
+    fn unsupported(&self, it: &TrackItem, rate: FrameRate) -> Option<String> {
+        if let Some(g) = generator_of(self.p, base_item(self.p, it.item)) {
+            return Some(format!("generator \"{}\" is not supported in FCPXML", g.label()));
+        }
+        crate::common::uncarried_clip(self.p, it, rate).map(|clip| format!("{clip} is not supported in FCPXML"))
+    }
+
     /// A clip element at `offset` (in its parent's local time).
     #[allow(clippy::too_many_arguments)]
     fn clip_el(&mut self, it: &TrackItem, audio: Option<&TrackItem>, kind: TrackKind, offset: Tick, lane: Option<i32>, seq: &Sequence, primary: bool) -> El {
         let rate = seq.settings.frame_rate;
         let base = base_item(self.p, it.item);
         let is_seq = matches!(self.p.item(base).map(|i| &i.kind), Some(ItemKind::Sequence(_)));
-        let generator = generator_of(self.p, base).cloned();
         let lane_attr = lane.map(|l| format!(" lane=\"{l}\"")).unwrap_or_default();
-        let name = crate::xml::escape(&it.name);
-        if let Some(g) = generator {
-            self.report.warn(format!("generator \"{}\" is not supported in FCPXML; written as a gap", g.label()));
-            return El {
-                start: it.start,
-                end: it.end(),
-                local: offset,
-                xml_open: format!(
-                    "<gap name=\"{name}\"{lane_attr} offset=\"{}\" start=\"{}\" duration=\"{}\"",
-                    fmt_time(offset, rate),
-                    fmt_time(offset, rate),
-                    fmt_time(it.duration, rate)
-                ),
-                children: vec![],
-                close: "gap".into(),
-            };
+        let name = crate::xml::escape_attr(&it.name);
+        // In the primary storyline, a clip FCPXML cannot carry becomes a gap that keeps the timing
+        // (connected ones never get here: see `unsupported`).
+        if let Some(what) = self.unsupported(it, rate) {
+            self.report.warn(format!("{what}: it is written as a gap and is not read back on import"));
+            return gap_el(it, &name, offset, rate);
         }
         // Local timeline of the element: origin + source time (retimed clips use a timeMap).
         let (tag, r, origin) = if is_seq {
@@ -974,13 +993,7 @@ impl Exp<'_, '_> {
             let origin = self.p.sequence(base).map(|s| s.settings.frame_rate.tick_of(s.start_timecode)).unwrap_or(Tick::ZERO);
             ("ref-clip", r, origin)
         } else {
-            let r = match crate::common::uncarried_clip(self.p, it, rate) {
-                Some(clip) => {
-                    self.report.warn(format!("{clip} is not supported in FCPXML: it is written as a clip without media and is not read back on import"));
-                    String::new()
-                }
-                None => self.asset(base, rate),
-            };
+            let r = self.asset(base, rate);
             let m = item_media(self.p, base);
             let mrate = m.and_then(|m| m.info.video.as_ref().map(|v| v.frame_rate)).unwrap_or(rate);
             let st = m.and_then(|m| m.info.start_timecode).map(|f| mrate.tick_of(f)).unwrap_or(Tick::ZERO);
@@ -1043,7 +1056,7 @@ impl Exp<'_, '_> {
             let n = e.def().map(|d| d.name).unwrap_or(&e.effect).to_string();
             let r = self.effect(&n, &e.effect);
             let tag = if kind == TrackKind::Video { "filter-video" } else { "filter-audio" };
-            let mut s = format!("<{tag} ref=\"{r}\" name=\"{}\"", crate::xml::escape(&n));
+            let mut s = format!("<{tag} ref=\"{r}\" name=\"{}\"", crate::xml::escape_attr(&n));
             if !e.enabled {
                 s.push_str(" enabled=\"0\"");
             }
@@ -1138,6 +1151,23 @@ impl Exp<'_, '_> {
     }
 }
 
+/// A primary-storyline `<gap>` standing in for a clip FCPXML cannot carry; it keeps the clip's place and length.
+fn gap_el(it: &TrackItem, name: &str, offset: Tick, rate: FrameRate) -> El {
+    El {
+        start: it.start,
+        end: it.end(),
+        local: offset,
+        xml_open: format!(
+            "<gap name=\"{name}\" offset=\"{}\" start=\"{}\" duration=\"{}\"",
+            fmt_time(offset, rate),
+            fmt_time(offset, rate),
+            fmt_time(it.duration, rate)
+        ),
+        children: vec![],
+        close: "gap".into(),
+    }
+}
+
 fn wrap(tag: &str, attrs: &str, params: &[String]) -> String {
     if params.is_empty() { format!("<{tag}{attrs}/>") } else { format!("<{tag}{attrs}>\n{}\n</{tag}>", params.join("\n")) }
 }
@@ -1169,8 +1199,8 @@ fn kparam_xml(
 fn marker_xml(m: &Marker, local: Tick, rate: FrameRate) -> String {
     let tag = if m.kind == MarkerKind::Chapter { "chapter-marker" } else { "marker" };
     let dur = if m.duration > Tick::ZERO { m.duration } else { rate.frame_duration() };
-    let note = if m.comment.is_empty() { String::new() } else { format!(" note=\"{}\"", crate::xml::escape(&m.comment)) };
-    format!("<{tag} start=\"{}\" duration=\"{}\" value=\"{}\"{note}/>", fmt_time(local, rate), fmt_time(dur, rate), crate::xml::escape(&m.name))
+    let note = if m.comment.is_empty() { String::new() } else { format!(" note=\"{}\"", crate::xml::escape_attr(&m.comment)) };
+    format!("<{tag} start=\"{}\" duration=\"{}\" value=\"{}\"{note}/>", fmt_time(local, rate), fmt_time(dur, rate), crate::xml::escape_attr(&m.name))
 }
 
 #[cfg(test)]
diff --git a/crates/interchange/src/omf/bento.rs b/crates/interchange/src/omf/bento.rs
index d3a0a80d7..2648b81b0 100644
--- a/crates/interchange/src/omf/bento.rs
+++ b/crates/interchange/src/omf/bento.rs
@@ -72,6 +72,10 @@ enum Seg {
     At(u64, u32),
 }
 
+/// Bento values are metadata, not essence payloads. Limit reassembled segments so repeated
+/// references cannot amplify a small OMF into an enormous allocation.
+const MAX_VALUE_BYTES: usize = 16 << 20;
+
 /// Builds a Bento container.
 pub(crate) struct Writer {
     data: Vec<u8>,
@@ -311,7 +315,18 @@ impl<'a> Container<'a> {
 
     /// The bytes of a value.
     pub fn value(&self, p: &Prop) -> Result<Vec<u8>, String> {
+        let total = p.segs.iter().try_fold(0usize, |total, s| {
+            let len = match s {
+                Seg::Imm(b) => b.len(),
+                Seg::At(_, len) => *len as usize,
+            };
+            total.checked_add(len).ok_or_else(|| "Bento value length overflows".to_string())
+        })?;
+        if total > MAX_VALUE_BYTES {
+            return Err("Bento value exceeds the decoded-value budget".into());
+        }
         let mut out = Vec::new();
+        out.try_reserve_exact(total).map_err(|_| "cannot allocate Bento value")?;
         for s in &p.segs {
             match s {
                 Seg::Imm(b) => out.extend_from_slice(b),
@@ -355,3 +370,15 @@ impl<'a> Container<'a> {
         key
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn repeated_segments_cannot_expand_a_value_past_its_budget() {
+        let p = Prop { prop: 1, ty: 1, segs: vec![Seg::At(0, MAX_VALUE_BYTES as u32), Seg::Imm(vec![0])] };
+        let c = Container { data: &[], objects: BTreeMap::new(), names: HashMap::new(), by_name: HashMap::new() };
+        assert!(c.value(&p).unwrap_err().contains("budget"));
+    }
+}
diff --git a/crates/interchange/src/omf/read.rs b/crates/interchange/src/omf/read.rs
index 3b2d1b369..b46673602 100644
--- a/crates/interchange/src/omf/read.rs
+++ b/crates/interchange/src/omf/read.rs
@@ -10,6 +10,8 @@ use crate::{Error, Report, Result};
 
 type Uid = [u8; 12];
 
+const MAX_REFERENCE_VISITS: usize = 65_536;
+
 struct R<'a, 'b> {
     c: &'b Container<'a>,
     report: &'b mut Report,
@@ -51,8 +53,10 @@ pub(crate) fn read(bytes: &[u8], report: &mut Report) -> Result<Document> {
     }
     let cmobs: Vec<u32> = mob_list.iter().copied().filter(|&m| class_of(m) == Some(*b"CMOB")).collect();
     let mut referenced = HashSet::new();
+    let mut visited = HashSet::new();
+    let mut visits = 0;
     for &m in &cmobs {
-        r.collect_refs(m, &mut referenced, 0);
+        r.collect_refs(m, &mut referenced, &mut visited, &mut visits, 0);
     }
     let primary: Vec<u32> = r.refs(head, "OMFI:HEAD:PrimaryMobs").into_iter().filter(|m| cmobs.contains(m)).collect();
     let top: Vec<u32> = if !primary.is_empty() {
@@ -122,10 +126,11 @@ impl R<'_, '_> {
         self.i32(o, "OMFI:CPNT:Length").unwrap_or(0).max(0)
     }
 
-    fn collect_refs(&self, o: u32, out: &mut HashSet<Uid>, depth: usize) {
-        if depth > 64 {
+    fn collect_refs(&self, o: u32, out: &mut HashSet<Uid>, visited: &mut HashSet<u32>, visits: &mut usize, depth: usize) {
+        if depth > 64 || !visited.insert(o) || *visits >= MAX_REFERENCE_VISITS {
             return;
         }
+        *visits += 1;
         if self.class(o) == *b"SCLP"
             && let Some(id) = self.uid(o, "OMFI:SCLP:SourceID")
         {
@@ -133,12 +138,12 @@ impl R<'_, '_> {
         }
         for p in ["OMFI:MOBJ:Slots", "OMFI:SEQU:Components", "OMFI:EFFE:EffectSlots"] {
             for c in self.refs(o, p) {
-                self.collect_refs(c, out, depth + 1);
+                self.collect_refs(c, out, visited, visits, depth + 1);
             }
         }
         for p in ["OMFI:MSLT:Segment", "OMFI:ESLT:ArgValue"] {
             if let Some(c) = self.r#ref(o, p) {
-                self.collect_refs(c, out, depth + 1);
+                self.collect_refs(c, out, visited, visits, depth + 1);
             }
         }
     }
diff --git a/crates/interchange/src/otio.rs b/crates/interchange/src/otio.rs
index 421bea985..dbf010247 100644
--- a/crates/interchange/src/otio.rs
+++ b/crates/interchange/src/otio.rs
@@ -113,17 +113,27 @@ fn color_label(s: &str) -> Label {
 // Export
 // ---------------------------------------------------------------------------------------------
 
+/// Most clips an export writes inside nested sequences. OTIO has no references: every use of a nested
+/// sequence is written in full, so a compound clip that holds three uses of another, nested ten deep,
+/// is 3^10 copies, and a 3 KB document made the export run for minutes and grow to gigabytes. Each
+/// clip is about 10 KB of JSON, so this bounds the extra output near 250 MB; real projects use a
+/// few thousand. Past it, further nested sequences are written as gaps, with a warning.
+const MAX_NESTED_ITEMS: usize = 25_000;
+
 struct Exp<'a, 'r> {
     p: &'a Project,
     opts: &'a ExportOptions,
     report: &'r mut Report,
     stack: Vec<ItemId>,
+    /// Clips written inside nested sequences so far, and the limit for it (see [`MAX_NESTED_ITEMS`]).
+    nested_items: usize,
+    nested_limit: usize,
 }
 
 pub(crate) fn export(p: &Project, seq_id: ItemId, opts: &ExportOptions, report: &mut Report) -> Result<String> {
     let seq = p.sequence(seq_id).ok_or(Error::NoSequence(seq_id))?;
     let rate = seq.settings.frame_rate;
-    let mut x = Exp { p, opts, report, stack: vec![seq_id] };
+    let mut x = Exp { p, opts, report, stack: vec![seq_id], nested_items: 0, nested_limit: MAX_NESTED_ITEMS };
     let name = opts.name.clone().unwrap_or_else(|| p.item(seq_id).map(|i| i.name.clone()).unwrap_or_default());
     let stack = x.stack_json(seq_id, &name, None);
     let tl = json!({
@@ -247,6 +257,9 @@ impl Exp<'_, '_> {
     }
 
     fn item_json(&mut self, it: &TrackItem, kind: TrackKind, rate: FrameRate) -> Value {
+        if self.stack.len() > 1 {
+            self.nested_items = self.nested_items.saturating_add(1);
+        }
         let base = base_item(self.p, it.item);
         let mut effects = Vec::new();
         if let Some(h) = it.frame_hold {
@@ -269,6 +282,17 @@ impl Exp<'_, '_> {
                 self.report.warn("recursive nested sequence skipped");
                 return json!({"OTIO_SCHEMA": "Gap.1", "name": "", "source_range": tr(Tick::ZERO, it.duration, rate), "effects": [], "markers": [], "enabled": true, "metadata": {}});
             }
+            if self.nested_items >= self.nested_limit {
+                // once: later nested sequences hit this too, and the message would repeat
+                if self.nested_items < usize::MAX {
+                    self.nested_items = usize::MAX;
+                    self.report.warn(format!(
+                        "more than {} clips written inside nested sequences: the rest are gaps (OTIO repeats a nested sequence for every use)",
+                        self.nested_limit
+                    ));
+                }
+                return json!({"OTIO_SCHEMA": "Gap.1", "name": "", "source_range": tr(Tick::ZERO, it.duration, rate), "effects": [], "markers": [], "enabled": true, "metadata": {}});
+            }
             self.stack.push(base);
             let mut s = self.stack_json(base, &it.name, Some((it.source_in, it.duration, rate)));
             self.stack.pop();
@@ -823,4 +847,58 @@ mod tests {
         let back = read_rt(&rt(t, FrameRate::FPS_24)).unwrap();
         assert!((back - t).abs() <= Tick(1));
     }
+
+    /// A tree of compound clips: `uses` uses of the next level in each, `levels` media levels deep, leaf clips in the last.
+    fn nested_tree(levels: usize, uses: usize) -> String {
+        let mut xml = String::from(
+            r#"<?xml version="1.0"?><fcpxml version="1.10"><resources><format id="f1" frameDuration="100/2500s" width="1920" height="1080"/>
+<asset id="a1" name="c" start="0s" duration="10s" hasVideo="1" format="f1"><media-rep kind="original-media" src="file:///tmp/c.mov"/></asset>"#,
+        );
+        for level in 0..levels {
+            let inner: String = (0..uses)
+                .map(|i| {
+                    if level + 1 < levels {
+                        format!(r#"<ref-clip ref="m{}" offset="{i}s" duration="1s"/>"#, level + 1)
+                    } else {
+                        format!(r#"<asset-clip ref="a1" offset="{i}s" duration="1s"/>"#)
+                    }
+                })
+                .collect();
+            xml.push_str(&format!(r#"<media id="m{level}" name="L{level}"><sequence format="f1" tcStart="0s"><spine>{inner}</spine></sequence></media>"#));
+        }
+        xml.push_str(r#"</resources><library><event name="E"><project name="P"><sequence format="f1" tcStart="0s"><spine><ref-clip ref="m0" offset="0s" duration="1s"/></spine></sequence></project></event></library></fcpxml>"#);
+        xml
+    }
+
+    /// OTIO repeats a nested sequence for every use, so 10 uses nested 3 deep is 111 copies and a 3 KB
+    /// document nested 12 deep made the export run for minutes and grow to gigabytes. Past the limit on clips
+    /// written inside nested sequences the rest are gaps, with one warning. The test lowers the limit so it
+    /// stays tiny: without the check all 112 stacks are written.
+    #[test]
+    fn nested_copies_stop_at_the_limit() {
+        let (imported, _) = crate::import(nested_tree(3, 10).as_bytes(), crate::Format::Fcpxml, None).expect("import succeeds");
+        let seq = imported.sequences[0];
+        let opts = ExportOptions::default();
+        let write = |limit: usize| {
+            let mut report = Report::default();
+            let mut x = Exp { p: &imported.project, opts: &opts, report: &mut report, stack: vec![seq], nested_items: 0, nested_limit: limit };
+            let stacks = x.stack_json(seq, "t", None).to_string().matches("\"Stack.1\"").count();
+            (stacks, report)
+        };
+        let (all, report) = write(usize::MAX - 1);
+        assert_eq!(all, 112);
+        assert!(!report.mentions("nested sequences"), "{report}");
+        let (capped, report) = write(200);
+        assert!(capped < 60, "{capped} stacks");
+        assert!(report.mentions("clips written inside nested sequences"), "{report}");
+        assert_eq!(report.warnings().filter(|w| w.message.contains("inside nested sequences")).map(|w| w.count).sum::<u32>(), 1);
+    }
+
+    /// An ordinary project with nested sequences is far below the real limit and exports untouched.
+    #[test]
+    fn ordinary_nesting_is_not_capped() {
+        let (imported, _) = crate::import(nested_tree(3, 4).as_bytes(), crate::Format::Fcpxml, None).expect("import succeeds");
+        let (_, report) = crate::export(&imported.project, imported.sequences[0], crate::Format::Otio, &ExportOptions::default()).expect("export succeeds");
+        assert!(!report.mentions("inside nested sequences"), "{report}");
+    }
 }
diff --git a/crates/interchange/src/xml.rs b/crates/interchange/src/xml.rs
index 6bd1c51dc..3bc1120bb 100644
--- a/crates/interchange/src/xml.rs
+++ b/crates/interchange/src/xml.rs
@@ -20,6 +20,21 @@ pub(crate) fn escape(s: &str) -> String {
     o
 }
 
+/// Like `escape`, but also encodes whitespace that attribute-value
+/// normalization would otherwise turn into spaces.
+pub(crate) fn escape_attr(s: &str) -> String {
+    let mut o = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '\n' => o.push_str("&#10;"),
+            '\r' => o.push_str("&#13;"),
+            '\t' => o.push_str("&#9;"),
+            c => o.push_str(&escape(c.encode_utf8(&mut [0; 4]))),
+        }
+    }
+    o
+}
+
 /// Pretty-printing XML writer (two-space indent, one element per line).
 pub(crate) struct XmlWriter {
     out: String,
@@ -46,7 +61,7 @@ impl XmlWriter {
         self.out.push('<');
         self.out.push_str(name);
         for (k, v) in attrs {
-            let _ = write!(self.out, " {k}=\"{}\"", escape(v));
+            let _ = write!(self.out, " {k}=\"{}\"", escape_attr(v));
         }
     }
 
@@ -144,6 +159,17 @@ pub(crate) fn num(v: f64) -> String {
 }
 
 pub(crate) fn parse(text: &str) -> Result<roxmltree::Document<'_>, String> {
+    // FCP7 XML commonly carries a plain `<!DOCTYPE xmeml>` declaration, which
+    // roxmltree accepts only with DTD parsing enabled. Internal subsets are not
+    // needed by any supported interchange format and can expand entities far
+    // beyond the input size, so reject them before handing the document to the
+    // parser. External entities remain unresolved because no resolver is set.
+    if let Some(start) = text.find("<!DOCTYPE") {
+        let declaration = &text[start..text[start..].find('>').map_or(text.len(), |end| start + end)];
+        if declaration.contains('[') {
+            return Err("internal DTD subsets are not supported".into());
+        }
+    }
     let opts = roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() };
     roxmltree::Document::parse_with_options(text, opts).map_err(|e| e.to_string())
 }
@@ -169,4 +195,22 @@ mod tests {
         assert_eq!(num(-0.0), "0");
         assert_eq!(num(0.1 + 0.2).parse::<f64>().unwrap(), 0.1 + 0.2);
     }
+
+    #[test]
+    fn attr_whitespace_roundtrip() {
+        let mut w = XmlWriter::new(None);
+        w.open("a", &[("name", "x\ny\tz\r")]);
+        w.text("b", "a\nb");
+        let s = w.finish();
+        let d = parse(&s).unwrap();
+        let a = d.root_element();
+        assert_eq!(a.attribute("name"), Some("x\ny\tz\r"));
+        assert_eq!(child(a, "b").and_then(|b| b.text()), Some("a\nb"));
+    }
+
+    #[test]
+    fn rejects_internal_dtd_entity_expansion() {
+        let text = "<!DOCTYPE root [<!ENTITY word 'expanded'>]><root>&word;</root>";
+        assert_eq!(parse(text).unwrap_err(), "internal DTD subsets are not supported");
+    }
 }
diff --git a/crates/interchange/tests/aaf_omf.rs b/crates/interchange/tests/it/aaf_omf.rs
similarity index 99%
rename from crates/interchange/tests/aaf_omf.rs
rename to crates/interchange/tests/it/aaf_omf.rs
index 3e16492f2..4a065677c 100644
--- a/crates/interchange/tests/aaf_omf.rs
+++ b/crates/interchange/tests/it/aaf_omf.rs
@@ -1,6 +1,6 @@
 //! AAF and OMF: export → import round trips (no external oracle exists for these formats).
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::aaf::{self, AafOptions};
 use filmcraft_interchange::essence::{AudioEssence, EssenceData, EssenceKey, MediaOptions, MixdownVideo, NeedOptions, NestNeeds, audio_needs};
diff --git a/crates/interchange/tests/api.rs b/crates/interchange/tests/it/api.rs
similarity index 99%
rename from crates/interchange/tests/api.rs
rename to crates/interchange/tests/it/api.rs
index 6a212793c..7d19eb3a9 100644
--- a/crates/interchange/tests/api.rs
+++ b/crates/interchange/tests/it/api.rs
@@ -1,6 +1,6 @@
 //! Crate API: detection, merging fragments into a project, timecode rebasing.
 
-mod support;
+use crate::support;
 
 use std::collections::HashSet;
 
diff --git a/crates/interchange/tests/edl.rs b/crates/interchange/tests/it/edl.rs
similarity index 99%
rename from crates/interchange/tests/edl.rs
rename to crates/interchange/tests/it/edl.rs
index 14100d146..db7369589 100644
--- a/crates/interchange/tests/edl.rs
+++ b/crates/interchange/tests/it/edl.rs
@@ -1,6 +1,6 @@
 //! CMX 3600 EDL: golden documents (hand-written from the public CMX 3600 conventions) and round trips.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, ImportOptions, ReelMode, detect, export, export_edl_per_track, import, import_with};
 use filmcraft_project::{ItemKind, MediaRef, TrackKind, TransitionAlign};
diff --git a/crates/interchange/tests/fcp7.rs b/crates/interchange/tests/it/fcp7.rs
similarity index 99%
rename from crates/interchange/tests/fcp7.rs
rename to crates/interchange/tests/it/fcp7.rs
index aad1d5f0e..663ce7337 100644
--- a/crates/interchange/tests/fcp7.rs
+++ b/crates/interchange/tests/it/fcp7.rs
@@ -1,7 +1,7 @@
 //! Final Cut Pro 7 XML (xmeml): a hand-written Premiere-style document (written from the public
 //! xmeml element descriptions) and export → import round trips.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, Imported, detect, export, import};
 use filmcraft_media::Generator;
diff --git a/crates/interchange/tests/fcpxml.rs b/crates/interchange/tests/it/fcpxml.rs
similarity index 93%
rename from crates/interchange/tests/fcpxml.rs
rename to crates/interchange/tests/it/fcpxml.rs
index 12892da57..065c341fd 100644
--- a/crates/interchange/tests/fcpxml.rs
+++ b/crates/interchange/tests/it/fcpxml.rs
@@ -1,7 +1,7 @@
 //! FCPXML: a hand-written document (from the public FCPXML element reference) with connected
 //! clips, a transition, a retimed clip, a gap and a compound clip; plus export → import round trips.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, FcpxmlVersion, Format, detect, import};
 use filmcraft_project::{ItemKind, Keyframe, Label, Marker, MarkerId, MarkerKind, MediaRef, Param, ParamValue, Project, TrackKind, TransitionAlign};
@@ -98,6 +98,24 @@ fn doc() -> String {
     )
 }
 
+#[test]
+fn self_referencing_compound_media_is_ignored_without_recursing() {
+    let xml = r#"<fcpxml version="1.10">
+      <resources>
+        <format id="r1" frameDuration="1/24s" width="1920" height="1080"/>
+        <media id="r2" name="Loop"><sequence format="r1"><spine>
+          <ref-clip ref="r2" offset="0s" start="0s" duration="1s"/>
+        </spine></sequence></media>
+      </resources>
+      <library><event><project name="P"><sequence format="r1"><spine>
+        <ref-clip ref="r2" offset="0s" start="0s" duration="1s"/>
+      </spine></sequence></project></event></library>
+    </fcpxml>"#;
+    let (imported, report) = import(xml.as_bytes(), Format::Fcpxml, None).unwrap();
+    assert!(!imported.sequences.is_empty());
+    assert!(report.mentions("recursive FCPXML media"), "{report:?}");
+}
+
 #[test]
 fn golden_connected_clips() {
     let d = doc();
@@ -163,6 +181,16 @@ fn golden_connected_clips() {
     assert!(matches!(&m.media, MediaRef::File { path } if path == "/proj/boats.mov"));
 }
 
+#[test]
+fn hostile_lane_numbers_do_not_create_sparse_tracks() {
+    let d = doc().replace("lane=\"-1\"", "lane=\"-2147483648\"").replace("lane=\"1\"", "lane=\"2147483647\"");
+    let (imp, rep) = import(d.as_bytes(), Format::Fcpxml, Some("/proj")).unwrap();
+    let s = imp.project.sequence(only_seq(&imp)).unwrap();
+    assert!(s.video_tracks.len() <= 256);
+    assert!(s.audio_tracks.len() <= 256);
+    assert!(rep.has_warnings());
+}
+
 fn project() -> (Project, filmcraft_project::ItemId) {
     let r = FrameRate::FPS_29_97;
     let mut p = Project::new("Lib");
diff --git a/crates/interchange/tests/file_urls.rs b/crates/interchange/tests/it/file_urls.rs
similarity index 100%
rename from crates/interchange/tests/file_urls.rs
rename to crates/interchange/tests/it/file_urls.rs
diff --git a/crates/interchange/tests/it/main.rs b/crates/interchange/tests/it/main.rs
new file mode 100644
index 000000000..81da996e9
--- /dev/null
+++ b/crates/interchange/tests/it/main.rs
@@ -0,0 +1,12 @@
+mod aaf_omf;
+mod api;
+mod edl;
+mod fcp7;
+mod fcpxml;
+mod file_urls;
+mod media_marker_export;
+mod nested_sequence_markers;
+mod otio;
+mod point_markers;
+mod support;
+mod uncarried_clips;
diff --git a/crates/interchange/tests/media_marker_export.rs b/crates/interchange/tests/it/media_marker_export.rs
similarity index 99%
rename from crates/interchange/tests/media_marker_export.rs
rename to crates/interchange/tests/it/media_marker_export.rs
index 752cc8b5d..e209b0693 100644
--- a/crates/interchange/tests/media_marker_export.rs
+++ b/crates/interchange/tests/it/media_marker_export.rs
@@ -1,6 +1,6 @@
 //! Source-media (master clip) markers must survive FCP7 XML export for xmeml 4 and 5.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, export, import};
 use filmcraft_project::{Label, Marker, MarkerId, MarkerKind, TrackKind};
diff --git a/crates/interchange/tests/nested_sequence_markers.rs b/crates/interchange/tests/it/nested_sequence_markers.rs
similarity index 99%
rename from crates/interchange/tests/nested_sequence_markers.rs
rename to crates/interchange/tests/it/nested_sequence_markers.rs
index 9f69b755e..6e4eca92b 100644
--- a/crates/interchange/tests/nested_sequence_markers.rs
+++ b/crates/interchange/tests/it/nested_sequence_markers.rs
@@ -4,7 +4,7 @@
 //! sequence's markers when the using clip has none, and must not put clip instance markers on the
 //! nested sequence.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format};
 use filmcraft_project::{Label, Marker, MarkerId, MarkerKind, TrackKind};
diff --git a/crates/interchange/tests/otio.rs b/crates/interchange/tests/it/otio.rs
similarity index 99%
rename from crates/interchange/tests/otio.rs
rename to crates/interchange/tests/it/otio.rs
index 0b952add4..857de1e79 100644
--- a/crates/interchange/tests/otio.rs
+++ b/crates/interchange/tests/it/otio.rs
@@ -1,7 +1,7 @@
 //! OpenTimelineIO: a hand-written plain OTIO document (from the public OTIO schema docs) with gaps,
 //! transitions, markers and legacy `Clip.1`; lossless round trips through `metadata.filmcraft`.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, detect, import};
 use filmcraft_media::Generator;
diff --git a/crates/interchange/tests/point_markers.rs b/crates/interchange/tests/it/point_markers.rs
similarity index 99%
rename from crates/interchange/tests/point_markers.rs
rename to crates/interchange/tests/it/point_markers.rs
index e0ffb5616..ba96cec58 100644
--- a/crates/interchange/tests/point_markers.rs
+++ b/crates/interchange/tests/it/point_markers.rs
@@ -1,6 +1,6 @@
 //! FCPXML point markers: a one-frame `<marker>` is a FilmCraft point (duration 0), not a range.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, import};
 use filmcraft_project::{Label, Marker, MarkerId, MarkerKind, Project, TrackKind};
diff --git a/crates/interchange/tests/support/mod.rs b/crates/interchange/tests/it/support/mod.rs
similarity index 100%
rename from crates/interchange/tests/support/mod.rs
rename to crates/interchange/tests/it/support/mod.rs
diff --git a/crates/interchange/tests/uncarried_clips.rs b/crates/interchange/tests/it/uncarried_clips.rs
similarity index 89%
rename from crates/interchange/tests/uncarried_clips.rs
rename to crates/interchange/tests/it/uncarried_clips.rs
index 2f0902e26..786547074 100644
--- a/crates/interchange/tests/uncarried_clips.rs
+++ b/crates/interchange/tests/it/uncarried_clips.rs
@@ -2,7 +2,7 @@
 //! export used to lose them without a word (FCP7 XML, OTIO, EDL) or with a line that named
 //! nothing (FCPXML, AAF): every such clip is now named in the export report.
 
-mod support;
+use crate::support;
 
 use filmcraft_interchange::{ExportOptions, Format, Report, export, import};
 use filmcraft_project::{ItemId, ItemKind, Label, ParamValue, Project, TrackKind, find_effect};
@@ -144,3 +144,19 @@ fn fcp7_import_reports_a_clip_item_whose_file_is_not_defined() {
     let (_, report) = import(&bytes, Format::Fcp7Xml, None).unwrap();
     assert!(!report.mentions("does not define"), "{report}");
 }
+
+/// An empty `ref` is not a valid IDREF: Final Cut Pro rejects the whole file. The adjustment layer
+/// on V1 becomes a gap in the primary storyline; the connected title is left out (a `<gap>` can
+/// only sit in a spine). The media clip still references its asset.
+#[test]
+fn fcpxml_has_no_empty_ref_for_a_title() {
+    let (p, s) = project_with_a_title();
+    let (bytes, report) = export_report(&p, s, Format::Fcpxml);
+    let xml = String::from_utf8(bytes).unwrap();
+    assert!(!xml.contains("ref=\"\""), "{xml}");
+    assert!(!xml.contains("Opening"), "{xml}");
+    assert_eq!(xml.matches("<gap name=\"Grade\" offset=").count(), 1, "{xml}");
+    assert!(xml.contains("<asset-clip ref=\"r"), "{xml}");
+    assert!(report.mentions(&format!("{TITLE} is not supported in FCPXML: it is left out")), "{report}");
+    assert!(report.mentions(&format!("{LAYER} is not supported in FCPXML: it is written as a gap")), "{report}");
+}
diff --git a/crates/isobmff/Cargo.toml b/crates/isobmff/Cargo.toml
index c9b848fa0..b24ab1a1a 100644
--- a/crates/isobmff/Cargo.toml
+++ b/crates/isobmff/Cargo.toml
@@ -10,8 +10,7 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-filmcraft-bitstream = { workspace = true }
-thiserror = { workspace = true }
+craft-media = { workspace = true, features = ["isobmff"] }
 
 [dev-dependencies]
 filmcraft-testkit = { workspace = true }
diff --git a/crates/isobmff/README.md b/crates/isobmff/README.md
index 47c31bb43..39ba2ffd6 100644
--- a/crates/isobmff/README.md
+++ b/crates/isobmff/README.md
@@ -1,146 +1,3 @@
 # filmcraft-isobmff
 
-A clean-room ISO Base Media File Format (MP4, ISO/IEC 14496-12/14/15) and QuickTime (MOV) demuxer and muxer,
-written from the public specifications. Layer L0: it depends only on `filmcraft-bitstream` and `thiserror`,
-has no `unsafe`, and builds for `wasm32-unknown-unknown`.
-
-## Demuxing
-
-```rust
-use filmcraft_isobmff::{open, TrackKind};
-
-let file = std::fs::File::open("clip.mov")?;
-let mp4 = open(&file)?;                        // any ByteSource: &[u8], Vec<u8>, Arc<[u8]>, File, ...
-let v = mp4.track_of_kind(TrackKind::Video).unwrap();
-let track = &mp4.tracks[v];
-let i = track.sample_at_presentation_time(1000).unwrap();   // track timescale, edit-adjusted
-let key = track.sync_sample_before(i);          // decode from here
-let bytes = mp4.read_sample(&file, v, key)?;    // raw sample (AVCC/HVCC length-prefixed NALs, ...)
-```
-
-- `ByteSource` (`len`, `read_at(offset, buf)`) is the input abstraction. Implementations exist for `[u8]`,
-  `Vec<u8>`, `&T`, `Arc<T>`, `Box<T>`, and `std::fs::File` on non-wasm targets.
-- `open` reads only top-level box headers, `ftyp`, `moov` and every `moof`. It never reads `mdat`.
-  The one exception is the first sample of a `tmcd` track, which it reads (4 bytes) to get the timecode
-  start frame.
-- `Mp4File`: brands, `is_quicktime`, movie `timescale`/`duration`, `tracks`, `metadata`, `fragmented`,
-  `fragment_count`.
-- `Track`: `id`, `kind` (Video/Audio/Timecode/Subtitle/Other), `handler`, `timescale`, `duration`,
-  `language`, `tkhd` fields (size, matrix, volume, enabled), `entries: Vec<SampleEntry>`, `samples`,
-  `edits`, `edit_offset`, `references` (`tref`), `sdtp`, `sample_groups` (`sbgp`+`sgpd`, raw), `pcm_chunked`.
-  Helpers: `codec()`, `video()`, `audio()`, `presentation_pts(i)`, `sample_at_pts(pts)`,
-  `sample_at_presentation_time(t)`, `sync_sample_before(i)`, `sync_samples()`.
-- `Sample`: `offset`, `size`, `dts`, `pts` (dts + ctts), `duration`, `is_sync` (all samples are sync when
-  `stss` is absent), `description_index`. All times are raw media time in the track timescale.
-- **Edit lists:** `edits` holds the `elst` entries unchanged. `edit_offset` is
-  `leading empty edits (rescaled to media timescale) − first non-empty edit's media_time`, so
-  `presentation time = pts + edit_offset`. This matches ffprobe's timestamps for the common cases
-  (B-frame delay, AAC priming, empty-edit offsets). Multi-segment edits, dwells and rate changes are exposed
-  raw for the caller to interpret.
-- **Uncompressed PCM** (`lpcm`, `sowt`, `twos`, `in24`, `in32`, `fl32`, `fl64`, `raw `, `ipcm`, `fpcm`) is
-  merged to one `Sample` per chunk (`pcm_chunked = true`), with `duration` in frames. This avoids one
-  table entry per audio frame.
-
-### Parsed boxes
-`ftyp`, `moov/mvhd`, `trak/tkhd`, `edts/elst` (v0/v1), `tref`, `mdia/mdhd` (v0/v1, ISO and Mac language
-codes), `hdlr` (ISO and Pascal names), `minf/stbl`: `stsd`, `stts`, `ctts` (v0/v1, read as signed), `stss`,
-`stsc`, `stsz`/`stz2` (4/8/16-bit), `stco`/`co64`, `sdtp`, `sbgp`/`sgpd`. Also `mvex/trex`, `moof/traf/tfhd/tfdt/trun`
-(every `tfhd` base-offset mode and multiple `moof`s), and `udta` metadata (QuickTime `©xxx` atoms,
-`meta/ilst`, and `meta/keys` (mdta)). `uuid`, `free`, `skip`, `wide`, `sidx` and `mfra` are skipped.
-Boxes with 64-bit sizes and with size 0 (runs to the end of the file) are supported.
-
-### Sample entries → `CodecConfig`
-| Format | Config |
-|---|---|
-| `avc1`/`avc3` + `avcC` | `Avc(AvcConfig)`: profile, level, length size, SPS/PPS, extension bytes |
-| `hvc1`/`hev1` + `hvcC` | `Hevc(HevcConfig)`: all header fields plus NAL arrays (`vps()/sps()/pps()`) |
-| `av01` + `av1C` | `Av1(Av1Config)` |
-| `vp09` + `vpcC` | `Vp9(VpcConfig)` |
-| `apch apcn apcs apco ap4h ap4x` | `ProRes { fourcc }` |
-| `jpeg mjpa mjpb` | `Jpeg { fourcc }` |
-| `AVdn AVdh` | `Dnx { fourcc }` |
-| `mp4a` + `esds` (in `wave` too) | `Aac(AacConfig)`: ASC bytes + decoded object type/rate/channels; `Mp3` for OTI 0x69/0x6B |
-| `.mp3`/`.mp2` | `Mp3`: MPEG-1/2 audio of any layer (each frame header names it) |
-| PCM fourccs | `Pcm(PcmConfig)`: bits, float, endianness (`enda`, lpcm flags, `pcmC`), channels, rate |
-| `alac` | `Alac { cookie }` |
-| `Opus` + `dOps` | `Opus(OpusConfig)` |
-| `fLaC` + `dfLa` | `Flac(FlacConfig)` (STREAMINFO decoded) |
-| `ac-3`/`ec-3` | `Ac3 { dac3 }` / `Eac3 { dec3 }` |
-| `tmcd` | `Timecode(TimecodeConfig)`: flags (drop frame), timescale, frame duration, fps, start frame, reel name; `format_frame()` |
-| anything else | `Unknown { fourcc, raw }` |
-
-Video entries also parse `colr` (`nclx`/`nclc`/ICC), `pasp`, `clap`, `fiel`, `gama` and `btrt` into
-`VideoParams`. The MP4 source in `filmcraft-codecs` crops every frame to `clap`'s clean aperture
-before the track's display rotation, and reports that size. Audio entries parse QuickTime sound description v0/v1/v2 into `AudioParams`.
-
-### Robustness
-The parser does not panic on malformed input; every error comes back as an `Error`. Table counts are
-checked against the bytes in their box before anything is allocated. A constant-size `stsz` count is
-clamped to what fits in the file. `trun` counts are checked, and each track is capped at 2²⁶ samples.
-`moov`/`moof` are capped at 1 GiB. Compressed movie headers (`cmov`) are rejected with
-`Error::Unsupported`.
-
-## Muxing
-
-```rust
-use filmcraft_isobmff::*;
-let mut w = Mp4Writer::new(std::io::Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4))?;
-let v = w.add_track(TrackConfig::new(SampleEntry::avc(avcc, 1920, 1080), 90_000))?;
-let mut acfg = TrackConfig::new(SampleEntry::aac(asc, 2, 48_000), 48_000);
-acfg.media_start = Some(1024);                 // AAC encoder delay → edit list
-let a = w.add_track(acfg)?;
-w.write_sample(v, WriteSample { data: &au, duration: 3000, composition_offset: 6000, is_sync: true })?;
-// ... interleave samples in decode order ...
-let bytes = w.finish_faststart()?.into_inner(); // or finish() for moov-at-end
-```
-
-- `Mp4Writer<W: Write + Seek>` streams samples into a single `mdat`. `finish()` appends `moov`.
-  `finish_faststart()` (needs `W: Read + Write + Seek`) moves the media data forward in place and writes
-  `moov` before it. If `mdat` goes past 4 GiB the header becomes a large-size header, and chunk offsets
-  switch to `co64` when needed.
-- Brands: `Brand::Mp4` writes `isom` with `isom iso2 avc1 mp41 mp42`. `Brand::Mov` writes `qt  `, uses
-  QuickTime `hdlr`/Pascal names, and sets `wide` as the placeholder box.
-- Tables written: `stts`, `ctts` (v1 when an offset is negative), `stss` (omitted when every sample is
-  sync), `stsc`, `stsz` (constant or table), `stco`/`co64`. Consecutive samples of one track share a chunk.
-- Sample entries come from `SampleEntry` (`avc`, `hevc`, `prores`, `jpeg`, `aac`, `pcm`, or any demuxed
-  entry). Remuxing copies codec config, `colr`, `pasp`, `clap`, `fiel`, `gama` and `btrt`.
-  PCM is written as `sowt`/`twos` (16-bit) or `raw ` (8-bit) or sound description v2 `lpcm` in MOV, and as
-  `ipcm`/`fpcm` + `pcmC` in MP4. A PCM `write_sample` call can hold any whole number of frames, and the
-  track timescale must equal the sample rate.
-- Edit lists: set `TrackConfig::edits` explicitly, or use `media_start` to get a single edit.
-- Timecode: `add_timecode_track(video, TimecodeConfig, start_frame)` adds a `tmcd` track (with `gmhd`)
-  and a `tref/tmcd` link from the video track.
-- `WriterOptions::metadata` writes `©xxx` text atoms to `udta`.
-- `FragmentedWriter<W: Write>` writes fMP4. The init segment is `ftyp` + `moov` with `mvex/trex`. Each
-  `flush_fragment()` then writes `moof` (`mfhd`, `traf` with default-base-is-moof `tfhd`, `tfdt` v1,
-  `trun` with per-sample duration, size, flags and composition offset) followed by `mdat`.
-
-## Tests
-- Unit tests cover the box reader and hand-built `stbl` edge cases (stz2, co64, ctts v1, empty edits,
-  64-bit and size-0 boxes, uuid/wide/skip), codec config round-trips, and allocation guards.
-- Property tests (`tests/roundtrip.rs`) write random multi-track files, both progressive (MP4/MOV,
-  faststart, PCM, edits) and fragmented, then read them back and compare sample tables and bytes.
-- ffprobe oracle tests (`tests/oracle_demux.rs`) run on ffmpeg-generated fixtures in
-  `target/fixtures/isobmff/`: H.264 with B-frames (MP4 and MOV), HEVC, ProRes 422/4444, MJPEG, DNxHR, PCM
-  s16le/s16be/s24le/f32le, AAC, ALAC, FLAC, Opus, AC-3, VP9, AV1, fragmented (with and without
-  default-base-is-moof), faststart, an edit-list cut, `tmcd` at 29.97 DF and 23.976, and colr/pasp. They
-  compare packet offsets, sizes, pts/dts, durations and key flags, plus stream parameters. Tests skip
-  with a message when ffmpeg or an encoder is missing.
-- Muxer oracle tests (`tests/oracle_mux.rs`) remux fixtures with our writers. They check that
-  `ffmpeg -v error -f null` reports nothing, that ffprobe packets and stream parameters match the source,
-  and that timecode, the AAC priming edit, ipcm and fMP4 output are correct.
-- Mutation fuzzing (`tests/fuzz.rs`) uses a deterministic seed to mutate and truncate synthetic and
-  ffmpeg files, and checks that nothing panics.
-
-## Limitations / not yet supported
-- `presentation time = pts + edit_offset` only applies the leading empty edits and the first media
-  edit. Multi-segment edit lists, dwell edits and non-unity rates are exposed raw. ffmpeg handles an edit
-  that starts mid-frame differently: it snaps to the frame.
-- Other data references (external `alis`/`url ` files), encrypted entries (`encv`/`enca`, `sinf`,
-  `senc`), `cmov`, and QuickTime reference movies are not supported.
-- `sidx`/`mfra` are ignored, because the demuxer scans every top-level box. `stsd` entries with a
-  QuickTime colour table are not decoded.
-- Subtitle and text tracks (`tx3g`, `c608`, `wvtt`) and `mp4v` show up as `Unknown`.
-- Muxer: one `mdat`, no chunk-size or duration limits (the caller controls interleaving), no `sdtp`,
-  `sgpd`/`sbgp` or `cslg` output, ISO-style `meta/ilst` metadata is not written, and the fragmented
-  writer has no PCM, `sidx` or `mfra`.
+A re-export of `craft_media::isobmff`. Documentation: https://github.com/storytold/craft-libs/blob/main/crates/media/README.md
diff --git a/crates/isobmff/src/bytes.rs b/crates/isobmff/src/bytes.rs
deleted file mode 100644
index 97f92690b..000000000
--- a/crates/isobmff/src/bytes.rs
+++ /dev/null
@@ -1,361 +0,0 @@
-//! Low-level helpers: four-character codes, a bounds-checked big-endian cursor, box iteration
-//! over in-memory payloads, and a box builder for the muxers.
-
-use crate::error::{Error, Result};
-use std::fmt;
-
-/// A four-character code (box type, sample entry format, brand, handler type…).
-#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Default)]
-pub struct FourCc(pub [u8; 4]);
-
-impl FourCc {
-    pub const fn new(b: &[u8; 4]) -> Self {
-        FourCc(*b)
-    }
-    pub fn as_u32(self) -> u32 {
-        u32::from_be_bytes(self.0)
-    }
-    /// Lossy string form; `©` (0xA9) is mapped to U+00A9, other non-printables to `?`.
-    pub fn to_string_lossy(self) -> String {
-        self.0
-            .iter()
-            .map(|&b| match b {
-                0xA9 => '©',
-                0x20..=0x7E => b as char,
-                _ => '?',
-            })
-            .collect()
-    }
-}
-
-impl fmt::Display for FourCc {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.to_string_lossy())
-    }
-}
-impl fmt::Debug for FourCc {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "FourCc({:?})", self.to_string_lossy())
-    }
-}
-impl From<&[u8; 4]> for FourCc {
-    fn from(b: &[u8; 4]) -> Self {
-        FourCc(*b)
-    }
-}
-impl PartialEq<[u8; 4]> for FourCc {
-    fn eq(&self, other: &[u8; 4]) -> bool {
-        &self.0 == other
-    }
-}
-impl PartialEq<&[u8; 4]> for FourCc {
-    fn eq(&self, other: &&[u8; 4]) -> bool {
-        &self.0 == *other
-    }
-}
-impl PartialEq<&&[u8; 4]> for FourCc {
-    fn eq(&self, other: &&&[u8; 4]) -> bool {
-        &self.0 == **other
-    }
-}
-
-/// Bounds-checked big-endian cursor over a byte slice.
-#[derive(Clone)]
-pub(crate) struct Cur<'a> {
-    pub data: &'a [u8],
-    pub pos: usize,
-    what: &'static str,
-}
-
-impl<'a> Cur<'a> {
-    pub fn new(data: &'a [u8], what: &'static str) -> Self {
-        Cur { data, pos: 0, what }
-    }
-    pub fn remaining(&self) -> usize {
-        self.data.len().saturating_sub(self.pos)
-    }
-    pub fn rest(&self) -> &'a [u8] {
-        self.data.get(self.pos..).unwrap_or(&[])
-    }
-    pub fn bytes(&mut self, n: usize) -> Result<&'a [u8]> {
-        let end = self.pos.checked_add(n).ok_or(Error::Truncated(self.what))?;
-        let s = self.data.get(self.pos..end).ok_or(Error::Truncated(self.what))?;
-        self.pos = end;
-        Ok(s)
-    }
-    pub fn skip(&mut self, n: usize) -> Result<()> {
-        self.bytes(n).map(|_| ())
-    }
-    pub fn array<const N: usize>(&mut self) -> Result<[u8; N]> {
-        let s = self.bytes(N)?;
-        let mut a = [0u8; N];
-        a.copy_from_slice(s);
-        Ok(a)
-    }
-    pub fn u8(&mut self) -> Result<u8> {
-        Ok(self.array::<1>()?[0])
-    }
-    pub fn u16(&mut self) -> Result<u16> {
-        Ok(u16::from_be_bytes(self.array()?))
-    }
-    pub fn i16(&mut self) -> Result<i16> {
-        Ok(i16::from_be_bytes(self.array()?))
-    }
-    pub fn u24(&mut self) -> Result<u32> {
-        let a = self.array::<3>()?;
-        Ok(((a[0] as u32) << 16) | ((a[1] as u32) << 8) | a[2] as u32)
-    }
-    pub fn u32(&mut self) -> Result<u32> {
-        Ok(u32::from_be_bytes(self.array()?))
-    }
-    pub fn i32(&mut self) -> Result<i32> {
-        Ok(i32::from_be_bytes(self.array()?))
-    }
-    pub fn u64(&mut self) -> Result<u64> {
-        Ok(u64::from_be_bytes(self.array()?))
-    }
-    pub fn i64(&mut self) -> Result<i64> {
-        Ok(i64::from_be_bytes(self.array()?))
-    }
-    pub fn f64(&mut self) -> Result<f64> {
-        Ok(f64::from_be_bytes(self.array()?))
-    }
-    pub fn fourcc(&mut self) -> Result<FourCc> {
-        Ok(FourCc(self.array()?))
-    }
-    /// Full-box header: (version, flags).
-    pub fn full_header(&mut self) -> Result<(u8, u32)> {
-        let v = self.u32()?;
-        Ok(((v >> 24) as u8, v & 0x00FF_FFFF))
-    }
-    /// Read a count and verify that `count * entry_size` bytes remain (allocation guard).
-    pub fn count(&mut self, entry_size: usize) -> Result<usize> {
-        let n = self.u32()? as usize;
-        self.check_count(n, entry_size)?;
-        Ok(n)
-    }
-    pub fn check_count(&self, n: usize, entry_size: usize) -> Result<()> {
-        match n.checked_mul(entry_size) {
-            Some(b) if b <= self.remaining() => Ok(()),
-            _ => Err(Error::Truncated(self.what)),
-        }
-    }
-}
-
-/// Header of one box as found in a byte stream.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) struct BoxHeader {
-    pub kind: FourCc,
-    /// Header length including largesize and uuid extended type.
-    pub header_len: u64,
-    /// Total box size including header; `None` means "extends to end of the enclosing container".
-    pub size: Option<u64>,
-    pub uuid: Option<[u8; 16]>,
-}
-
-/// Parse a box header from `buf` (needs up to 32 bytes; fewer if available).
-pub(crate) fn parse_box_header(buf: &[u8]) -> Result<BoxHeader> {
-    let mut c = Cur::new(buf, "box header");
-    let size32 = c.u32()?;
-    let kind = c.fourcc()?;
-    let mut header_len = 8u64;
-    let size = match size32 {
-        0 => None,
-        1 => {
-            header_len += 8;
-            let s = c.u64()?;
-            Some(s)
-        }
-        s => Some(s as u64),
-    };
-    let uuid = if kind == b"uuid" {
-        header_len += 16;
-        Some(c.array::<16>()?)
-    } else {
-        None
-    };
-    if let Some(s) = size
-        && s < header_len
-    {
-        return Err(Error::Invalid(format!("box '{kind}' size {s} smaller than its header")));
-    }
-    Ok(BoxHeader { kind, header_len, size, uuid })
-}
-
-/// One child box inside an in-memory payload.
-#[derive(Clone, Copy, Debug)]
-pub(crate) struct RawBox<'a> {
-    pub kind: FourCc,
-    pub payload: &'a [u8],
-    #[allow(dead_code)]
-    pub uuid: Option<[u8; 16]>,
-}
-
-/// Iterator over the child boxes of a payload. Yields an error for a malformed box and then stops.
-pub(crate) struct Boxes<'a> {
-    data: &'a [u8],
-    pos: usize,
-    done: bool,
-}
-
-pub(crate) fn boxes(data: &[u8]) -> Boxes<'_> {
-    Boxes { data, pos: 0, done: false }
-}
-
-impl<'a> Iterator for Boxes<'a> {
-    type Item = Result<RawBox<'a>>;
-    fn next(&mut self) -> Option<Self::Item> {
-        if self.done {
-            return None;
-        }
-        let rest = &self.data[self.pos..];
-        if rest.is_empty() {
-            self.done = true;
-            return None;
-        }
-        // QuickTime allows a 32-bit zero terminator at the end of some containers.
-        if rest.len() < 8 {
-            self.done = true;
-            if rest.iter().all(|&b| b == 0) {
-                return None;
-            }
-            return Some(Err(Error::Truncated("box header")));
-        }
-        let h = match parse_box_header(rest) {
-            Ok(h) => h,
-            Err(e) => {
-                self.done = true;
-                return Some(Err(e));
-            }
-        };
-        let size = h.size.unwrap_or(rest.len() as u64);
-        if size > rest.len() as u64 {
-            self.done = true;
-            return Some(Err(Error::Invalid(format!("box '{}' size {} exceeds its container ({} bytes left)", h.kind, size, rest.len()))));
-        }
-        let size = size as usize;
-        let payload = &rest[h.header_len as usize..size];
-        self.pos += size;
-        Some(Ok(RawBox { kind: h.kind, payload, uuid: h.uuid }))
-    }
-}
-
-/// Find the first child of the given type (malformed trailing children are ignored).
-pub(crate) fn find<'a>(data: &'a [u8], kind: &[u8; 4]) -> Option<&'a [u8]> {
-    boxes(data).map_while(|b| b.ok()).find(|b| b.kind == kind).map(|b| b.payload)
-}
-
-/// Growable buffer for building boxes.
-#[derive(Default, Clone, Debug)]
-pub(crate) struct BoxBuf {
-    pub buf: Vec<u8>,
-}
-
-impl BoxBuf {
-    pub fn new() -> Self {
-        Self::default()
-    }
-    /// Begin a box; returns a marker to pass to [`end`](Self::end).
-    pub fn start(&mut self, kind: &[u8; 4]) -> usize {
-        let at = self.buf.len();
-        self.buf.extend_from_slice(&[0, 0, 0, 0]);
-        self.buf.extend_from_slice(kind);
-        at
-    }
-    pub fn start_full(&mut self, kind: &[u8; 4], version: u8, flags: u32) -> usize {
-        let at = self.start(kind);
-        self.u32(((version as u32) << 24) | (flags & 0xFF_FFFF));
-        at
-    }
-    pub fn end(&mut self, at: usize) {
-        let size = (self.buf.len() - at) as u32;
-        self.buf[at..at + 4].copy_from_slice(&size.to_be_bytes());
-    }
-    /// Append a complete box with the given payload.
-    pub fn leaf(&mut self, kind: &[u8; 4], payload: &[u8]) {
-        let at = self.start(kind);
-        self.bytes(payload);
-        self.end(at);
-    }
-    pub fn u8(&mut self, v: u8) {
-        self.buf.push(v);
-    }
-    pub fn u16(&mut self, v: u16) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn i16(&mut self, v: i16) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn u32(&mut self, v: u32) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn i32(&mut self, v: i32) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn u64(&mut self, v: u64) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn i64(&mut self, v: i64) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn f64(&mut self, v: f64) {
-        self.buf.extend_from_slice(&v.to_be_bytes());
-    }
-    pub fn bytes(&mut self, b: &[u8]) {
-        self.buf.extend_from_slice(b);
-    }
-    pub fn zeros(&mut self, n: usize) {
-        self.buf.resize(self.buf.len() + n, 0);
-    }
-    pub fn len(&self) -> usize {
-        self.buf.len()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn header_forms() {
-        let h = parse_box_header(&[0, 0, 0, 16, b'f', b'r', b'e', b'e']).unwrap();
-        assert_eq!((h.kind, h.header_len, h.size), (FourCc(*b"free"), 8, Some(16)));
-        let h = parse_box_header(&[0, 0, 0, 0, b'm', b'd', b'a', b't']).unwrap();
-        assert_eq!(h.size, None);
-        let mut v = vec![0, 0, 0, 1, b'm', b'd', b'a', b't'];
-        v.extend_from_slice(&100u64.to_be_bytes());
-        let h = parse_box_header(&v).unwrap();
-        assert_eq!((h.header_len, h.size), (16, Some(100)));
-        let mut v = vec![0, 0, 0, 30, b'u', b'u', b'i', b'd'];
-        v.extend_from_slice(&[7u8; 16]);
-        let h = parse_box_header(&v).unwrap();
-        assert_eq!((h.header_len, h.uuid), (24, Some([7u8; 16])));
-        assert!(parse_box_header(&[0, 0, 0, 4, b'f', b'r', b'e', b'e']).is_err());
-        assert!(parse_box_header(&[0, 0, 0]).is_err());
-    }
-
-    #[test]
-    fn iterate_children() {
-        let mut b = BoxBuf::new();
-        b.leaf(b"aaaa", &[1, 2]);
-        let m = b.start(b"bbbb");
-        b.leaf(b"cccc", &[]);
-        b.end(m);
-        b.u32(0); // QT terminator
-        let kids: Vec<_> = boxes(&b.buf).collect::<Result<Vec<_>>>().unwrap();
-        assert_eq!(kids.len(), 2);
-        assert_eq!(kids[0].payload, &[1, 2]);
-        assert_eq!(find(&b.buf, b"bbbb").map(|p| p.len()), Some(8));
-        // Oversized child → error, no panic.
-        let bad = [0u8, 0, 0, 99, b'x', b'x', b'x', b'x', 0];
-        assert!(boxes(&bad).next().unwrap().is_err());
-    }
-
-    #[test]
-    fn cursor_bounds() {
-        let mut c = Cur::new(&[0, 0, 0, 5, 1], "t");
-        assert!(c.count(1).is_err());
-        let mut c = Cur::new(&[0xFF, 0xFF, 0xFF, 0xFF], "t");
-        assert!(c.count(usize::MAX).is_err());
-    }
-}
diff --git a/crates/isobmff/src/codec.rs b/crates/isobmff/src/codec.rs
deleted file mode 100644
index 1fbcff9ce..000000000
--- a/crates/isobmff/src/codec.rs
+++ /dev/null
@@ -1,1724 +0,0 @@
-//! Sample entries (`stsd` children) and codec configuration records: parsing and serialization.
-
-use crate::bytes::{BoxBuf, Cur, FourCc, boxes};
-use crate::error::{Error, Result};
-use filmcraft_bitstream::BitReader;
-
-/// One sample description (an entry of `stsd`).
-#[derive(Clone, Debug, PartialEq)]
-pub struct SampleEntry {
-    /// Sample entry format (`avc1`, `mp4a`, `apch`, …).
-    pub format: FourCc,
-    pub data_reference_index: u16,
-    pub codec: CodecConfig,
-    /// Present for visual sample entries.
-    pub video: Option<VideoParams>,
-    /// Present for audio sample entries.
-    pub audio: Option<AudioParams>,
-    /// `btrt` box.
-    pub bitrate: Option<BitRate>,
-}
-
-/// Fields common to all visual sample entries plus the optional descriptive boxes.
-#[derive(Clone, Debug, PartialEq, Default)]
-pub struct VideoParams {
-    pub width: u16,
-    pub height: u16,
-    /// Horizontal/vertical resolution in pixels per inch (16.16 fixed point; 72 dpi = 0x0048_0000).
-    pub horiz_resolution: u32,
-    pub vert_resolution: u32,
-    pub frame_count: u16,
-    pub compressor_name: String,
-    pub depth: u16,
-    /// QuickTime `vendor` / version fields (zero in ISO files).
-    pub vendor: FourCc,
-    pub temporal_quality: u32,
-    pub spatial_quality: u32,
-    pub color: Option<ColorInfo>,
-    /// `pasp`: (hSpacing, vSpacing).
-    pub pixel_aspect: Option<(u32, u32)>,
-    pub clean_aperture: Option<CleanAperture>,
-    pub field_info: Option<FieldInfo>,
-    /// QuickTime `gama` (16.16 fixed point).
-    pub gamma: Option<u32>,
-    /// `mdcv`: mastering display colour volume (SMPTE ST 2086).
-    pub mastering_display: Option<MasteringDisplay>,
-    /// `clli`: content light level (MaxCLL, MaxFALL in cd/m²; 0 = unknown).
-    pub content_light: Option<(u16, u16)>,
-}
-
-/// SMPTE ST 2086 mastering display metadata, in the units of the `mdcv` box and the H.264/HEVC
-/// SEI: chromaticities in 0.00002 steps (order G, B, R as the SEI), luminance in 0.0001 cd/m².
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct MasteringDisplay {
-    pub primaries: [(u16, u16); 3],
-    pub white_point: (u16, u16),
-    pub max_luminance: u32,
-    pub min_luminance: u32,
-}
-
-impl MasteringDisplay {
-    /// BT.2020 primaries, D65, with the given peak and black in cd/m².
-    pub fn bt2020(max_nits: f64, min_nits: f64) -> Self {
-        let q = |v: f64| (v / 0.00002).round() as u16;
-        MasteringDisplay {
-            primaries: [(q(0.170), q(0.797)), (q(0.131), q(0.046)), (q(0.708), q(0.292))],
-            white_point: (q(0.3127), q(0.3290)),
-            max_luminance: (max_nits * 10_000.0).round() as u32,
-            min_luminance: (min_nits * 10_000.0).round() as u32,
-        }
-    }
-    pub fn max_nits(&self) -> f64 {
-        self.max_luminance as f64 / 10_000.0
-    }
-    /// The 24-byte payload shared by `mdcv` and the SEI message.
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut v = Vec::with_capacity(24);
-        for (x, y) in self.primaries {
-            v.extend_from_slice(&x.to_be_bytes());
-            v.extend_from_slice(&y.to_be_bytes());
-        }
-        v.extend_from_slice(&self.white_point.0.to_be_bytes());
-        v.extend_from_slice(&self.white_point.1.to_be_bytes());
-        v.extend_from_slice(&self.max_luminance.to_be_bytes());
-        v.extend_from_slice(&self.min_luminance.to_be_bytes());
-        v
-    }
-    pub fn parse(p: &[u8]) -> Option<Self> {
-        if p.len() < 24 {
-            return None;
-        }
-        let u16_at = |i: usize| u16::from_be_bytes([p[i], p[i + 1]]);
-        let u32_at = |i: usize| u32::from_be_bytes([p[i], p[i + 1], p[i + 2], p[i + 3]]);
-        Some(MasteringDisplay {
-            primaries: [(u16_at(0), u16_at(2)), (u16_at(4), u16_at(6)), (u16_at(8), u16_at(10))],
-            white_point: (u16_at(12), u16_at(14)),
-            max_luminance: u32_at(16),
-            min_luminance: u32_at(20),
-        })
-    }
-}
-
-/// `colr` box contents.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ColorInfo {
-    /// ISO `nclx` (with full-range flag).
-    Nclx { primaries: u16, transfer: u16, matrix: u16, full_range: bool },
-    /// QuickTime `nclc`.
-    Nclc { primaries: u16, transfer: u16, matrix: u16 },
-    /// Embedded ICC profile (`prof` restricted/unrestricted `rICC`).
-    Icc { kind: FourCc, profile: Vec<u8> },
-}
-
-/// `clap` clean aperture (all rationals num/den; offsets are signed).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct CleanAperture {
-    pub width: (u32, u32),
-    pub height: (u32, u32),
-    pub horiz_offset: (i32, u32),
-    pub vert_offset: (i32, u32),
-}
-
-/// QuickTime `fiel`: field count (1 progressive, 2 interlaced) and ordering detail
-/// (0, 1 = top first, 6 = bottom first, 9 / 14 per the QuickTime spec).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct FieldInfo {
-    pub fields: u8,
-    pub detail: u8,
-}
-
-/// `btrt` box.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct BitRate {
-    pub buffer_size: u32,
-    pub max_bitrate: u32,
-    pub avg_bitrate: u32,
-}
-
-/// Fields of audio sample entries (ISO v0 plus QuickTime sound description v1/v2 extensions).
-#[derive(Clone, Debug, PartialEq, Default)]
-pub struct AudioParams {
-    /// QuickTime sound description version (0, 1, 2). ISO files use 0.
-    pub qt_version: u16,
-    pub channels: u32,
-    /// Bits per sample from the entry (16 for most compressed formats).
-    pub sample_size: u16,
-    pub sample_rate: f64,
-    pub compression_id: i16,
-    /// v1 fields.
-    pub samples_per_packet: u32,
-    pub bytes_per_packet: u32,
-    pub bytes_per_frame: u32,
-    pub bytes_per_sample: u32,
-    /// v2 fields.
-    pub const_bits_per_channel: u32,
-    pub lpcm_flags: u32,
-    pub const_bytes_per_packet: u32,
-    pub const_frames_per_packet: u32,
-    /// `enda` little-endian flag inside a QuickTime `wave` box.
-    pub little_endian: Option<bool>,
-}
-
-/// Codec configuration decoded from the sample entry.
-#[derive(Clone, Debug, PartialEq)]
-pub enum CodecConfig {
-    Avc(AvcConfig),
-    Hevc(HevcConfig),
-    Av1(Av1Config),
-    Vp9(VpcConfig),
-    /// Apple ProRes; fourcc is `apch`/`apcn`/`apcs`/`apco`/`ap4h`/`ap4x`.
-    ProRes {
-        fourcc: FourCc,
-    },
-    /// Motion JPEG (`jpeg`, `mjpa`, `mjpb`).
-    Jpeg {
-        fourcc: FourCc,
-    },
-    /// Avid DNxHD/DNxHR (`AVdn`, `AVdh`).
-    Dnx {
-        fourcc: FourCc,
-    },
-    /// Advanced Professional Video (`apv1` + `apvC`).
-    Apv(ApvConfig),
-    Aac(AacConfig),
-    /// MPEG-1/2 audio (esds object type 0x69/0x6B, or QuickTime `.mp3` / `.mp2`). Usually layer
-    /// III, but these name no layer: ffmpeg stores MP2 as `mp4a` + 0x6B. Each frame header has it.
-    Mp3,
-    Pcm(PcmConfig),
-    /// ALAC magic cookie (ALACSpecificConfig, 24 bytes, optionally followed by a channel layout).
-    Alac {
-        cookie: Vec<u8>,
-    },
-    Opus(OpusConfig),
-    Flac(FlacConfig),
-    /// `dac3` payload.
-    Ac3 {
-        dac3: Vec<u8>,
-    },
-    /// `dec3` payload.
-    Eac3 {
-        dec3: Vec<u8>,
-    },
-    Timecode(TimecodeConfig),
-    /// Anything else; `raw` is the full sample entry payload (after the 8-byte box header).
-    Unknown {
-        fourcc: FourCc,
-        raw: Vec<u8>,
-    },
-}
-
-impl CodecConfig {
-    /// A short human-readable codec name.
-    pub fn name(&self) -> &'static str {
-        match self {
-            CodecConfig::Avc(_) => "h264",
-            CodecConfig::Hevc(_) => "hevc",
-            CodecConfig::Av1(_) => "av1",
-            CodecConfig::Vp9(_) => "vp9",
-            CodecConfig::ProRes { .. } => "prores",
-            CodecConfig::Jpeg { .. } => "mjpeg",
-            CodecConfig::Dnx { .. } => "dnxhd",
-            CodecConfig::Apv(_) => "apv",
-            CodecConfig::Aac(_) => "aac",
-            CodecConfig::Mp3 => "mp3",
-            CodecConfig::Pcm(_) => "pcm",
-            CodecConfig::Alac { .. } => "alac",
-            CodecConfig::Opus(_) => "opus",
-            CodecConfig::Flac(_) => "flac",
-            CodecConfig::Ac3 { .. } => "ac3",
-            CodecConfig::Eac3 { .. } => "eac3",
-            CodecConfig::Timecode(_) => "timecode",
-            CodecConfig::Unknown { .. } => "unknown",
-        }
-    }
-}
-
-/// `avcC` — AVCDecoderConfigurationRecord (ISO/IEC 14496-15 §5.3.3).
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct AvcConfig {
-    pub profile: u8,
-    pub compatibility: u8,
-    pub level: u8,
-    /// NAL length field size in bytes (1, 2 or 4).
-    pub length_size: u8,
-    pub sps: Vec<Vec<u8>>,
-    pub pps: Vec<Vec<u8>>,
-    /// Bytes after the PPS list (high-profile extension: chroma format, bit depths, SPS-ext).
-    pub ext: Vec<u8>,
-}
-
-impl AvcConfig {
-    /// Build from parameter sets (NAL units without start codes); profile/level taken from the first SPS.
-    pub fn new(sps: Vec<Vec<u8>>, pps: Vec<Vec<u8>>, length_size: u8) -> Self {
-        let (profile, compatibility, level) = sps.first().filter(|s| s.len() >= 4).map(|s| (s[1], s[2], s[3])).unwrap_or((0, 0, 0));
-        AvcConfig { profile, compatibility, level, length_size, sps, pps, ext: Vec::new() }
-    }
-
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "avcC");
-        let _version = c.u8()?;
-        let profile = c.u8()?;
-        let compatibility = c.u8()?;
-        let level = c.u8()?;
-        let length_size = (c.u8()? & 3) + 1;
-        let nsps = (c.u8()? & 0x1F) as usize;
-        let mut sps = Vec::with_capacity(nsps);
-        for _ in 0..nsps {
-            let n = c.u16()? as usize;
-            sps.push(c.bytes(n)?.to_vec());
-        }
-        let npps = c.u8()? as usize;
-        let mut pps = Vec::with_capacity(npps);
-        for _ in 0..npps {
-            let n = c.u16()? as usize;
-            pps.push(c.bytes(n)?.to_vec());
-        }
-        Ok(AvcConfig { profile, compatibility, level, length_size, sps, pps, ext: c.rest().to_vec() })
-    }
-
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u8(1);
-        b.u8(self.profile);
-        b.u8(self.compatibility);
-        b.u8(self.level);
-        b.u8(0xFC | (self.length_size.clamp(1, 4) - 1));
-        b.u8(0xE0 | (self.sps.len().min(31) as u8));
-        for s in self.sps.iter().take(31) {
-            b.u16(s.len() as u16);
-            b.bytes(s);
-        }
-        b.u8(self.pps.len().min(255) as u8);
-        for p in self.pps.iter().take(255) {
-            b.u16(p.len() as u16);
-            b.bytes(p);
-        }
-        b.bytes(&self.ext);
-        b.buf
-    }
-}
-
-/// One NAL array of an `hvcC` record.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct HevcNalArray {
-    pub completeness: bool,
-    pub nal_type: u8,
-    pub nalus: Vec<Vec<u8>>,
-}
-
-/// `hvcC` — HEVCDecoderConfigurationRecord (ISO/IEC 14496-15 §8.3.3).
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct HevcConfig {
-    pub general_profile_space: u8,
-    pub general_tier_flag: bool,
-    pub general_profile_idc: u8,
-    pub general_profile_compatibility_flags: u32,
-    /// 48 bits of general constraint indicator flags.
-    pub general_constraint_indicator_flags: u64,
-    pub general_level_idc: u8,
-    pub min_spatial_segmentation_idc: u16,
-    pub parallelism_type: u8,
-    pub chroma_format_idc: u8,
-    pub bit_depth_luma: u8,
-    pub bit_depth_chroma: u8,
-    pub avg_frame_rate: u16,
-    pub constant_frame_rate: u8,
-    pub num_temporal_layers: u8,
-    pub temporal_id_nested: bool,
-    pub length_size: u8,
-    pub arrays: Vec<HevcNalArray>,
-}
-
-impl HevcConfig {
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "hvcC");
-        let _version = c.u8()?;
-        let b = c.u8()?;
-        let compat = c.u32()?;
-        let hi = c.u16()? as u64;
-        let lo = c.u32()? as u64;
-        let level = c.u8()?;
-        let min_seg = c.u16()? & 0x0FFF;
-        let par = c.u8()? & 3;
-        let chroma = c.u8()? & 3;
-        let bdl = (c.u8()? & 7) + 8;
-        let bdc = (c.u8()? & 7) + 8;
-        let afr = c.u16()?;
-        let x = c.u8()?;
-        let narrays = c.u8()? as usize;
-        let mut arrays = Vec::new();
-        for _ in 0..narrays {
-            let t = c.u8()?;
-            let n = c.u16()? as usize;
-            c.check_count(n, 2)?;
-            let mut nalus = Vec::with_capacity(n);
-            for _ in 0..n {
-                let len = c.u16()? as usize;
-                nalus.push(c.bytes(len)?.to_vec());
-            }
-            arrays.push(HevcNalArray { completeness: t & 0x80 != 0, nal_type: t & 0x3F, nalus });
-        }
-        Ok(HevcConfig {
-            general_profile_space: b >> 6,
-            general_tier_flag: b & 0x20 != 0,
-            general_profile_idc: b & 0x1F,
-            general_profile_compatibility_flags: compat,
-            general_constraint_indicator_flags: (hi << 32) | lo,
-            general_level_idc: level,
-            min_spatial_segmentation_idc: min_seg,
-            parallelism_type: par,
-            chroma_format_idc: chroma,
-            bit_depth_luma: bdl,
-            bit_depth_chroma: bdc,
-            avg_frame_rate: afr,
-            constant_frame_rate: x >> 6,
-            num_temporal_layers: (x >> 3) & 7,
-            temporal_id_nested: x & 4 != 0,
-            length_size: (x & 3) + 1,
-            arrays,
-        })
-    }
-
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u8(1);
-        b.u8((self.general_profile_space << 6) | ((self.general_tier_flag as u8) << 5) | (self.general_profile_idc & 0x1F));
-        b.u32(self.general_profile_compatibility_flags);
-        b.u16((self.general_constraint_indicator_flags >> 32) as u16);
-        b.u32(self.general_constraint_indicator_flags as u32);
-        b.u8(self.general_level_idc);
-        b.u16(0xF000 | (self.min_spatial_segmentation_idc & 0x0FFF));
-        b.u8(0xFC | (self.parallelism_type & 3));
-        b.u8(0xFC | (self.chroma_format_idc & 3));
-        b.u8(0xF8 | (self.bit_depth_luma.saturating_sub(8) & 7));
-        b.u8(0xF8 | (self.bit_depth_chroma.saturating_sub(8) & 7));
-        b.u16(self.avg_frame_rate);
-        b.u8((self.constant_frame_rate << 6)
-            | ((self.num_temporal_layers & 7) << 3)
-            | ((self.temporal_id_nested as u8) << 2)
-            | (self.length_size.clamp(1, 4) - 1));
-        b.u8(self.arrays.len() as u8);
-        for a in &self.arrays {
-            b.u8(((a.completeness as u8) << 7) | (a.nal_type & 0x3F));
-            b.u16(a.nalus.len() as u16);
-            for n in &a.nalus {
-                b.u16(n.len() as u16);
-                b.bytes(n);
-            }
-        }
-        b.buf
-    }
-
-    fn nalus_of(&self, t: u8) -> Vec<&[u8]> {
-        self.arrays.iter().filter(|a| a.nal_type == t).flat_map(|a| a.nalus.iter().map(|n| n.as_slice())).collect()
-    }
-    pub fn vps(&self) -> Vec<&[u8]> {
-        self.nalus_of(32)
-    }
-    pub fn sps(&self) -> Vec<&[u8]> {
-        self.nalus_of(33)
-    }
-    pub fn pps(&self) -> Vec<&[u8]> {
-        self.nalus_of(34)
-    }
-}
-
-/// `av1C` — AV1CodecConfigurationRecord.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct Av1Config {
-    pub seq_profile: u8,
-    pub seq_level_idx_0: u8,
-    pub seq_tier_0: bool,
-    pub high_bitdepth: bool,
-    pub twelve_bit: bool,
-    pub monochrome: bool,
-    pub chroma_subsampling_x: bool,
-    pub chroma_subsampling_y: bool,
-    pub chroma_sample_position: u8,
-    pub initial_presentation_delay_minus_one: Option<u8>,
-    pub config_obus: Vec<u8>,
-}
-
-impl Av1Config {
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "av1C");
-        let m = c.u8()?;
-        if m & 0x80 == 0 {
-            return Err(Error::Invalid("av1C marker bit not set".into()));
-        }
-        let a = c.u8()?;
-        let b = c.u8()?;
-        let d = c.u8()?;
-        Ok(Av1Config {
-            seq_profile: a >> 5,
-            seq_level_idx_0: a & 0x1F,
-            seq_tier_0: b & 0x80 != 0,
-            high_bitdepth: b & 0x40 != 0,
-            twelve_bit: b & 0x20 != 0,
-            monochrome: b & 0x10 != 0,
-            chroma_subsampling_x: b & 0x08 != 0,
-            chroma_subsampling_y: b & 0x04 != 0,
-            chroma_sample_position: b & 3,
-            initial_presentation_delay_minus_one: if d & 0x10 != 0 { Some(d & 0x0F) } else { None },
-            config_obus: c.rest().to_vec(),
-        })
-    }
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u8(0x81);
-        b.u8((self.seq_profile << 5) | (self.seq_level_idx_0 & 0x1F));
-        b.u8(((self.seq_tier_0 as u8) << 7)
-            | ((self.high_bitdepth as u8) << 6)
-            | ((self.twelve_bit as u8) << 5)
-            | ((self.monochrome as u8) << 4)
-            | ((self.chroma_subsampling_x as u8) << 3)
-            | ((self.chroma_subsampling_y as u8) << 2)
-            | (self.chroma_sample_position & 3));
-        b.u8(match self.initial_presentation_delay_minus_one {
-            Some(d) => 0x10 | (d & 0x0F),
-            None => 0,
-        });
-        b.bytes(&self.config_obus);
-        b.buf
-    }
-}
-
-/// `vpcC` — VP codec configuration (version 1).
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct VpcConfig {
-    pub profile: u8,
-    pub level: u8,
-    pub bit_depth: u8,
-    pub chroma_subsampling: u8,
-    pub full_range: bool,
-    pub colour_primaries: u8,
-    pub transfer_characteristics: u8,
-    pub matrix_coefficients: u8,
-    pub codec_init: Vec<u8>,
-}
-
-impl VpcConfig {
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "vpcC");
-        let (version, _) = c.full_header()?;
-        if version == 0 {
-            // Version 0 draft layout: profile, level, bitDepth(4)|colorSpace(4), chroma(4)|transfer(3)|range(1)
-            let profile = c.u8()?;
-            let level = c.u8()?;
-            let a = c.u8()?;
-            let b = c.u8()?;
-            return Ok(VpcConfig { profile, level, bit_depth: a >> 4, chroma_subsampling: b >> 4, full_range: b & 1 != 0, ..Default::default() });
-        }
-        let profile = c.u8()?;
-        let level = c.u8()?;
-        let a = c.u8()?;
-        let colour_primaries = c.u8()?;
-        let transfer_characteristics = c.u8()?;
-        let matrix_coefficients = c.u8()?;
-        let n = c.u16()? as usize;
-        let codec_init = c.bytes(n)?.to_vec();
-        Ok(VpcConfig {
-            profile,
-            level,
-            bit_depth: a >> 4,
-            chroma_subsampling: (a >> 1) & 7,
-            full_range: a & 1 != 0,
-            colour_primaries,
-            transfer_characteristics,
-            matrix_coefficients,
-            codec_init,
-        })
-    }
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u32(1 << 24);
-        b.u8(self.profile);
-        b.u8(self.level);
-        b.u8((self.bit_depth << 4) | ((self.chroma_subsampling & 7) << 1) | self.full_range as u8);
-        b.u8(self.colour_primaries);
-        b.u8(self.transfer_characteristics);
-        b.u8(self.matrix_coefficients);
-        b.u16(self.codec_init.len() as u16);
-        b.bytes(&self.codec_init);
-        b.buf
-    }
-}
-
-/// AAC (MPEG-4 audio) configuration from `esds`.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct AacConfig {
-    /// AudioSpecificConfig bytes (DecoderSpecificInfo).
-    pub asc: Vec<u8>,
-    /// Audio object type (2 = AAC-LC, 5 = SBR/HE-AAC, 29 = PS …) as signalled first in the ASC.
-    pub object_type: u8,
-    /// Sampling rate signalled by the ASC (core rate; 0 if the ASC is missing).
-    pub sample_rate: u32,
-    /// Channel configuration from the ASC (0 = defined elsewhere).
-    pub channel_config: u8,
-    /// DecoderConfigDescriptor fields.
-    pub max_bitrate: u32,
-    pub avg_bitrate: u32,
-    pub buffer_size: u32,
-}
-
-const AAC_RATES: [u32; 13] = [96000, 88200, 64000, 48000, 44100, 32000, 24000, 22050, 16000, 12000, 11025, 8000, 7350];
-
-impl AacConfig {
-    /// Build from an AudioSpecificConfig, decoding its header fields.
-    pub fn from_asc(asc: Vec<u8>) -> Self {
-        let (object_type, sample_rate, channel_config) = parse_asc(&asc).unwrap_or((0, 0, 0));
-        AacConfig { asc, object_type, sample_rate, channel_config, max_bitrate: 0, avg_bitrate: 0, buffer_size: 0 }
-    }
-    /// Channel count implied by the channel configuration (ISO/IEC 14496-3 Table 1.19 with Amd 4:
-    /// 7 and 12 are 7.1 front / back, 11 is 6.1, 13 is 22.2, 14 is 7.1 with front heights), 0 if
-    /// unspecified (a PCE) or reserved.
-    pub fn channels(&self) -> u32 {
-        match self.channel_config {
-            1..=6 => self.channel_config as u32,
-            11 => 7,
-            7 | 12 | 14 => 8,
-            13 => 24,
-            _ => 0,
-        }
-    }
-}
-
-/// Decode (audio object type, sampling frequency, channel configuration) from an AudioSpecificConfig.
-pub fn parse_asc(asc: &[u8]) -> Option<(u8, u32, u8)> {
-    let mut r = BitReader::new(asc);
-    let aot = |r: &mut BitReader| -> Option<u8> {
-        let t = r.read_bits(5).ok()? as u8;
-        if t == 31 { Some(32 + r.read_bits(6).ok()? as u8) } else { Some(t) }
-    };
-    let rate = |r: &mut BitReader| -> Option<u32> {
-        let i = r.read_bits(4).ok()? as usize;
-        if i == 15 { r.read_bits(24).ok() } else { AAC_RATES.get(i).copied() }
-    };
-    let t = aot(&mut r)?;
-    let sr = rate(&mut r)?;
-    let ch = r.read_bits(4).ok()? as u8;
-    Some((t, sr, ch))
-}
-
-/// Uncompressed PCM description.
-#[derive(Clone, Copy, Debug, PartialEq, Default)]
-pub struct PcmConfig {
-    pub bits: u16,
-    pub float: bool,
-    pub big_endian: bool,
-    /// Signed integer samples (8-bit `raw ` is unsigned).
-    pub signed: bool,
-    pub channels: u32,
-    pub sample_rate: f64,
-}
-
-impl PcmConfig {
-    /// Bytes per interleaved audio frame (all channels).
-    pub fn bytes_per_frame(&self) -> u32 {
-        (self.bits as u32).div_ceil(8) * self.channels.max(1)
-    }
-}
-
-/// `dOps` — Opus specific box.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct OpusConfig {
-    pub output_channels: u8,
-    pub pre_skip: u16,
-    pub input_sample_rate: u32,
-    pub output_gain: i16,
-    pub channel_mapping_family: u8,
-    /// StreamCount, CoupledCount and ChannelMapping bytes when family != 0.
-    pub channel_mapping: Vec<u8>,
-}
-
-impl OpusConfig {
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "dOps");
-        let _version = c.u8()?;
-        Ok(OpusConfig {
-            output_channels: c.u8()?,
-            pre_skip: c.u16()?,
-            input_sample_rate: c.u32()?,
-            output_gain: c.i16()?,
-            channel_mapping_family: c.u8()?,
-            channel_mapping: c.rest().to_vec(),
-        })
-    }
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u8(0);
-        b.u8(self.output_channels);
-        b.u16(self.pre_skip);
-        b.u32(self.input_sample_rate);
-        b.i16(self.output_gain);
-        b.u8(self.channel_mapping_family);
-        b.bytes(&self.channel_mapping);
-        b.buf
-    }
-}
-
-/// `dfLa` — FLAC metadata blocks, with STREAMINFO decoded.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct FlacConfig {
-    /// Raw metadata blocks (each with its 4-byte header) as stored in `dfLa`.
-    pub metadata_blocks: Vec<u8>,
-    pub sample_rate: u32,
-    pub channels: u8,
-    pub bits_per_sample: u8,
-    pub total_samples: u64,
-}
-
-impl FlacConfig {
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        let mut c = Cur::new(data, "dfLa");
-        c.full_header()?;
-        let blocks = c.rest().to_vec();
-        let mut cfg = FlacConfig { metadata_blocks: blocks.clone(), ..Default::default() };
-        let mut b = Cur::new(&blocks, "dfLa");
-        let hdr = b.u32()?;
-        if (hdr >> 24) & 0x7F == 0 {
-            let si = b.bytes(((hdr & 0xFF_FFFF) as usize).min(34))?;
-            if si.len() >= 18 {
-                let mut r = BitReader::new(&si[10..18]);
-                cfg.sample_rate = r.read_bits(20).unwrap_or(0);
-                cfg.channels = r.read_bits(3).unwrap_or(0) as u8 + 1;
-                cfg.bits_per_sample = r.read_bits(5).unwrap_or(0) as u8 + 1;
-                cfg.total_samples = r.read_bits_u64(36).unwrap_or(0);
-            }
-        }
-        Ok(cfg)
-    }
-}
-
-/// QuickTime timecode sample description (`tmcd`) plus the start frame read from its first sample.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct TimecodeConfig {
-    /// Bit 0 drop frame, bit 1 24-hour max, bit 2 negative times OK, bit 3 counter.
-    pub flags: u32,
-    pub timescale: u32,
-    pub frame_duration: u32,
-    /// Nominal frames per second (`numberOfFrames`), e.g. 30 for 29.97.
-    pub frames_per_second: u8,
-    /// Frame number of the first timecode sample (filled in by the demuxer).
-    pub start_frame: Option<u32>,
-    /// Source reel name (`name` box) if present.
-    pub name: Option<String>,
-}
-
-impl TimecodeConfig {
-    pub fn drop_frame(&self) -> bool {
-        self.flags & 1 != 0
-    }
-    /// Format a frame number as `HH:MM:SS:FF` (`;` before the frames when drop-frame).
-    pub fn format_frame(&self, frame: u32) -> String {
-        let fps = self.frames_per_second.max(1) as u64;
-        let mut f = frame as u64;
-        if self.drop_frame() && fps >= 30 {
-            let drop = (fps / 30) * 2; // 2 frames per minute at 30, 4 at 60
-            let per_min = fps * 60 - drop;
-            let per_10 = per_min * 10 + drop;
-            let d = f / per_10;
-            let m = f % per_10;
-            f += drop * 9 * d + if m > drop { drop * ((m - drop) / per_min) } else { 0 };
-        }
-        let ff = f % fps;
-        let s = (f / fps) % 60;
-        let mi = (f / fps / 60) % 60;
-        let h = (f / fps / 3600) % 24;
-        let sep = if self.drop_frame() { ';' } else { ':' };
-        format!("{h:02}:{mi:02}:{s:02}{sep}{ff:02}")
-    }
-}
-
-/// `apvC` — APVDecoderConfigurationBox (`FullBox('apvC', version = 0, flags = 0)` containing
-/// `APVDecoderConfigurationRecord`).
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct ApvConfig {
-    pub profile_idc: u8,
-    pub level_idc: u8,
-    pub band_idc: u8,
-    pub frame_width: u32,
-    pub frame_height: u32,
-    pub chroma_format_idc: u8,
-    pub bit_depth_minus8: u8,
-    pub capture_time_distance: u8,
-    pub capture_time_distance_ignored: bool,
-    pub color_description_present: bool,
-    pub color_primaries: u8,
-    pub transfer_characteristics: u8,
-    pub matrix_coefficients: u8,
-    pub full_range: bool,
-    /// Raw `APVDecoderConfigurationRecord` bytes (after the 4-byte FullBox header).
-    pub raw_record: Vec<u8>,
-}
-
-impl ApvConfig {
-    /// Build from a raw `APVDecoderConfigurationRecord` (starting with `configurationVersion = 1`).
-    pub fn from_record(record: Vec<u8>) -> Result<Self> {
-        let mut c = Cur::new(&record, "apvC");
-        let version = c.u8()?;
-        if version != 1 {
-            return Err(Error::Invalid(format!("unsupported APVDecoderConfigurationRecord version {version}")));
-        }
-        let num_entries = c.u8()?;
-        let mut cfg = ApvConfig { raw_record: record.clone(), ..Default::default() };
-        if num_entries >= 1 && c.remaining() >= 2 {
-            let _pbu_type = c.u8()?;
-            let num_fi = c.u8()?;
-            if num_fi >= 1 && c.remaining() >= 14 {
-                let flags = c.u8()?;
-                cfg.color_description_present = (flags & 0x02) != 0;
-                cfg.capture_time_distance_ignored = (flags & 0x01) != 0;
-                cfg.profile_idc = c.u8()?;
-                cfg.level_idc = c.u8()?;
-                cfg.band_idc = c.u8()?;
-                cfg.frame_width = c.u32()?;
-                cfg.frame_height = c.u32()?;
-                let cb = c.u8()?;
-                cfg.chroma_format_idc = cb >> 4;
-                cfg.bit_depth_minus8 = cb & 0x0F;
-                cfg.capture_time_distance = c.u8()?;
-                if cfg.color_description_present && c.remaining() >= 4 {
-                    cfg.color_primaries = c.u8()?;
-                    cfg.transfer_characteristics = c.u8()?;
-                    cfg.matrix_coefficients = c.u8()?;
-                    cfg.full_range = (c.u8()? & 0x80) != 0;
-                }
-            }
-        }
-        Ok(cfg)
-    }
-
-    /// Parse the payload of an `apvC` box (with or without the 4-byte `FullBox` header).
-    pub fn parse(data: &[u8]) -> Result<Self> {
-        if data.len() >= 5 && data[..4] == [0, 0, 0, 0] && data[4] == 1 {
-            Self::from_record(data[4..].to_vec())
-        } else if !data.is_empty() && data[0] == 1 {
-            Self::from_record(data.to_vec())
-        } else {
-            let mut c = Cur::new(data, "apvC");
-            let (v, _) = c.full_header()?;
-            if v != 0 {
-                return Err(Error::Invalid(format!("unsupported apvC FullBox version {v}")));
-            }
-            Self::from_record(c.rest().to_vec())
-        }
-    }
-
-    /// Serialize the full `apvC` box payload (4-byte `FullBox` header + `APVDecoderConfigurationRecord`).
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        b.u32(0); // FullBox version = 0, flags = 0
-        if !self.raw_record.is_empty() {
-            b.bytes(&self.raw_record);
-            return b.buf;
-        }
-        b.u8(1); // configurationVersion = 1
-        b.u8(1); // number_of_configuration_entry = 1
-        b.u8(1); // pbu_type = 1 (primary frame)
-        b.u8(1); // number_of_frame_info = 1
-        let flags = (if self.color_description_present { 0x02 } else { 0 }) | (if self.capture_time_distance_ignored { 0x01 } else { 0 });
-        b.u8(flags);
-        b.u8(self.profile_idc);
-        b.u8(self.level_idc);
-        b.u8(self.band_idc);
-        b.u32(self.frame_width);
-        b.u32(self.frame_height);
-        b.u8((self.chroma_format_idc << 4) | (self.bit_depth_minus8 & 0x0F));
-        b.u8(self.capture_time_distance);
-        if self.color_description_present {
-            b.u8(self.color_primaries);
-            b.u8(self.transfer_characteristics);
-            b.u8(self.matrix_coefficients);
-            b.u8(if self.full_range { 0x80 } else { 0 });
-        }
-        b.buf
-    }
-}
-
-// ---------------------------------------------------------------------------------------------
-// Parsing
-
-fn is_video_fourcc(f: &[u8; 4]) -> bool {
-    matches!(
-        f,
-        b"avc1"
-            | b"avc3"
-            | b"hvc1"
-            | b"hev1"
-            | b"av01"
-            | b"vp09"
-            | b"vp08"
-            | b"apch"
-            | b"apcn"
-            | b"apcs"
-            | b"apco"
-            | b"ap4h"
-            | b"ap4x"
-            | b"apv1"
-            | b"jpeg"
-            | b"mjpa"
-            | b"mjpb"
-            | b"AVdn"
-            | b"AVdh"
-            | b"mp4v"
-            | b"encv"
-            | b"raw "
-            | b"2vuy"
-            | b"v210"
-    )
-}
-
-fn is_audio_fourcc(f: &[u8; 4]) -> bool {
-    matches!(
-        f,
-        b"mp4a"
-            | b"lpcm"
-            | b"sowt"
-            | b"twos"
-            | b"in24"
-            | b"in32"
-            | b"fl32"
-            | b"fl64"
-            | b"ipcm"
-            | b"fpcm"
-            | b"alac"
-            | b"Opus"
-            | b"fLaC"
-            | b"ac-3"
-            | b"ec-3"
-            | b".mp3"
-            | b".mp2"
-            | b"enca"
-            | b"ulaw"
-            | b"alaw"
-            | b"NONE"
-    )
-}
-
-/// Parse one `stsd` entry. `handler` is the track handler type; `is_qt` selects QuickTime
-/// interpretation of the sound description version field.
-pub(crate) fn parse_sample_entry(format: FourCc, payload: &[u8], handler: FourCc, is_qt: bool) -> Result<SampleEntry> {
-    let mut c = Cur::new(payload, "sample entry");
-    c.skip(6)?;
-    let data_reference_index = c.u16()?;
-    let f = &format.0;
-    let unknown = || CodecConfig::Unknown { fourcc: format, raw: payload.to_vec() };
-    if f == b"tmcd" || (handler == b"tmcd" && !is_video_fourcc(f)) {
-        let mut tc = TimecodeConfig::default();
-        c.skip(4)?;
-        tc.flags = c.u32()?;
-        tc.timescale = c.u32()?;
-        tc.frame_duration = c.u32()?;
-        tc.frames_per_second = c.u8()?;
-        c.skip(1)?;
-        for b in boxes(c.rest()).map_while(|b| b.ok()) {
-            if b.kind == b"name" && b.payload.len() >= 4 {
-                let n = u16::from_be_bytes([b.payload[0], b.payload[1]]) as usize;
-                let s = b.payload.get(4..4 + n).unwrap_or(&b.payload[4..]);
-                tc.name = Some(String::from_utf8_lossy(s).into_owned());
-            }
-        }
-        return Ok(SampleEntry { format, data_reference_index, codec: CodecConfig::Timecode(tc), video: None, audio: None, bitrate: None });
-    }
-    let video_like = is_video_fourcc(f) || (handler == b"vide" && !is_audio_fourcc(f));
-    let audio_like = is_audio_fourcc(f) || (handler == b"soun" && !video_like);
-    if video_like {
-        let mut v = VideoParams::default();
-        let _version = c.u16()?;
-        let _revision = c.u16()?;
-        v.vendor = c.fourcc()?;
-        v.temporal_quality = c.u32()?;
-        v.spatial_quality = c.u32()?;
-        v.width = c.u16()?;
-        v.height = c.u16()?;
-        v.horiz_resolution = c.u32()?;
-        v.vert_resolution = c.u32()?;
-        c.skip(4)?;
-        v.frame_count = c.u16()?;
-        let name = c.bytes(32)?;
-        let n = (name[0] as usize).min(31);
-        v.compressor_name = String::from_utf8_lossy(&name[1..1 + n]).into_owned();
-        v.depth = c.u16()?;
-        let _ctab = c.i16()?;
-        let mut codec = None;
-        let mut bitrate = None;
-        for b in boxes(c.rest()).map_while(|b| b.ok()) {
-            let p = b.payload;
-            match &b.kind.0 {
-                b"avcC" if matches!(f, b"avc1" | b"avc3") => codec = Some(CodecConfig::Avc(AvcConfig::parse(p)?)),
-                b"hvcC" if matches!(f, b"hvc1" | b"hev1") => codec = Some(CodecConfig::Hevc(HevcConfig::parse(p)?)),
-                b"av1C" if f == b"av01" => codec = Some(CodecConfig::Av1(Av1Config::parse(p)?)),
-                b"vpcC" if f == b"vp09" => codec = Some(CodecConfig::Vp9(VpcConfig::parse(p)?)),
-                b"apvC" if f == b"apv1" => codec = Some(CodecConfig::Apv(ApvConfig::parse(p)?)),
-                b"colr" => v.color = parse_colr(p).ok(),
-                b"mdcv" => v.mastering_display = MasteringDisplay::parse(p),
-                b"clli" if p.len() >= 4 => v.content_light = Some((u16::from_be_bytes([p[0], p[1]]), u16::from_be_bytes([p[2], p[3]]))),
-                b"pasp" => {
-                    let mut c = Cur::new(p, "pasp");
-                    v.pixel_aspect = Some((c.u32()?, c.u32()?));
-                }
-                b"clap" => {
-                    let mut c = Cur::new(p, "clap");
-                    v.clean_aperture = Some(CleanAperture {
-                        width: (c.u32()?, c.u32()?),
-                        height: (c.u32()?, c.u32()?),
-                        horiz_offset: (c.i32()?, c.u32()?),
-                        vert_offset: (c.i32()?, c.u32()?),
-                    });
-                }
-                b"fiel" => {
-                    let mut c = Cur::new(p, "fiel");
-                    v.field_info = Some(FieldInfo { fields: c.u8()?, detail: c.u8()? });
-                }
-                b"gama" => v.gamma = Some(Cur::new(p, "gama").u32()?),
-                b"btrt" => bitrate = Some(parse_btrt(p)?),
-                _ => {}
-            }
-        }
-        let codec = match codec {
-            Some(c) => c,
-            None => match f {
-                b"apch" | b"apcn" | b"apcs" | b"apco" | b"ap4h" | b"ap4x" => CodecConfig::ProRes { fourcc: format },
-                b"jpeg" | b"mjpa" | b"mjpb" => CodecConfig::Jpeg { fourcc: format },
-                b"AVdn" | b"AVdh" => CodecConfig::Dnx { fourcc: format },
-                b"apv1" => CodecConfig::Apv(ApvConfig::default()),
-                _ => unknown(),
-            },
-        };
-        return Ok(SampleEntry { format, data_reference_index, codec, video: Some(v), audio: None, bitrate });
-    }
-    if audio_like {
-        let mut a = AudioParams { qt_version: c.u16()?, ..Default::default() };
-        let _revision = c.u16()?;
-        let _vendor = c.u32()?;
-        a.channels = c.u16()? as u32;
-        a.sample_size = c.u16()?;
-        a.compression_id = c.i16()?;
-        let _packet_size = c.u16()?;
-        a.sample_rate = c.u32()? as f64 / 65536.0;
-        if is_qt && a.qt_version == 1 {
-            a.samples_per_packet = c.u32()?;
-            a.bytes_per_packet = c.u32()?;
-            a.bytes_per_frame = c.u32()?;
-            a.bytes_per_sample = c.u32()?;
-        } else if is_qt && a.qt_version == 2 {
-            let _size_of_struct = c.u32()?;
-            a.sample_rate = c.f64()?;
-            a.channels = c.u32()?;
-            let _always = c.u32()?;
-            a.const_bits_per_channel = c.u32()?;
-            a.lpcm_flags = c.u32()?;
-            a.const_bytes_per_packet = c.u32()?;
-            a.const_frames_per_packet = c.u32()?;
-        }
-        // Flatten QuickTime `wave` children into the list of extension boxes.
-        let mut ext: Vec<(FourCc, &[u8])> = Vec::new();
-        for b in boxes(c.rest()).map_while(|b| b.ok()) {
-            if b.kind == b"wave" {
-                for w in boxes(b.payload).map_while(|b| b.ok()) {
-                    ext.push((w.kind, w.payload));
-                }
-            } else {
-                ext.push((b.kind, b.payload));
-            }
-        }
-        let get = |k: &[u8; 4]| ext.iter().find(|(kk, _)| kk == k).map(|(_, p)| *p);
-        if let Some(p) = get(b"enda") {
-            let v = if p.len() >= 2 { u16::from_be_bytes([p[0], p[1]]) } else { p.first().copied().unwrap_or(0) as u16 };
-            a.little_endian = Some(v != 0);
-        }
-        let bitrate = get(b"btrt").and_then(|p| parse_btrt(p).ok());
-        let codec = match f {
-            b"mp4a" => match get(b"esds") {
-                Some(p) => parse_esds(p)?,
-                None => unknown(),
-            },
-            b".mp3" | b".mp2" => CodecConfig::Mp3,
-            b"alac" => match get(b"alac") {
-                Some(p) if p.len() >= 4 => CodecConfig::Alac { cookie: p[4..].to_vec() },
-                _ => unknown(),
-            },
-            b"Opus" => match get(b"dOps") {
-                Some(p) => CodecConfig::Opus(OpusConfig::parse(p)?),
-                None => unknown(),
-            },
-            b"fLaC" => match get(b"dfLa") {
-                Some(p) => CodecConfig::Flac(FlacConfig::parse(p)?),
-                None => unknown(),
-            },
-            b"ac-3" => CodecConfig::Ac3 { dac3: get(b"dac3").unwrap_or(&[]).to_vec() },
-            b"ec-3" => CodecConfig::Eac3 { dec3: get(b"dec3").unwrap_or(&[]).to_vec() },
-            b"lpcm" | b"sowt" | b"twos" | b"in24" | b"in32" | b"fl32" | b"fl64" | b"raw " | b"NONE" => CodecConfig::Pcm(qt_pcm(f, &a)),
-            b"ipcm" | b"fpcm" => {
-                let mut pcm =
-                    PcmConfig { bits: a.sample_size, float: f == b"fpcm", big_endian: true, signed: true, channels: a.channels, sample_rate: a.sample_rate };
-                if let Some(p) = get(b"pcmC") {
-                    let mut c = Cur::new(p, "pcmC");
-                    c.full_header()?;
-                    let flags = c.u8()?;
-                    pcm.big_endian = flags & 1 == 0;
-                    pcm.bits = c.u8()? as u16;
-                }
-                CodecConfig::Pcm(pcm)
-            }
-            _ => unknown(),
-        };
-        return Ok(SampleEntry { format, data_reference_index, codec, video: None, audio: Some(a), bitrate });
-    }
-    Ok(SampleEntry { format, data_reference_index, codec: unknown(), video: None, audio: None, bitrate: None })
-}
-
-fn qt_pcm(f: &[u8; 4], a: &AudioParams) -> PcmConfig {
-    let mut p = PcmConfig { channels: a.channels, sample_rate: a.sample_rate, signed: true, ..Default::default() };
-    match f {
-        b"lpcm" => {
-            p.bits = a.const_bits_per_channel as u16;
-            p.float = a.lpcm_flags & 1 != 0;
-            p.big_endian = a.lpcm_flags & 2 != 0;
-            p.signed = a.lpcm_flags & 4 != 0 || p.float;
-            if p.bits == 0 {
-                p.bits = a.sample_size;
-            }
-        }
-        b"sowt" => {
-            p.bits = if a.sample_size == 0 { 16 } else { a.sample_size };
-        }
-        b"twos" => {
-            p.bits = if a.sample_size == 0 { 16 } else { a.sample_size };
-            p.big_endian = true;
-        }
-        b"raw " | b"NONE" => {
-            p.bits = if a.sample_size == 0 { 8 } else { a.sample_size };
-            p.signed = p.bits != 8;
-            p.big_endian = true;
-        }
-        b"in24" | b"in32" | b"fl32" | b"fl64" => {
-            p.bits = match f {
-                b"in24" => 24,
-                b"in32" | b"fl32" => 32,
-                _ => 64,
-            };
-            p.float = f[0] == b'f';
-            p.big_endian = !a.little_endian.unwrap_or(false);
-        }
-        _ => {}
-    }
-    p
-}
-
-fn parse_btrt(p: &[u8]) -> Result<BitRate> {
-    let mut c = Cur::new(p, "btrt");
-    Ok(BitRate { buffer_size: c.u32()?, max_bitrate: c.u32()?, avg_bitrate: c.u32()? })
-}
-
-fn parse_colr(p: &[u8]) -> Result<ColorInfo> {
-    let mut c = Cur::new(p, "colr");
-    let kind = c.fourcc()?;
-    Ok(match &kind.0 {
-        b"nclx" => ColorInfo::Nclx { primaries: c.u16()?, transfer: c.u16()?, matrix: c.u16()?, full_range: c.u8().map(|v| v & 0x80 != 0).unwrap_or(false) },
-        b"nclc" => ColorInfo::Nclc { primaries: c.u16()?, transfer: c.u16()?, matrix: c.u16()? },
-        _ => ColorInfo::Icc { kind, profile: c.rest().to_vec() },
-    })
-}
-
-fn descriptor(c: &mut Cur) -> Result<(u8, usize)> {
-    let tag = c.u8()?;
-    let mut len = 0usize;
-    for _ in 0..4 {
-        let b = c.u8()?;
-        len = (len << 7) | (b & 0x7F) as usize;
-        if b & 0x80 == 0 {
-            break;
-        }
-    }
-    Ok((tag, len))
-}
-
-fn parse_esds(p: &[u8]) -> Result<CodecConfig> {
-    let mut c = Cur::new(p, "esds");
-    c.full_header()?;
-    let (tag, len) = descriptor(&mut c)?;
-    if tag != 3 {
-        return Err(Error::Invalid(format!("esds: expected ES_Descriptor, got tag {tag}")));
-    }
-    let es = c.bytes(len.min(c.remaining()))?;
-    let mut c = Cur::new(es, "ES_Descriptor");
-    c.u16()?;
-    let fl = c.u8()?;
-    if fl & 0x80 != 0 {
-        c.u16()?;
-    }
-    if fl & 0x40 != 0 {
-        let n = c.u8()? as usize;
-        c.skip(n)?;
-    }
-    if fl & 0x20 != 0 {
-        c.u16()?;
-    }
-    while c.remaining() > 0 {
-        let (tag, len) = descriptor(&mut c)?;
-        let body = c.bytes(len.min(c.remaining()))?;
-        if tag != 4 {
-            continue;
-        }
-        let mut d = Cur::new(body, "DecoderConfigDescriptor");
-        let oti = d.u8()?;
-        let _stream_type = d.u8()?;
-        let buffer_size = d.u24()?;
-        let max_bitrate = d.u32()?;
-        let avg_bitrate = d.u32()?;
-        let mut asc = Vec::new();
-        while d.remaining() > 0 {
-            let (t, l) = descriptor(&mut d)?;
-            let b = d.bytes(l.min(d.remaining()))?;
-            if t == 5 {
-                asc = b.to_vec();
-                break;
-            }
-        }
-        return Ok(match oti {
-            0x69 | 0x6B => CodecConfig::Mp3,
-            _ => {
-                let mut a = AacConfig::from_asc(asc);
-                a.max_bitrate = max_bitrate;
-                a.avg_bitrate = avg_bitrate;
-                a.buffer_size = buffer_size;
-                CodecConfig::Aac(a)
-            }
-        });
-    }
-    Err(Error::Invalid("esds without DecoderConfigDescriptor".into()))
-}
-
-// ---------------------------------------------------------------------------------------------
-// Serialization (muxer)
-
-fn put_descriptor(b: &mut BoxBuf, tag: u8, body: &[u8]) {
-    b.u8(tag);
-    let n = body.len() as u32;
-    // Always use the 4-byte length form for simplicity (as many encoders do).
-    b.u8(0x80 | ((n >> 21) & 0x7F) as u8);
-    b.u8(0x80 | ((n >> 14) & 0x7F) as u8);
-    b.u8(0x80 | ((n >> 7) & 0x7F) as u8);
-    b.u8((n & 0x7F) as u8);
-    b.bytes(body);
-}
-
-pub(crate) fn esds_payload(oti: u8, asc: &[u8], max_bitrate: u32, avg_bitrate: u32, buffer_size: u32) -> Vec<u8> {
-    let mut dcd = BoxBuf::new();
-    dcd.u8(oti);
-    dcd.u8(0x15); // streamType audio (5) << 2 | upstream 0 | reserved 1
-    dcd.u8((buffer_size >> 16) as u8);
-    dcd.u16(buffer_size as u16);
-    dcd.u32(max_bitrate);
-    dcd.u32(avg_bitrate);
-    if !asc.is_empty() {
-        put_descriptor(&mut dcd, 5, asc);
-    }
-    let mut es = BoxBuf::new();
-    es.u16(1); // ES_ID
-    es.u8(0);
-    put_descriptor(&mut es, 4, &dcd.buf);
-    put_descriptor(&mut es, 6, &[2]); // SLConfigDescriptor, predefined = 2 (MP4)
-    let mut b = BoxBuf::new();
-    b.u32(0);
-    put_descriptor(&mut b, 3, &es.buf);
-    b.buf
-}
-
-impl SampleEntry {
-    /// Convenience constructor for a video entry.
-    pub fn video(format: FourCc, codec: CodecConfig, width: u16, height: u16) -> Self {
-        let compressor_name = match &codec {
-            CodecConfig::ProRes { fourcc } => match &fourcc.0 {
-                b"apch" => "Apple ProRes 422 HQ",
-                b"apcn" => "Apple ProRes 422",
-                b"apcs" => "Apple ProRes 422 LT",
-                b"apco" => "Apple ProRes 422 Proxy",
-                b"ap4h" => "Apple ProRes 4444",
-                _ => "Apple ProRes 4444 XQ",
-            },
-            CodecConfig::Jpeg { .. } => "Photo - JPEG",
-            _ => "",
-        };
-        SampleEntry {
-            format,
-            data_reference_index: 1,
-            codec,
-            video: Some(VideoParams {
-                width,
-                height,
-                horiz_resolution: 0x0048_0000,
-                vert_resolution: 0x0048_0000,
-                frame_count: 1,
-                compressor_name: compressor_name.into(),
-                depth: 24,
-                ..Default::default()
-            }),
-            audio: None,
-            bitrate: None,
-        }
-    }
-
-    /// Convenience constructor for an audio entry (ISO v0 layout; the muxer upgrades PCM in MOV to v2).
-    pub fn audio(format: FourCc, codec: CodecConfig, channels: u32, sample_rate: f64, sample_size: u16) -> Self {
-        SampleEntry {
-            format,
-            data_reference_index: 1,
-            codec,
-            video: None,
-            audio: Some(AudioParams { channels, sample_rate, sample_size, ..Default::default() }),
-            bitrate: None,
-        }
-    }
-
-    /// H.264 entry (`avc1`).
-    pub fn avc(cfg: AvcConfig, width: u16, height: u16) -> Self {
-        Self::video(FourCc(*b"avc1"), CodecConfig::Avc(cfg), width, height)
-    }
-    /// HEVC entry (`hvc1`, parameter sets in the config only).
-    pub fn hevc(cfg: HevcConfig, width: u16, height: u16) -> Self {
-        Self::video(FourCc(*b"hvc1"), CodecConfig::Hevc(cfg), width, height)
-    }
-    /// AV1 entry (`av01`).
-    pub fn av1(cfg: Av1Config, width: u16, height: u16) -> Self {
-        Self::video(FourCc(*b"av01"), CodecConfig::Av1(cfg), width, height)
-    }
-    /// ProRes entry; `fourcc` one of `apch`/`apcn`/`apcs`/`apco`/`ap4h`/`ap4x`.
-    pub fn prores(fourcc: FourCc, width: u16, height: u16) -> Self {
-        let mut e = Self::video(fourcc, CodecConfig::ProRes { fourcc }, width, height);
-        if let Some(v) = e.video.as_mut()
-            && matches!(&fourcc.0, b"ap4h" | b"ap4x")
-        {
-            v.depth = 32;
-        }
-        e
-    }
-    /// Avid DNxHD / DNxHR entry (`AVdn`, or `AVdh` for DNxHR).
-    pub fn dnx(fourcc: FourCc, width: u16, height: u16) -> Self {
-        let mut e = Self::video(fourcc, CodecConfig::Dnx { fourcc }, width, height);
-        if let Some(v) = e.video.as_mut() {
-            v.depth = 24;
-        }
-        e
-    }
-    /// Advanced Professional Video entry (`apv1` + `apvC`).
-    pub fn apv(cfg: ApvConfig, width: u16, height: u16) -> Self {
-        let mut e = Self::video(FourCc(*b"apv1"), CodecConfig::Apv(cfg), width, height);
-        if let Some(v) = e.video.as_mut() {
-            v.compressor_name = "APV".into();
-        }
-        e
-    }
-    /// Motion-JPEG entry (`jpeg`).
-    pub fn jpeg(width: u16, height: u16) -> Self {
-        let f = FourCc(*b"jpeg");
-        Self::video(f, CodecConfig::Jpeg { fourcc: f }, width, height)
-    }
-    /// AAC entry (`mp4a` + `esds`) from an AudioSpecificConfig.
-    pub fn aac(asc: Vec<u8>, channels: u32, sample_rate: u32) -> Self {
-        Self::audio(FourCc(*b"mp4a"), CodecConfig::Aac(AacConfig::from_asc(asc)), channels, sample_rate as f64, 16)
-    }
-    /// FLAC entry (`fLaC` + `dfLa`) from the 34-byte STREAMINFO body: the only metadata block.
-    pub fn flac(streaminfo: &[u8; 34]) -> Self {
-        let mut blocks = vec![0x80, 0, 0, 34];
-        blocks.extend_from_slice(streaminfo);
-        let mut full = vec![0; 4];
-        full.extend_from_slice(&blocks);
-        let cfg = FlacConfig::parse(&full).unwrap_or(FlacConfig { metadata_blocks: blocks, ..Default::default() });
-        let (channels, rate, bits) = (u32::from(cfg.channels), f64::from(cfg.sample_rate), u16::from(cfg.bits_per_sample));
-        Self::audio(FourCc(*b"fLaC"), CodecConfig::Flac(cfg), channels, rate, bits)
-    }
-    /// PCM entry. The muxer picks the on-disk format (`sowt`/`twos`/`lpcm` for MOV, `ipcm`/`fpcm` for MP4).
-    pub fn pcm(cfg: PcmConfig) -> Self {
-        Self::audio(FourCc(*b"lpcm"), CodecConfig::Pcm(cfg), cfg.channels, cfg.sample_rate, cfg.bits)
-    }
-
-    /// Serialize as a complete sample entry box. For PCM the format is chosen from the brand.
-    pub(crate) fn write(&self, b: &mut BoxBuf, qt: bool) -> Result<()> {
-        if let CodecConfig::Unknown { fourcc, raw } = &self.codec {
-            let m = b.start(&fourcc.0);
-            b.bytes(raw);
-            b.end(m);
-            return Ok(());
-        }
-        if let CodecConfig::Timecode(tc) = &self.codec {
-            let m = b.start(b"tmcd");
-            b.zeros(6);
-            b.u16(self.data_reference_index);
-            b.u32(0);
-            b.u32(tc.flags);
-            b.u32(tc.timescale);
-            b.u32(tc.frame_duration);
-            b.u8(tc.frames_per_second);
-            b.u8(0);
-            if let Some(name) = &tc.name {
-                let n = b.start(b"name");
-                b.u16(name.len() as u16);
-                b.u16(0);
-                b.bytes(name.as_bytes());
-                b.end(n);
-            }
-            b.end(m);
-            return Ok(());
-        }
-        if let Some(v) = &self.video {
-            let m = b.start(&self.format.0);
-            b.zeros(6);
-            b.u16(self.data_reference_index);
-            b.u16(0);
-            b.u16(0);
-            b.u32(v.vendor.as_u32());
-            b.u32(v.temporal_quality);
-            b.u32(v.spatial_quality);
-            b.u16(v.width);
-            b.u16(v.height);
-            b.u32(v.horiz_resolution);
-            b.u32(v.vert_resolution);
-            b.u32(0);
-            b.u16(v.frame_count);
-            let name = v.compressor_name.as_bytes();
-            let n = name.len().min(31);
-            let mut nb = [0u8; 32];
-            nb[0] = n as u8;
-            nb[1..1 + n].copy_from_slice(&name[..n]);
-            b.bytes(&nb);
-            b.u16(v.depth);
-            b.i16(-1);
-            match &self.codec {
-                CodecConfig::Avc(c) => b.leaf(b"avcC", &c.to_bytes()),
-                CodecConfig::Hevc(c) => b.leaf(b"hvcC", &c.to_bytes()),
-                CodecConfig::Av1(c) => b.leaf(b"av1C", &c.to_bytes()),
-                CodecConfig::Vp9(c) => b.leaf(b"vpcC", &c.to_bytes()),
-                CodecConfig::Apv(c) => b.leaf(b"apvC", &c.to_bytes()),
-                _ => {}
-            }
-            if let Some(g) = v.gamma {
-                b.leaf(b"gama", &g.to_be_bytes());
-            }
-            if let Some(fi) = v.field_info {
-                b.leaf(b"fiel", &[fi.fields, fi.detail]);
-            }
-            if let Some(ci) = &v.color {
-                let m = b.start(b"colr");
-                match ci {
-                    ColorInfo::Nclx { primaries, transfer, matrix, full_range } => {
-                        b.bytes(b"nclx");
-                        b.u16(*primaries);
-                        b.u16(*transfer);
-                        b.u16(*matrix);
-                        b.u8(if *full_range { 0x80 } else { 0 });
-                    }
-                    ColorInfo::Nclc { primaries, transfer, matrix } => {
-                        b.bytes(b"nclc");
-                        b.u16(*primaries);
-                        b.u16(*transfer);
-                        b.u16(*matrix);
-                    }
-                    ColorInfo::Icc { kind, profile } => {
-                        b.bytes(&kind.0);
-                        b.bytes(profile);
-                    }
-                }
-                b.end(m);
-            }
-            if let Some(md) = &v.mastering_display {
-                b.leaf(b"mdcv", &md.to_bytes());
-            }
-            if let Some((cll, fall)) = v.content_light {
-                let mut d = cll.to_be_bytes().to_vec();
-                d.extend_from_slice(&fall.to_be_bytes());
-                b.leaf(b"clli", &d);
-            }
-            if let Some((h, vv)) = v.pixel_aspect {
-                let m = b.start(b"pasp");
-                b.u32(h);
-                b.u32(vv);
-                b.end(m);
-            }
-            if let Some(c) = v.clean_aperture {
-                let m = b.start(b"clap");
-                b.u32(c.width.0);
-                b.u32(c.width.1);
-                b.u32(c.height.0);
-                b.u32(c.height.1);
-                b.i32(c.horiz_offset.0);
-                b.u32(c.horiz_offset.1);
-                b.i32(c.vert_offset.0);
-                b.u32(c.vert_offset.1);
-                b.end(m);
-            }
-            if let Some(br) = self.bitrate {
-                write_btrt(b, br);
-            }
-            b.end(m);
-            return Ok(());
-        }
-        let a = self.audio.clone().ok_or_else(|| Error::Mux("sample entry has neither video nor audio params".into()))?;
-        // Choose the on-disk format and sound description version.
-        let (format, version, pcm) = match &self.codec {
-            CodecConfig::Pcm(p) => {
-                if qt {
-                    if p.bits == 16 && !p.float {
-                        (if p.big_endian { *b"twos" } else { *b"sowt" }, 0u16, Some(*p))
-                    } else if p.bits == 8 && !p.float {
-                        (*b"raw ", 0, Some(*p))
-                    } else {
-                        (*b"lpcm", 2, Some(*p))
-                    }
-                } else {
-                    (if p.float { *b"fpcm" } else { *b"ipcm" }, 0, Some(*p))
-                }
-            }
-            _ => (self.format.0, if qt { a.qt_version.min(2) } else { 0 }, None),
-        };
-        let m = b.start(&format);
-        b.zeros(6);
-        b.u16(self.data_reference_index);
-        if version == 2 {
-            let p = pcm.unwrap_or_default();
-            b.u16(2);
-            b.u16(0);
-            b.u32(0);
-            b.u16(3);
-            b.u16(16);
-            b.i16(-2);
-            b.u16(0);
-            b.u32(65536);
-            b.u32(72);
-            b.f64(p.sample_rate);
-            b.u32(p.channels);
-            b.u32(0x7F00_0000);
-            b.u32(p.bits as u32);
-            let flags = (p.float as u32) | ((p.big_endian as u32) << 1) | (((p.signed && !p.float) as u32) << 2) | 8;
-            b.u32(flags);
-            b.u32(p.bytes_per_frame());
-            b.u32(1);
-        } else {
-            b.u16(version);
-            b.u16(0);
-            b.u32(0);
-            b.u16(a.channels.min(u16::MAX as u32) as u16);
-            b.u16(match pcm {
-                Some(p) => p.bits,
-                None => {
-                    if a.sample_size == 0 {
-                        16
-                    } else {
-                        a.sample_size
-                    }
-                }
-            });
-            b.i16(if version == 1 { a.compression_id } else { 0 });
-            b.u16(0);
-            let sr = if a.sample_rate < 65536.0 { (a.sample_rate * 65536.0).round() as u32 } else { 0 };
-            b.u32(sr);
-            if version == 1 {
-                b.u32(a.samples_per_packet);
-                b.u32(a.bytes_per_packet);
-                b.u32(a.bytes_per_frame);
-                b.u32(a.bytes_per_sample);
-            }
-        }
-        match &self.codec {
-            CodecConfig::Aac(c) => {
-                b.leaf(b"esds", &esds_payload(0x40, &c.asc, c.max_bitrate, c.avg_bitrate, c.buffer_size));
-            }
-            CodecConfig::Mp3 if format == *b"mp4a" => {
-                b.leaf(b"esds", &esds_payload(0x6B, &[], 0, 0, 0));
-            }
-            CodecConfig::Alac { cookie } => {
-                let m = b.start_full(b"alac", 0, 0);
-                b.bytes(cookie);
-                b.end(m);
-            }
-            CodecConfig::Opus(o) => b.leaf(b"dOps", &o.to_bytes()),
-            CodecConfig::Flac(fl) => {
-                let m = b.start_full(b"dfLa", 0, 0);
-                b.bytes(&fl.metadata_blocks);
-                b.end(m);
-            }
-            CodecConfig::Ac3 { dac3 } => b.leaf(b"dac3", dac3),
-            CodecConfig::Eac3 { dec3 } => b.leaf(b"dec3", dec3),
-            CodecConfig::Pcm(p) if !qt => {
-                let m = b.start_full(b"pcmC", 0, 0);
-                b.u8(if p.big_endian { 0 } else { 1 });
-                b.u8(p.bits as u8);
-                b.end(m);
-            }
-            CodecConfig::Pcm(p) if p.channels == 6 => {
-                // QuickTime channel layout: kAudioChannelLayoutTag_MPEG_5_1_A (L R C LFE Ls Rs)
-                let m = b.start_full(b"chan", 0, 0);
-                b.u32((121 << 16) | 6);
-                b.u32(0);
-                b.u32(0);
-                b.end(m);
-            }
-            _ => {}
-        }
-        if let Some(br) = self.bitrate {
-            write_btrt(b, br);
-        }
-        b.end(m);
-        Ok(())
-    }
-}
-
-fn write_btrt(b: &mut BoxBuf, br: BitRate) {
-    let m = b.start(b"btrt");
-    b.u32(br.buffer_size);
-    b.u32(br.max_bitrate);
-    b.u32(br.avg_bitrate);
-    b.end(m);
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn roundtrip(e: &SampleEntry, qt: bool, handler: &[u8; 4]) -> SampleEntry {
-        let mut b = BoxBuf::new();
-        e.write(&mut b, qt).unwrap();
-        let bx = crate::bytes::boxes(&b.buf).next().unwrap().unwrap();
-        parse_sample_entry(bx.kind, bx.payload, FourCc(*handler), qt).unwrap()
-    }
-
-    #[test]
-    fn avcc_roundtrip() {
-        let cfg = AvcConfig::new(vec![vec![0x67, 0x64, 0x00, 0x1F, 0xAC]], vec![vec![0x68, 0xEB]], 4);
-        assert_eq!(cfg.profile, 0x64);
-        assert_eq!(AvcConfig::parse(&cfg.to_bytes()).unwrap(), cfg);
-        let mut e = SampleEntry::avc(cfg, 1920, 1080);
-        e.video.as_mut().unwrap().color = Some(ColorInfo::Nclx { primaries: 1, transfer: 1, matrix: 1, full_range: false });
-        e.video.as_mut().unwrap().pixel_aspect = Some((4, 3));
-        e.video.as_mut().unwrap().field_info = Some(FieldInfo { fields: 2, detail: 9 });
-        e.video.as_mut().unwrap().clean_aperture = Some(CleanAperture { width: (1920, 1), height: (1080, 1), horiz_offset: (-2, 1), vert_offset: (0, 1) });
-        e.video.as_mut().unwrap().mastering_display = Some(MasteringDisplay::bt2020(1000.0, 0.0001));
-        e.video.as_mut().unwrap().content_light = Some((1000, 400));
-        e.bitrate = Some(BitRate { buffer_size: 1, max_bitrate: 2, avg_bitrate: 3 });
-        assert_eq!(roundtrip(&e, false, b"vide"), e);
-        assert_eq!(MasteringDisplay::bt2020(1000.0, 0.0001).max_nits(), 1000.0);
-    }
-
-    #[test]
-    fn hvcc_roundtrip() {
-        let cfg = HevcConfig {
-            general_profile_idc: 1,
-            general_profile_compatibility_flags: 0x6000_0000,
-            general_constraint_indicator_flags: 0x9000_0000_0000,
-            general_level_idc: 93,
-            chroma_format_idc: 1,
-            bit_depth_luma: 8,
-            bit_depth_chroma: 8,
-            length_size: 4,
-            num_temporal_layers: 1,
-            temporal_id_nested: true,
-            arrays: vec![
-                HevcNalArray { completeness: true, nal_type: 32, nalus: vec![vec![0x40, 1]] },
-                HevcNalArray { completeness: true, nal_type: 33, nalus: vec![vec![0x42, 1, 2]] },
-                HevcNalArray { completeness: true, nal_type: 34, nalus: vec![vec![0x44, 1]] },
-            ],
-            ..Default::default()
-        };
-        let back = HevcConfig::parse(&cfg.to_bytes()).unwrap();
-        assert_eq!(back, cfg);
-        assert_eq!(back.sps(), vec![&[0x42u8, 1, 2][..]]);
-    }
-
-    #[test]
-    fn av1_vp9_opus_roundtrip() {
-        let a = Av1Config { seq_profile: 1, seq_level_idx_0: 8, high_bitdepth: true, config_obus: vec![1, 2], ..Default::default() };
-        assert_eq!(Av1Config::parse(&a.to_bytes()).unwrap(), a);
-        let v = VpcConfig {
-            profile: 2,
-            level: 31,
-            bit_depth: 10,
-            chroma_subsampling: 1,
-            full_range: true,
-            colour_primaries: 9,
-            transfer_characteristics: 16,
-            matrix_coefficients: 9,
-            codec_init: vec![],
-        };
-        assert_eq!(VpcConfig::parse(&v.to_bytes()).unwrap(), v);
-        let o = OpusConfig { output_channels: 2, pre_skip: 312, input_sample_rate: 48000, output_gain: 0, channel_mapping_family: 0, channel_mapping: vec![] };
-        assert_eq!(OpusConfig::parse(&o.to_bytes()).unwrap(), o);
-    }
-
-    #[test]
-    fn aac_channel_configuration_is_an_index() {
-        // 48 kHz AAC LC: configuration → channels (Table 1.19 with Amd 4; #922)
-        let channels = |c: u16| AacConfig::from_asc(((2 << 11) | (3 << 7) | (c << 3)).to_be_bytes().to_vec()).channels();
-        assert_eq!([0, 1, 6, 7, 8, 11, 12, 13, 14, 15].map(channels), [0, 1, 6, 8, 0, 7, 8, 24, 8, 0]);
-    }
-
-    #[test]
-    fn aac_esds_roundtrip() {
-        let e = SampleEntry::aac(vec![0x12, 0x10], 2, 44100);
-        match &e.codec {
-            CodecConfig::Aac(a) => {
-                assert_eq!((a.object_type, a.sample_rate, a.channel_config), (2, 44100, 2));
-            }
-            _ => panic!(),
-        }
-        assert_eq!(roundtrip(&e, false, b"soun"), e);
-        assert_eq!(roundtrip(&e, true, b"soun"), e);
-    }
-
-    /// QuickTime's `.mp2` entry (what ffmpeg writes for MP2 in MOV) is MPEG audio, as `.mp3` is,
-    /// even under a handler that does not say "sound" (#800).
-    #[test]
-    fn quicktime_mpeg_audio_entries() {
-        for fourcc in [*b".mp3", *b".mp2"] {
-            let e = SampleEntry::audio(FourCc(fourcc), CodecConfig::Mp3, 2, 48000.0, 16);
-            for handler in [b"soun", b"\0\0\0\0"] {
-                let back = roundtrip(&e, true, handler);
-                assert_eq!(back.codec, CodecConfig::Mp3, "{fourcc:?} {handler:?}");
-                assert_eq!(back.audio.map(|a| (a.channels, a.sample_rate)), Some((2, 48000.0)), "{fourcc:?} {handler:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn pcm_entries() {
-        for (bits, float, be, qt) in [
-            (16, false, false, true),
-            (16, false, true, true),
-            (24, false, false, true),
-            (32, true, false, true),
-            (24, false, true, false),
-            (32, true, false, false),
-        ] {
-            let p = PcmConfig { bits, float, big_endian: be, signed: true, channels: 2, sample_rate: 48000.0 };
-            let e = SampleEntry::pcm(p);
-            let back = roundtrip(&e, qt, b"soun");
-            assert_eq!(back.codec, CodecConfig::Pcm(p), "{bits} {float} {be} {qt}");
-        }
-    }
-
-    #[test]
-    fn timecode_and_prores() {
-        let tc = TimecodeConfig { flags: 1, timescale: 30000, frame_duration: 1001, frames_per_second: 30, start_frame: None, name: Some("reel".into()) };
-        let e = SampleEntry {
-            format: FourCc(*b"tmcd"),
-            data_reference_index: 1,
-            codec: CodecConfig::Timecode(tc.clone()),
-            video: None,
-            audio: None,
-            bitrate: None,
-        };
-        assert_eq!(roundtrip(&e, true, b"tmcd"), e);
-        assert_eq!(tc.format_frame(107892), "01:00:00;00");
-        let nd = TimecodeConfig { flags: 0, frames_per_second: 24, ..Default::default() };
-        assert_eq!(nd.format_frame(86400), "01:00:00:00");
-        let p = SampleEntry::prores(FourCc(*b"apch"), 1920, 1080);
-        assert_eq!(roundtrip(&p, true, b"vide"), p);
-    }
-
-    #[test]
-    fn asc_parse() {
-        assert_eq!(parse_asc(&[0x11, 0x90]), Some((2, 48000, 2)));
-        assert_eq!(parse_asc(&[]), None);
-    }
-}
diff --git a/crates/isobmff/src/demux.rs b/crates/isobmff/src/demux.rs
deleted file mode 100644
index b9b685ac0..000000000
--- a/crates/isobmff/src/demux.rs
+++ /dev/null
@@ -1,1172 +0,0 @@
-//! Demuxer: parses box structure lazily (headers + `moov`/`moof` only) and builds per-track sample tables.
-
-use crate::bytes::{Cur, FourCc, boxes, find, parse_box_header};
-use crate::codec::{CodecConfig, SampleEntry, parse_sample_entry};
-use crate::error::{Error, Result, invalid};
-use crate::source::ByteSource;
-use std::collections::HashMap;
-
-/// Hard cap on per-track sample count (after PCM chunk merging).
-const MAX_SAMPLES: usize = 1 << 26;
-/// Hard cap on the size of an in-memory `moov`/`moof` box.
-const MAX_HEADER_BOX: u64 = 1 << 30;
-
-/// One sample (access unit) of a track, in the track's media timescale.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub struct Sample {
-    /// Absolute byte offset in the file.
-    pub offset: u64,
-    pub size: u32,
-    /// Decode timestamp (raw media time, edit lists not applied).
-    pub dts: i64,
-    /// Presentation timestamp = dts + composition offset (raw media time).
-    pub pts: i64,
-    pub duration: u32,
-    pub is_sync: bool,
-    /// 1-based index into [`Track::entries`].
-    pub description_index: u32,
-}
-
-/// One edit list entry (`elst`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Edit {
-    /// Duration of this edit in the movie timescale.
-    pub segment_duration: u64,
-    /// Start time within the media (track timescale); `-1` marks an empty edit.
-    pub media_time: i64,
-    /// Media rate as 16.16 fixed point (0x0001_0000 = normal speed, 0 = dwell).
-    pub media_rate: i32,
-}
-
-/// Broad classification of a track by its handler.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum TrackKind {
-    Video,
-    Audio,
-    Timecode,
-    Subtitle,
-    Other,
-}
-
-/// A sample-to-group mapping (`sbgp`) with the matching descriptions (`sgpd`) kept raw.
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct SampleGroup {
-    pub grouping_type: FourCc,
-    /// (sample_count, group_description_index) runs.
-    pub runs: Vec<(u32, u32)>,
-    /// Raw description entries from `sgpd`.
-    pub descriptions: Vec<Vec<u8>>,
-}
-
-/// A demuxed track.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Track {
-    pub id: u32,
-    pub kind: TrackKind,
-    pub handler: FourCc,
-    pub handler_name: String,
-    /// Media timescale (`mdhd`).
-    pub timescale: u32,
-    /// Media duration in the media timescale (`mdhd`).
-    pub duration: u64,
-    /// Track duration in the movie timescale (`tkhd`).
-    pub tkhd_duration: u64,
-    /// ISO 639-2/T language code (e.g. `und`, `eng`).
-    pub language: String,
-    /// `tkhd` presentation size (16.16 fixed point converted to integer pixels, rounded down).
-    pub width: u32,
-    pub height: u32,
-    pub enabled: bool,
-    pub alternate_group: u16,
-    /// `tkhd` volume (8.8 fixed point).
-    pub volume: i16,
-    /// `tkhd` transformation matrix.
-    pub matrix: [i32; 9],
-    pub entries: Vec<SampleEntry>,
-    pub samples: Vec<Sample>,
-    pub edits: Vec<Edit>,
-    /// Offset to add to raw pts to get presentation time (track timescale), derived from the
-    /// leading empty edits and the first non-empty edit's `media_time`.
-    pub edit_offset: i64,
-    /// Track references (`tref`): (type, track ids).
-    pub references: Vec<(FourCc, Vec<u32>)>,
-    /// Raw `sdtp` bytes (one per sample) if present.
-    pub sdtp: Vec<u8>,
-    pub sample_groups: Vec<SampleGroup>,
-    /// True if uncompressed audio samples were merged into one [`Sample`] per chunk.
-    pub pcm_chunked: bool,
-    sync_index: Vec<u32>,
-    pts_order: Vec<u32>,
-}
-
-impl Track {
-    /// The first sample entry's codec configuration.
-    pub fn codec(&self) -> Option<&CodecConfig> {
-        self.entries.first().map(|e| &e.codec)
-    }
-    pub fn video(&self) -> Option<&crate::codec::VideoParams> {
-        self.entries.first().and_then(|e| e.video.as_ref())
-    }
-    /// Clockwise quarter turns (0–3) the `tkhd` matrix applies for display, or None when it is not
-    /// a pure 0/90/180/270° rotation (mirrored, scaled or sheared — left to the caller).
-    ///
-    /// ISO/IEC 14496-12 §8.3.2: a sample point (p, q) is displayed at p′ = a·p + c·q + x,
-    /// q′ = b·p + d·q + y for the matrix {a, b, u, c, d, v, x, y, w}, with y pointing down. So
-    /// {0, 1, −1, 0} sends the top row to the right-hand column (90° clockwise — iPhone portrait
-    /// video), {−1, 0, 0, −1} is 180° and {0, −1, 1, 0} is 270°. Only the signs matter: a·d − b·c
-    /// carries the scale, which the presentation size already reflects.
-    pub fn display_rotation(&self) -> Option<u8> {
-        let [a, b, _, c, d, _, _, _, _] = self.matrix;
-        match (a.signum(), b.signum(), c.signum(), d.signum()) {
-            (1, 0, 0, 1) => Some(0),
-            (0, 1, -1, 0) => Some(1),
-            (-1, 0, 0, -1) => Some(2),
-            (0, -1, 1, 0) => Some(3),
-            _ => None,
-        }
-    }
-    pub fn audio(&self) -> Option<&crate::codec::AudioParams> {
-        self.entries.first().and_then(|e| e.audio.as_ref())
-    }
-    /// Presentation (edit-adjusted) pts of sample `i`.
-    pub fn presentation_pts(&self, i: usize) -> Option<i64> {
-        self.samples.get(i).map(|s| s.pts.saturating_add(self.edit_offset))
-    }
-    /// Index of the sample being presented at raw media time `pts` (the last sample, in
-    /// presentation order, whose pts is ≤ `pts`; the first sample if `pts` precedes all).
-    pub fn sample_at_pts(&self, pts: i64) -> Option<usize> {
-        if self.pts_order.is_empty() {
-            return None;
-        }
-        let k = self.pts_order.partition_point(|&i| self.samples[i as usize].pts <= pts);
-        Some(self.pts_order[k.saturating_sub(1)] as usize)
-    }
-    /// Like [`sample_at_pts`](Self::sample_at_pts) but for edit-adjusted presentation time.
-    pub fn sample_at_presentation_time(&self, t: i64) -> Option<usize> {
-        self.sample_at_pts(t.saturating_sub(self.edit_offset))
-    }
-    /// The closest sync sample at or before `index` (decode order); 0 if there is none.
-    pub fn sync_sample_before(&self, index: usize) -> usize {
-        let k = self.sync_index.partition_point(|&i| i as usize <= index);
-        if k == 0 { 0 } else { self.sync_index[k - 1] as usize }
-    }
-    /// Indices of all sync samples.
-    pub fn sync_samples(&self) -> &[u32] {
-        &self.sync_index
-    }
-
-    fn finish_indexes(&mut self) {
-        self.sync_index = self.samples.iter().enumerate().filter(|(_, s)| s.is_sync).map(|(i, _)| i as u32).collect();
-        let mut order: Vec<u32> = (0..self.samples.len() as u32).collect();
-        order.sort_by_key(|&i| (self.samples[i as usize].pts, i));
-        self.pts_order = order;
-    }
-}
-
-/// Text metadata from `udta` (QuickTime `©xxx` atoms and iTunes-style `meta/ilst`, incl. `keys`).
-#[derive(Clone, Debug, PartialEq, Eq, Default)]
-pub struct Metadata {
-    pub entries: Vec<(String, String)>,
-}
-
-impl Metadata {
-    pub fn get(&self, key: &str) -> Option<&str> {
-        self.entries.iter().find(|(k, _)| k == key).map(|(_, v)| v.as_str())
-    }
-    /// Title from `©nam` or the `com.apple.quicktime.title` key.
-    pub fn title(&self) -> Option<&str> {
-        self.get("©nam").or_else(|| self.get("com.apple.quicktime.title")).or_else(|| self.get("title"))
-    }
-}
-
-/// A parsed MP4/MOV file (headers and sample tables; media data stays in the source).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Mp4File {
-    pub major_brand: FourCc,
-    pub minor_version: u32,
-    pub compatible_brands: Vec<FourCc>,
-    /// QuickTime file (major brand `qt  ` or no `ftyp`).
-    pub is_quicktime: bool,
-    /// Movie timescale (`mvhd`).
-    pub timescale: u32,
-    /// Movie duration in the movie timescale (`mvhd`; for fragmented files, the longest track).
-    pub duration: u64,
-    pub tracks: Vec<Track>,
-    pub metadata: Metadata,
-    /// File uses movie fragments (`mvex` present).
-    pub fragmented: bool,
-    /// Byte offset of the `moov` box.
-    pub moov_offset: u64,
-    /// Number of `moof` boxes found.
-    pub fragment_count: usize,
-}
-
-impl Mp4File {
-    /// Read the bytes of sample `index` of track `track` (index into [`tracks`](Self::tracks)).
-    pub fn read_sample<S: ByteSource + ?Sized>(&self, src: &S, track: usize, index: usize) -> Result<Vec<u8>> {
-        let t = self.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        let s = t.samples.get(index).ok_or(Error::NoSuchSample(index))?;
-        read_range(src, s.offset, s.size as u64)
-    }
-    pub fn sample_at_pts(&self, track: usize, pts: i64) -> Option<usize> {
-        self.tracks.get(track)?.sample_at_pts(pts)
-    }
-    pub fn sync_sample_before(&self, track: usize, index: usize) -> Option<usize> {
-        Some(self.tracks.get(track)?.sync_sample_before(index))
-    }
-    /// First track of the given kind.
-    pub fn track_of_kind(&self, kind: TrackKind) -> Option<usize> {
-        self.tracks.iter().position(|t| t.kind == kind)
-    }
-}
-
-fn read_range<S: ByteSource + ?Sized>(src: &S, offset: u64, size: u64) -> Result<Vec<u8>> {
-    let end = offset.checked_add(size).ok_or(Error::Truncated("sample"))?;
-    if end > src.len() {
-        return Err(Error::Truncated("sample data"));
-    }
-    let mut v = vec![0u8; size as usize];
-    src.read_at(offset, &mut v)?;
-    Ok(v)
-}
-
-/// Parse an MP4/MOV file. Only box headers, `ftyp`, `moov` and `moof` boxes are read.
-pub fn open<S: ByteSource>(src: S) -> Result<Mp4File> {
-    let len = src.len();
-    let mut offset = 0u64;
-    let mut ftyp: Option<Vec<u8>> = None;
-    let mut moov: Option<(u64, Vec<u8>)> = None;
-    let mut moofs: Vec<(u64, Vec<u8>)> = Vec::new();
-    while offset + 8 <= len {
-        let n = (len - offset).min(32) as usize;
-        let mut hb = [0u8; 32];
-        src.read_at(offset, &mut hb[..n])?;
-        let h = parse_box_header(&hb[..n])?;
-        let size = h.size.unwrap_or(len - offset);
-        let end = offset.saturating_add(size).min(len);
-        let body_len = end.saturating_sub(offset + h.header_len);
-        let read_body = |max: u64| -> Result<Vec<u8>> {
-            if body_len > max {
-                return Err(Error::TooLarge("header box"));
-            }
-            read_range(&src, offset + h.header_len, body_len)
-        };
-        match &h.kind.0 {
-            b"ftyp" if ftyp.is_none() => ftyp = Some(read_body(1 << 16)?),
-            b"moov" if moov.is_none() => moov = Some((offset, read_body(MAX_HEADER_BOX)?)),
-            b"moof" => moofs.push((offset, read_body(MAX_HEADER_BOX)?)),
-            _ => {}
-        }
-        if h.size.is_none() {
-            break;
-        }
-        offset = offset.saturating_add(size);
-    }
-    let (moov_offset, moov) = moov.ok_or(Error::NoMoov)?;
-    let mut file = Mp4File {
-        major_brand: FourCc::default(),
-        minor_version: 0,
-        compatible_brands: Vec::new(),
-        is_quicktime: true,
-        timescale: 0,
-        duration: 0,
-        tracks: Vec::new(),
-        metadata: Metadata::default(),
-        fragmented: false,
-        moov_offset,
-        fragment_count: moofs.len(),
-    };
-    if let Some(f) = &ftyp {
-        let mut c = Cur::new(f, "ftyp");
-        file.major_brand = c.fourcc()?;
-        file.minor_version = c.u32().unwrap_or(0);
-        while c.remaining() >= 4 {
-            file.compatible_brands.push(c.fourcc()?);
-        }
-        file.is_quicktime = file.major_brand == b"qt  ";
-    }
-    let mut trex: HashMap<u32, Trex> = HashMap::new();
-    let mut trak_payloads = Vec::new();
-    for b in boxes(&moov) {
-        let b = b?;
-        match &b.kind.0 {
-            b"cmov" => return Err(Error::Unsupported("compressed movie header (cmov)".into())),
-            b"mvhd" => {
-                let mut c = Cur::new(b.payload, "mvhd");
-                let (v, _) = c.full_header()?;
-                if v == 1 {
-                    c.skip(16)?;
-                    file.timescale = c.u32()?;
-                    file.duration = c.u64()?;
-                } else {
-                    c.skip(8)?;
-                    file.timescale = c.u32()?;
-                    file.duration = c.u32()? as u64;
-                }
-            }
-            b"trak" => trak_payloads.push(b.payload),
-            b"mvex" => {
-                file.fragmented = true;
-                for m in boxes(b.payload).map_while(|b| b.ok()) {
-                    if m.kind == b"trex" {
-                        let mut c = Cur::new(m.payload, "trex");
-                        c.full_header()?;
-                        let id = c.u32()?;
-                        trex.insert(id, Trex { description_index: c.u32()?, duration: c.u32()?, size: c.u32()?, flags: c.u32()? });
-                    }
-                }
-            }
-            b"udta" => parse_udta(b.payload, &mut file.metadata),
-            b"meta" => parse_meta(b.payload, &mut file.metadata),
-            _ => {}
-        }
-    }
-    for p in trak_payloads {
-        let t = parse_trak(p, &file, len)?;
-        file.tracks.push(t);
-    }
-    // Movie fragments.
-    let mut next_dts: Vec<i64> = file.tracks.iter().map(|t| t.samples.last().map(|s| s.dts + s.duration as i64).unwrap_or(0)).collect();
-    for (moof_off, moof) in &moofs {
-        parse_moof(*moof_off, moof, &mut file.tracks, &trex, &mut next_dts, len)?;
-    }
-    for t in &mut file.tracks {
-        if file.fragmented && !moofs.is_empty() {
-            let d: u64 = t.samples.iter().map(|s| s.duration as u64).sum();
-            t.duration = t.duration.max(d);
-            if t.timescale > 0 && file.timescale > 0 {
-                let md = (t.duration as u128 * file.timescale as u128 / t.timescale as u128) as u64;
-                file.duration = file.duration.max(md);
-            }
-        }
-        t.finish_indexes();
-        // Timecode start frame from the first sample.
-        if let Some(CodecConfig::Timecode(tc)) = t.entries.first_mut().map(|e| &mut e.codec)
-            && let Some(s) = t.samples.first()
-            && s.size >= 4
-        {
-            let mut b = [0u8; 4];
-            if src.read_at(s.offset, &mut b).is_ok() {
-                tc.start_frame = Some(u32::from_be_bytes(b));
-            }
-        }
-    }
-    Ok(file)
-}
-
-#[derive(Clone, Copy, Debug, Default)]
-struct Trex {
-    description_index: u32,
-    duration: u32,
-    size: u32,
-    flags: u32,
-}
-
-fn parse_language(code: u16) -> String {
-    if code < 0x400 {
-        // QuickTime Macintosh language code.
-        return if code == 0 { "eng".into() } else { "und".into() };
-    }
-    let c = |s: u16| (((code >> s) & 0x1F) as u8 + 0x60) as char;
-    let s: String = [c(10), c(5), c(0)].into_iter().collect();
-    if s.chars().all(|ch| ch.is_ascii_lowercase()) { s } else { "und".into() }
-}
-
-fn rescale(v: i128, from: u32, to: u32) -> i64 {
-    if from == 0 {
-        return 0;
-    }
-    (v * to as i128 / from as i128).clamp(i64::MIN as i128, i64::MAX as i128) as i64
-}
-
-fn parse_trak(p: &[u8], file: &Mp4File, file_len: u64) -> Result<Track> {
-    let mut t = Track {
-        id: 0,
-        kind: TrackKind::Other,
-        handler: FourCc::default(),
-        handler_name: String::new(),
-        timescale: 0,
-        duration: 0,
-        tkhd_duration: 0,
-        language: "und".into(),
-        width: 0,
-        height: 0,
-        enabled: true,
-        alternate_group: 0,
-        volume: 0,
-        matrix: [0x10000, 0, 0, 0, 0x10000, 0, 0, 0, 0x4000_0000],
-        entries: Vec::new(),
-        samples: Vec::new(),
-        edits: Vec::new(),
-        edit_offset: 0,
-        references: Vec::new(),
-        sdtp: Vec::new(),
-        sample_groups: Vec::new(),
-        pcm_chunked: false,
-        sync_index: Vec::new(),
-        pts_order: Vec::new(),
-    };
-    let mut mdia = None;
-    for b in boxes(p) {
-        let b = b?;
-        match &b.kind.0 {
-            b"tkhd" => {
-                let mut c = Cur::new(b.payload, "tkhd");
-                let (v, flags) = c.full_header()?;
-                t.enabled = flags & 1 != 0;
-                if v == 1 {
-                    c.skip(16)?;
-                    t.id = c.u32()?;
-                    c.skip(4)?;
-                    t.tkhd_duration = c.u64()?;
-                } else {
-                    c.skip(8)?;
-                    t.id = c.u32()?;
-                    c.skip(4)?;
-                    t.tkhd_duration = c.u32()? as u64;
-                }
-                c.skip(8)?;
-                let _layer = c.i16()?;
-                t.alternate_group = c.u16()?;
-                t.volume = c.i16()?;
-                c.skip(2)?;
-                for m in t.matrix.iter_mut() {
-                    *m = c.i32()?;
-                }
-                t.width = c.u32()? >> 16;
-                t.height = c.u32()? >> 16;
-            }
-            b"edts" => {
-                if let Some(e) = find(b.payload, b"elst") {
-                    let mut c = Cur::new(e, "elst");
-                    let (v, _) = c.full_header()?;
-                    let n = c.count(if v == 1 { 20 } else { 12 })?;
-                    for _ in 0..n {
-                        let (segment_duration, media_time) = if v == 1 { (c.u64()?, c.i64()?) } else { (c.u32()? as u64, c.i32()? as i64) };
-                        t.edits.push(Edit { segment_duration, media_time, media_rate: c.i32()? });
-                    }
-                }
-            }
-            b"tref" => {
-                for r in boxes(b.payload).map_while(|b| b.ok()) {
-                    let ids = r.payload.as_chunks::<4>().0.iter().map(|c| u32::from_be_bytes([c[0], c[1], c[2], c[3]])).collect();
-                    t.references.push((r.kind, ids));
-                }
-            }
-            b"mdia" => mdia = Some(b.payload),
-            _ => {}
-        }
-    }
-    let mdia = mdia.ok_or_else(|| Error::Invalid("trak without mdia".into()))?;
-    let mut minf = None;
-    for b in boxes(mdia) {
-        let b = b?;
-        match &b.kind.0 {
-            b"mdhd" => {
-                let mut c = Cur::new(b.payload, "mdhd");
-                let (v, _) = c.full_header()?;
-                if v == 1 {
-                    c.skip(16)?;
-                    t.timescale = c.u32()?;
-                    t.duration = c.u64()?;
-                } else {
-                    c.skip(8)?;
-                    t.timescale = c.u32()?;
-                    t.duration = c.u32()? as u64;
-                }
-                t.language = parse_language(c.u16()?);
-            }
-            b"hdlr" => {
-                let mut c = Cur::new(b.payload, "hdlr");
-                c.full_header()?;
-                let _pre = c.u32()?;
-                t.handler = c.fourcc()?;
-                c.skip(12)?;
-                let name = c.rest();
-                // ISO: null-terminated UTF-8; QuickTime: Pascal string.
-                let s = if !name.is_empty() && name[0] as usize == name.len() - 1 && name.len() > 1 {
-                    &name[1..]
-                } else {
-                    name.split(|&b| b == 0).next().unwrap_or(&[])
-                };
-                t.handler_name = String::from_utf8_lossy(s).into_owned();
-            }
-            b"minf" => minf = Some(b.payload),
-            _ => {}
-        }
-    }
-    t.kind = match &t.handler.0 {
-        b"vide" => TrackKind::Video,
-        b"soun" => TrackKind::Audio,
-        b"tmcd" => TrackKind::Timecode,
-        b"text" | b"sbtl" | b"subt" | b"clcp" => TrackKind::Subtitle,
-        _ => TrackKind::Other,
-    };
-    // Edit offset in media timescale.
-    let mut empty = 0i128;
-    for e in &t.edits {
-        if e.media_time == -1 {
-            empty += e.segment_duration as i128;
-        } else {
-            t.edit_offset = rescale(empty, file.timescale, t.timescale).saturating_sub(e.media_time);
-            break;
-        }
-    }
-    if let Some(stbl) = minf.and_then(|m| find(m, b"stbl")) {
-        parse_stbl(stbl, &mut t, file.is_quicktime, file_len)?;
-    }
-    Ok(t)
-}
-
-struct SttsCursor<'a> {
-    runs: &'a [(u32, u32)],
-    run: usize,
-    used: u32,
-}
-
-impl SttsCursor<'_> {
-    /// Advance by `n` samples, returning the summed duration.
-    fn take(&mut self, mut n: u64) -> u64 {
-        let mut total = 0u64;
-        while n > 0 && self.run < self.runs.len() {
-            let (count, delta) = self.runs[self.run];
-            let avail = (count - self.used) as u64;
-            let k = avail.min(n);
-            total = total.saturating_add(k.saturating_mul(delta as u64));
-            n -= k;
-            self.used += k as u32;
-            if self.used >= count {
-                self.run += 1;
-                self.used = 0;
-            }
-        }
-        total
-    }
-    fn next_value(&mut self) -> u32 {
-        while self.run < self.runs.len() && self.runs[self.run].0 == 0 {
-            self.run += 1;
-        }
-        let Some(&(_, d)) = self.runs.get(self.run) else { return 0 };
-        self.take(1);
-        d
-    }
-}
-
-fn parse_stbl(stbl: &[u8], t: &mut Track, is_qt: bool, file_len: u64) -> Result<()> {
-    let mut stts: Vec<(u32, u32)> = Vec::new();
-    let mut ctts: Vec<(u32, u32)> = Vec::new();
-    let mut stss: Option<Vec<u32>> = None;
-    let mut stsc: Vec<(u32, u32, u32)> = Vec::new();
-    let mut const_size = 0u32;
-    let mut sample_count = 0usize;
-    let mut sizes: Vec<u32> = Vec::new();
-    let mut chunks: Vec<u64> = Vec::new();
-    let mut sbgp: Vec<(FourCc, Vec<(u32, u32)>)> = Vec::new();
-    let mut sgpd: HashMap<FourCc, Vec<Vec<u8>>> = HashMap::new();
-    for b in boxes(stbl) {
-        let b = b?;
-        let mut c = Cur::new(b.payload, "stbl child");
-        match &b.kind.0 {
-            b"stsd" => {
-                c.full_header()?;
-                let n = c.count(8)?;
-                for e in boxes(c.rest()).take(n) {
-                    let e = e?;
-                    t.entries.push(parse_sample_entry(e.kind, e.payload, t.handler, is_qt)?);
-                }
-            }
-            b"stts" => {
-                c.full_header()?;
-                let n = c.count(8)?;
-                stts = (0..n).map(|_| Ok((c.u32()?, c.u32()?))).collect::<Result<_>>()?;
-            }
-            b"ctts" => {
-                c.full_header()?;
-                let n = c.count(8)?;
-                ctts = (0..n).map(|_| Ok((c.u32()?, c.u32()?))).collect::<Result<_>>()?;
-            }
-            b"stss" => {
-                c.full_header()?;
-                let n = c.count(4)?;
-                let mut v: Vec<u32> = (0..n).map(|_| c.u32()).collect::<Result<_>>()?;
-                v.sort_unstable();
-                stss = Some(v);
-            }
-            b"stsc" => {
-                c.full_header()?;
-                let n = c.count(12)?;
-                stsc = (0..n).map(|_| Ok((c.u32()?, c.u32()?, c.u32()?))).collect::<Result<_>>()?;
-            }
-            b"stsz" => {
-                c.full_header()?;
-                const_size = c.u32()?;
-                let n = c.u32()? as usize;
-                if const_size == 0 {
-                    c.check_count(n, 4)?;
-                    sizes = (0..n).map(|_| c.u32()).collect::<Result<_>>()?;
-                    sample_count = n;
-                } else {
-                    // Samples of constant size must fit in the file: clamp absurd counts.
-                    sample_count = (n as u64).min(file_len / const_size as u64) as usize;
-                }
-            }
-            b"stz2" => {
-                c.full_header()?;
-                let field = c.u32()? & 0xFF;
-                let n = c.u32()? as usize;
-                let bits = match field {
-                    4 | 8 | 16 => field as usize,
-                    _ => return invalid(format!("stz2 field size {field}")),
-                };
-                if n.checked_mul(bits).is_none_or(|b| b.div_ceil(8) > c.remaining()) {
-                    return Err(Error::Truncated("stz2"));
-                }
-                let d = c.rest();
-                sizes = (0..n)
-                    .map(|i| match bits {
-                        4 => ((d[i / 2] >> if i % 2 == 0 { 4 } else { 0 }) & 0xF) as u32,
-                        8 => d[i] as u32,
-                        _ => u16::from_be_bytes([d[2 * i], d[2 * i + 1]]) as u32,
-                    })
-                    .collect();
-                sample_count = n;
-            }
-            b"stco" => {
-                c.full_header()?;
-                let n = c.count(4)?;
-                chunks = (0..n).map(|_| c.u32().map(|v| v as u64)).collect::<Result<_>>()?;
-            }
-            b"co64" => {
-                c.full_header()?;
-                let n = c.count(8)?;
-                chunks = (0..n).map(|_| c.u64()).collect::<Result<_>>()?;
-            }
-            b"sdtp" => {
-                c.full_header()?;
-                t.sdtp = c.rest().to_vec();
-            }
-            b"sbgp" => {
-                let (v, _) = c.full_header()?;
-                let gt = c.fourcc()?;
-                if v == 1 {
-                    c.u32()?;
-                }
-                let n = c.count(8)?;
-                let runs = (0..n).map(|_| Ok((c.u32()?, c.u32()?))).collect::<Result<_>>()?;
-                sbgp.push((gt, runs));
-            }
-            b"sgpd" => {
-                let (v, _) = c.full_header()?;
-                let gt = c.fourcc()?;
-                let default_len = if v >= 1 { c.u32()? } else { 0 };
-                if v >= 2 {
-                    c.u32()?;
-                }
-                let n = c.count(0)?;
-                let mut descs = Vec::new();
-                for _ in 0..n {
-                    let l = if v >= 1 && default_len == 0 { c.u32()? } else { default_len };
-                    if l == 0 {
-                        // Version 0 without known length: keep the remainder as a single entry.
-                        descs.push(c.rest().to_vec());
-                        break;
-                    }
-                    descs.push(c.bytes(l as usize)?.to_vec());
-                }
-                sgpd.insert(gt, descs);
-            }
-            _ => {}
-        }
-    }
-    t.sample_groups = sbgp.into_iter().map(|(gt, runs)| SampleGroup { grouping_type: gt, runs, descriptions: sgpd.remove(&gt).unwrap_or_default() }).collect();
-    if sample_count == 0 || chunks.is_empty() || stsc.is_empty() {
-        return Ok(());
-    }
-    if stsc[0].0 == 0 || stsc.windows(2).any(|w| w[1].0 <= w[0].0) {
-        return invalid("stsc first_chunk values are not increasing from 1");
-    }
-    let pcm = match t.entries.first().map(|e| &e.codec) {
-        Some(CodecConfig::Pcm(p)) if const_size != 0 => Some(*p),
-        _ => None,
-    };
-    let mut stts_c = SttsCursor { runs: &stts, run: 0, used: 0 };
-    let mut ctts_c = SttsCursor { runs: &ctts, run: 0, used: 0 };
-    let mut samples = Vec::new();
-    let mut sidx = 0usize;
-    let mut dts = 0i64;
-    let mut stsc_i = 0usize;
-    if let Some(p) = pcm {
-        t.pcm_chunked = true;
-        let a = t.audio().cloned().unwrap_or_default();
-        let frame_bytes = |frames: u64| -> u64 {
-            if a.qt_version == 1 && a.bytes_per_frame > 0 && a.samples_per_packet > 0 {
-                frames / a.samples_per_packet as u64 * a.bytes_per_frame as u64
-            } else if const_size > 1 {
-                frames * const_size as u64
-            } else {
-                frames * p.bytes_per_frame() as u64
-            }
-        };
-        if chunks.len() > MAX_SAMPLES {
-            return Err(Error::TooLarge("chunk count"));
-        }
-        samples.reserve(chunks.len());
-        for (ci, &off) in chunks.iter().enumerate() {
-            while stsc_i + 1 < stsc.len() && stsc[stsc_i + 1].0 as usize <= ci + 1 {
-                stsc_i += 1;
-            }
-            let spc = (stsc[stsc_i].1 as usize).min(sample_count - sidx);
-            if spc == 0 {
-                continue;
-            }
-            let dur = stts_c.take(spc as u64);
-            let size = frame_bytes(spc as u64).min(u32::MAX as u64) as u32;
-            samples.push(Sample {
-                offset: off,
-                size,
-                dts,
-                pts: dts,
-                duration: dur.min(u32::MAX as u64) as u32,
-                is_sync: true,
-                description_index: stsc[stsc_i].2,
-            });
-            dts = dts.saturating_add(dur.min(i64::MAX as u64) as i64);
-            sidx += spc;
-            if sidx >= sample_count {
-                break;
-            }
-        }
-    } else {
-        if sample_count > MAX_SAMPLES {
-            return Err(Error::TooLarge("sample count"));
-        }
-        samples.reserve(sample_count);
-        let mut stss_i = 0usize;
-        'chunks: for (ci, &off) in chunks.iter().enumerate() {
-            while stsc_i + 1 < stsc.len() && stsc[stsc_i + 1].0 as usize <= ci + 1 {
-                stsc_i += 1;
-            }
-            let (_, spc, sdi) = stsc[stsc_i];
-            let mut pos = off;
-            for _ in 0..spc {
-                if sidx >= sample_count {
-                    break 'chunks;
-                }
-                let size = if const_size != 0 { const_size } else { sizes[sidx] };
-                let duration = stts_c.next_value();
-                let cts = ctts_c.next_value() as i32 as i64;
-                let is_sync = match &stss {
-                    None => true,
-                    Some(v) => {
-                        while stss_i < v.len() && (v[stss_i] as usize) < sidx + 1 {
-                            stss_i += 1;
-                        }
-                        stss_i < v.len() && v[stss_i] as usize == sidx + 1
-                    }
-                };
-                samples.push(Sample { offset: pos, size, dts, pts: dts.saturating_add(cts), duration, is_sync, description_index: sdi });
-                pos = pos.saturating_add(size as u64);
-                dts = dts.saturating_add(duration as i64);
-                sidx += 1;
-            }
-        }
-    }
-    t.samples = samples;
-    Ok(())
-}
-
-fn parse_moof(moof_off: u64, moof: &[u8], tracks: &mut [Track], trex: &HashMap<u32, Trex>, next_dts: &mut [i64], file_len: u64) -> Result<()> {
-    // End of data of the previous traf, for the base-offset default of subsequent trafs.
-    let mut prev_end: Option<u64> = None;
-    for b in boxes(moof) {
-        let b = b?;
-        if b.kind != b"traf" {
-            continue;
-        }
-        let mut tfhd = None;
-        let mut tfdt = None;
-        let mut truns = Vec::new();
-        for c in boxes(b.payload) {
-            let c = c?;
-            match &c.kind.0 {
-                b"tfhd" => tfhd = Some(c.payload),
-                b"tfdt" => tfdt = Some(c.payload),
-                b"trun" => truns.push(c.payload),
-                _ => {}
-            }
-        }
-        let tfhd = tfhd.ok_or_else(|| Error::Invalid("traf without tfhd".into()))?;
-        let mut c = Cur::new(tfhd, "tfhd");
-        let (_, fl) = c.full_header()?;
-        let id = c.u32()?;
-        let Some(ti) = tracks.iter().position(|t| t.id == id) else { continue };
-        let d = trex.get(&id).copied().unwrap_or_default();
-        let base = if fl & 1 != 0 {
-            c.u64()?
-        } else if fl & 0x20000 != 0 {
-            moof_off
-        } else {
-            prev_end.unwrap_or(moof_off)
-        };
-        let sdi = if fl & 2 != 0 { c.u32()? } else { d.description_index };
-        let def_dur = if fl & 8 != 0 { c.u32()? } else { d.duration };
-        let def_size = if fl & 0x10 != 0 { c.u32()? } else { d.size };
-        let def_flags = if fl & 0x20 != 0 { c.u32()? } else { d.flags };
-        if let Some(p) = tfdt {
-            let mut c = Cur::new(p, "tfdt");
-            let (v, _) = c.full_header()?;
-            let t = if v == 1 { c.u64()? } else { c.u32()? as u64 };
-            next_dts[ti] = t.min(i64::MAX as u64) as i64;
-        }
-        let mut data_pos = base;
-        for tr in truns {
-            let mut c = Cur::new(tr, "trun");
-            let (v, tf) = c.full_header()?;
-            let per = [0x100u32, 0x200, 0x400, 0x800].iter().filter(|&&f| tf & f != 0).count() * 4;
-            let n = c.u32()? as usize;
-            if per > 0 {
-                c.check_count(n, per)?;
-            } else if (n as u64).saturating_mul(def_size.max(1) as u64) > file_len {
-                return Err(Error::TooLarge("trun sample count"));
-            }
-            if tracks[ti].samples.len() + n > MAX_SAMPLES {
-                return Err(Error::TooLarge("sample count"));
-            }
-            if tf & 1 != 0 {
-                data_pos = base.wrapping_add_signed(c.i32()? as i64);
-            }
-            let first_flags = if tf & 4 != 0 { Some(c.u32()?) } else { None };
-            let t = &mut tracks[ti];
-            t.samples.reserve(n);
-            for i in 0..n {
-                let dur = if tf & 0x100 != 0 { c.u32()? } else { def_dur };
-                let size = if tf & 0x200 != 0 { c.u32()? } else { def_size };
-                let flags = if tf & 0x400 != 0 { c.u32()? } else { def_flags };
-                // first_sample_flags overrides the flags of the first sample only.
-                let flags = if i == 0 { first_flags.unwrap_or(flags) } else { flags };
-                let cto = if tf & 0x800 != 0 {
-                    let raw = c.u32()?;
-                    if v == 0 { raw as i64 } else { raw as i32 as i64 }
-                } else {
-                    0
-                };
-                let dts = next_dts[ti];
-                t.samples.push(Sample {
-                    offset: data_pos,
-                    size,
-                    dts,
-                    pts: dts.saturating_add(cto),
-                    duration: dur,
-                    is_sync: flags & 0x1_0000 == 0,
-                    description_index: sdi,
-                });
-                data_pos = data_pos.saturating_add(size as u64);
-                next_dts[ti] = dts.saturating_add(dur as i64);
-            }
-        }
-        prev_end = Some(data_pos);
-    }
-    Ok(())
-}
-
-fn parse_udta(p: &[u8], md: &mut Metadata) {
-    for b in boxes(p).map_while(|b| b.ok()) {
-        if b.kind == b"meta" {
-            parse_meta(b.payload, md);
-        } else if b.kind.0[0] == 0xA9 && b.payload.len() >= 4 {
-            let n = u16::from_be_bytes([b.payload[0], b.payload[1]]) as usize;
-            if let Some(s) = b.payload.get(4..4 + n) {
-                md.entries.push((b.kind.to_string_lossy(), String::from_utf8_lossy(s).into_owned()));
-            }
-        }
-    }
-}
-
-fn parse_meta(p: &[u8], md: &mut Metadata) {
-    // QuickTime `meta` is a plain box; ISO `meta` is a full box.
-    let body = if p.len() >= 8 && &p[4..8] == b"hdlr" { p } else { p.get(4..).unwrap_or(&[]) };
-    let mut keys: Vec<String> = Vec::new();
-    if let Some(k) = find(body, b"keys") {
-        let mut c = Cur::new(k, "keys");
-        if c.full_header().is_ok()
-            && let Ok(n) = c.count(8)
-        {
-            for _ in 0..n {
-                let Ok(sz) = c.u32() else { break };
-                let Ok(_ns) = c.u32() else { break };
-                let Ok(name) = c.bytes((sz as usize).saturating_sub(8)) else { break };
-                keys.push(String::from_utf8_lossy(name).into_owned());
-            }
-        }
-    }
-    let Some(ilst) = find(body, b"ilst") else { return };
-    for item in boxes(ilst).map_while(|b| b.ok()) {
-        let idx = item.kind.as_u32() as usize;
-        let key = if !keys.is_empty() && idx >= 1 && idx <= keys.len() { keys[idx - 1].clone() } else { item.kind.to_string_lossy() };
-        if let Some(d) = find(item.payload, b"data")
-            && d.len() >= 8
-        {
-            let ty = u32::from_be_bytes([d[0], d[1], d[2], d[3]]) & 0xFF_FFFF;
-            if ty == 1 || ty == 0 {
-                md.entries.push((key, String::from_utf8_lossy(&d[8..]).into_owned()));
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn language_codes() {
-        // "und" = 0x55C4
-        assert_eq!(parse_language(0x55C4), "und");
-        assert_eq!(parse_language(0), "eng");
-        assert_eq!(parse_language(0x15C7), "eng");
-    }
-
-    #[test]
-    fn stts_cursor() {
-        let runs = [(2, 10), (0, 99), (3, 5)];
-        let mut c = SttsCursor { runs: &runs, run: 0, used: 0 };
-        assert_eq!(c.next_value(), 10);
-        assert_eq!(c.take(3), 10 + 5 + 5);
-        assert_eq!(c.next_value(), 5);
-        assert_eq!(c.next_value(), 0);
-    }
-
-    #[test]
-    fn rejects_no_moov_and_cmov() {
-        let mut b = crate::bytes::BoxBuf::new();
-        b.leaf(b"free", &[0; 4]);
-        assert!(matches!(open(b.buf.clone()), Err(Error::NoMoov)));
-        let m = b.start(b"moov");
-        b.leaf(b"cmov", &[]);
-        b.end(m);
-        assert!(matches!(open(b.buf), Err(Error::Unsupported(_))));
-    }
-
-    #[test]
-    fn metadata_qt_and_ilst() {
-        let mut b = crate::bytes::BoxBuf::new();
-        let m = b.start(&[0xA9, b'n', b'a', b'm']);
-        b.u16(2);
-        b.u16(0);
-        b.bytes(b"hi");
-        b.end(m);
-        let meta = b.start_full(b"meta", 0, 0);
-        b.leaf(b"hdlr", &[0; 24]);
-        let il = b.start(b"ilst");
-        let it = b.start(&[0xA9, b'A', b'R', b'T']);
-        let d = b.start(b"data");
-        b.u32(1);
-        b.u32(0);
-        b.bytes(b"me");
-        b.end(d);
-        b.end(it);
-        b.end(il);
-        b.end(meta);
-        let mut md = Metadata::default();
-        parse_udta(&b.buf, &mut md);
-        assert_eq!(md.title(), Some("hi"));
-        assert_eq!(md.get("©ART"), Some("me"));
-    }
-
-    use crate::bytes::BoxBuf;
-
-    fn full(b: &mut BoxBuf, kind: &[u8; 4], v: u8, f: impl FnOnce(&mut BoxBuf)) {
-        let m = b.start_full(kind, v, 0);
-        f(b);
-        b.end(m);
-    }
-
-    /// Hand-built file: uuid/wide/skip boxes, stz2 sizes, co64, ctts v1 with negative offsets,
-    /// stss, sdtp, sbgp/sgpd, and an edit list with a leading empty edit.
-    fn handmade(stsz_override: Option<(u32, u32)>) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        let m = b.start(b"ftyp");
-        b.bytes(b"isom");
-        b.u32(0);
-        b.bytes(b"isom");
-        b.end(m);
-        let m = b.start(b"uuid");
-        b.bytes(&[0xAB; 16]);
-        b.bytes(b"payload");
-        b.end(m);
-        b.leaf(b"wide", &[]);
-        b.leaf(b"skip", &[1, 2, 3]);
-        // mdat with 64-bit size: 4 samples of 3,1,2,4 bytes.
-        let data_start = b.len() as u64 + 16;
-        b.u32(1);
-        b.bytes(b"mdat");
-        b.u64(16 + 10);
-        b.bytes(&[1, 1, 1, 2, 3, 3, 4, 4, 4, 4]);
-        let moov = b.start(b"moov");
-        full(&mut b, b"mvhd", 0, |b| {
-            b.u32(0);
-            b.u32(0);
-            b.u32(1000);
-            b.u32(500);
-            b.zeros(80);
-        });
-        let trak = b.start(b"trak");
-        full(&mut b, b"tkhd", 0, |b| {
-            b.u32(0);
-            b.u32(0);
-            b.u32(7);
-            b.u32(0);
-            b.u32(500);
-            b.zeros(52);
-            b.u32(320 << 16);
-            b.u32(240 << 16);
-        });
-        let edts = b.start(b"edts");
-        full(&mut b, b"elst", 1, |b| {
-            b.u32(2);
-            b.u64(100);
-            b.i64(-1);
-            b.i32(0x10000);
-            b.u64(400);
-            b.i64(20);
-            b.i32(0x10000);
-        });
-        b.end(edts);
-        let mdia = b.start(b"mdia");
-        full(&mut b, b"mdhd", 0, |b| {
-            b.u32(0);
-            b.u32(0);
-            b.u32(100);
-            b.u32(40);
-            b.u16(0x15C7);
-            b.u16(0);
-        });
-        full(&mut b, b"hdlr", 0, |b| {
-            b.u32(0);
-            b.bytes(b"vide");
-            b.zeros(12);
-            b.bytes(b"Video\0");
-        });
-        let minf = b.start(b"minf");
-        let stbl = b.start(b"stbl");
-        full(&mut b, b"stsd", 0, |b| {
-            b.u32(1);
-            crate::codec::SampleEntry::jpeg(320, 240).write(b, false).unwrap();
-        });
-        full(&mut b, b"stts", 0, |b| {
-            b.u32(1);
-            b.u32(4);
-            b.u32(10);
-        });
-        full(&mut b, b"ctts", 1, |b| {
-            b.u32(2);
-            b.u32(2);
-            b.i32(-5);
-            b.u32(2);
-            b.i32(5);
-        });
-        full(&mut b, b"stss", 0, |b| {
-            b.u32(2);
-            b.u32(3);
-            b.u32(1);
-        });
-        full(&mut b, b"stsc", 0, |b| {
-            b.u32(2);
-            b.u32(1);
-            b.u32(3);
-            b.u32(1);
-            b.u32(2);
-            b.u32(1);
-            b.u32(1);
-        });
-        match stsz_override {
-            Some((size, count)) => full(&mut b, b"stsz", 0, |b| {
-                b.u32(size);
-                b.u32(count);
-            }),
-            None => full(&mut b, b"stz2", 0, |b| {
-                b.u32(4);
-                b.u32(4);
-                b.u8(0x31);
-                b.u8(0x24);
-            }),
-        }
-        full(&mut b, b"co64", 0, |b| {
-            b.u32(2);
-            b.u64(data_start);
-            b.u64(data_start + 6);
-        });
-        full(&mut b, b"sdtp", 0, |b| b.bytes(&[0x20, 0x10, 0x10, 0x10]));
-        full(&mut b, b"sbgp", 0, |b| {
-            b.bytes(b"roll");
-            b.u32(1);
-            b.u32(4);
-            b.u32(1);
-        });
-        full(&mut b, b"sgpd", 1, |b| {
-            b.bytes(b"roll");
-            b.u32(2);
-            b.u32(1);
-            b.i16(-1);
-        });
-        b.end(stbl);
-        b.end(minf);
-        b.end(mdia);
-        b.end(trak);
-        b.end(moov);
-        // Trailing box extending to EOF (size 0).
-        b.u32(0);
-        b.bytes(b"free");
-        b.bytes(&[9; 5]);
-        b.buf
-    }
-
-    #[test]
-    fn handmade_sample_table() {
-        let d = handmade(None);
-        let f = open(d.as_slice()).unwrap();
-        assert_eq!(f.major_brand, *b"isom");
-        let t = &f.tracks[0];
-        assert_eq!((t.id, t.kind, t.timescale, t.language.as_str()), (7, TrackKind::Video, 100, "eng"));
-        assert_eq!((t.width, t.height), (320, 240));
-        assert_eq!(t.handler_name, "Video");
-        let sizes: Vec<u32> = t.samples.iter().map(|s| s.size).collect();
-        assert_eq!(sizes, [3, 1, 2, 4]);
-        let offs: Vec<u64> = t.samples.iter().map(|s| s.offset - t.samples[0].offset).collect();
-        assert_eq!(offs, [0, 3, 4, 6]);
-        let pts: Vec<i64> = t.samples.iter().map(|s| s.pts).collect();
-        assert_eq!(pts, [-5, 5, 25, 35]);
-        let sync: Vec<bool> = t.samples.iter().map(|s| s.is_sync).collect();
-        assert_eq!(sync, [true, false, true, false]);
-        for (i, want) in [vec![1u8, 1, 1], vec![2], vec![3, 3], vec![4; 4]].iter().enumerate() {
-            assert_eq!(&f.read_sample(d.as_slice(), 0, i).unwrap(), want);
-        }
-        // Empty edit of 100 movie ticks = 10 media ticks, then media starts at 20.
-        assert_eq!(t.edits.len(), 2);
-        assert_eq!(t.edit_offset, 10 - 20);
-        assert_eq!(t.presentation_pts(2), Some(15));
-        assert_eq!(t.sdtp.len(), 4);
-        assert_eq!(t.sample_groups[0].grouping_type, *b"roll");
-        assert_eq!(t.sample_groups[0].descriptions, vec![vec![0xFF, 0xFF]]);
-        assert!(f.read_sample(d.as_slice(), 0, 4).is_err());
-        assert!(f.read_sample(d.as_slice(), 1, 0).is_err());
-    }
-
-    #[test]
-    fn absurd_counts_are_bounded() {
-        // Constant-size stsz claiming 4 billion samples is clamped to what fits in the file.
-        let d = handmade(Some((1, u32::MAX)));
-        let f = open(d.as_slice()).unwrap();
-        assert!(f.tracks[0].samples.len() <= d.len());
-        // A table claiming more entries than its box holds fails cleanly.
-        let mut d = handmade(None);
-        let p = d.windows(4).position(|w| w == b"stts").unwrap();
-        d[p + 8..p + 12].copy_from_slice(&u32::MAX.to_be_bytes());
-        assert!(matches!(open(d.as_slice()), Err(Error::Truncated(_))));
-        // Box larger than its parent.
-        let mut d = handmade(None);
-        let p = d.windows(4).position(|w| w == b"stsc").unwrap();
-        d[p - 4..p].copy_from_slice(&0x7FFF_FFFFu32.to_be_bytes());
-        assert!(open(d.as_slice()).is_err());
-    }
-}
diff --git a/crates/isobmff/src/error.rs b/crates/isobmff/src/error.rs
deleted file mode 100644
index b5dfd752f..000000000
--- a/crates/isobmff/src/error.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-use std::io;
-
-/// Errors produced by the demuxer and muxer.
-#[derive(Debug, thiserror::Error)]
-pub enum Error {
-    #[error("I/O error: {0}")]
-    Io(#[from] io::Error),
-    /// A box or structure ended before all required fields were read.
-    #[error("truncated data while reading {0}")]
-    Truncated(&'static str),
-    /// Structurally invalid data.
-    #[error("invalid data: {0}")]
-    Invalid(String),
-    /// Valid but unsupported feature (e.g. compressed `cmov` movie header).
-    #[error("unsupported: {0}")]
-    Unsupported(String),
-    /// A count or size exceeds sanity limits relative to the file size.
-    #[error("size limit exceeded: {0}")]
-    TooLarge(&'static str),
-    /// No `moov` box was found.
-    #[error("no moov box found")]
-    NoMoov,
-    /// A track index was out of range.
-    #[error("track index {0} out of range")]
-    NoSuchTrack(usize),
-    /// A sample index was out of range.
-    #[error("sample index {0} out of range")]
-    NoSuchSample(usize),
-    /// Muxer usage error (e.g. invalid track config, bad sample).
-    #[error("muxer: {0}")]
-    Mux(String),
-}
-
-pub type Result<T> = std::result::Result<T, Error>;
-
-pub(crate) fn invalid<T>(msg: impl Into<String>) -> Result<T> {
-    Err(Error::Invalid(msg.into()))
-}
diff --git a/crates/isobmff/src/lib.rs b/crates/isobmff/src/lib.rs
index 6c0b657d8..50871ab54 100644
--- a/crates/isobmff/src/lib.rs
+++ b/crates/isobmff/src/lib.rs
@@ -1,28 +1,7 @@
-//! Clean-room ISO Base Media File Format (MP4, ISO/IEC 14496-12/14/15) and QuickTime (MOV) support.
-//!
-//! - **Demux:** [`open`] parses box headers plus `moov` (and `moof` for fragmented files) from a
-//!   [`ByteSource`] and builds per-track [`Sample`] tables; media data is read on demand with
-//!   [`Mp4File::read_sample`].
-//! - **Mux:** [`Mp4Writer`] writes progressive MP4/MOV (optionally faststart);
-//!   [`FragmentedWriter`] writes fragmented MP4.
-//!
-//! See the crate README for supported boxes and limitations.
+//! ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer: a re-export of
+//! [`craft_media::isobmff`] from craft-libs. Supported boxes and limitations are in the
+//! craft-media README.
 
 #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
 
-mod bytes;
-mod codec;
-mod demux;
-mod error;
-mod mux;
-mod source;
-
-pub use bytes::FourCc;
-pub use codec::{
-    AacConfig, ApvConfig, AudioParams, Av1Config, AvcConfig, BitRate, CleanAperture, CodecConfig, ColorInfo, FieldInfo, FlacConfig, HevcConfig, HevcNalArray,
-    MasteringDisplay, OpusConfig, PcmConfig, SampleEntry, TimecodeConfig, VideoParams, VpcConfig, parse_asc,
-};
-pub use demux::{Edit, Metadata, Mp4File, Sample, SampleGroup, Track, TrackKind, open};
-pub use error::{Error, Result};
-pub use mux::{Brand, FragmentedWriter, Mp4Writer, TrackConfig, WriteSample, WriterOptions};
-pub use source::ByteSource;
+pub use craft_media::isobmff::*;
diff --git a/crates/isobmff/src/mux.rs b/crates/isobmff/src/mux.rs
deleted file mode 100644
index 880d49a2c..000000000
--- a/crates/isobmff/src/mux.rs
+++ /dev/null
@@ -1,963 +0,0 @@
-//! Muxers: progressive MP4/MOV ([`Mp4Writer`], optional faststart) and fragmented MP4 ([`FragmentedWriter`]).
-
-use crate::bytes::BoxBuf;
-use crate::codec::{CodecConfig, SampleEntry, TimecodeConfig};
-use crate::demux::Edit;
-use crate::error::{Error, Result};
-use std::io::{Read, Seek, SeekFrom, Write};
-
-/// Output flavour: determines brands and some sample-entry encodings.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Brand {
-    /// ISO MP4: `isom` major brand, compatible `isom iso2 avc1 mp41 mp42`.
-    Mp4,
-    /// QuickTime MOV: `qt  ` major brand.
-    Mov,
-}
-
-/// Movie-level writer options.
-#[derive(Clone, Debug)]
-pub struct WriterOptions {
-    pub brand: Brand,
-    /// Movie timescale (`mvhd`); default 1000.
-    pub movie_timescale: u32,
-    /// Text metadata written to `moov/udta` (keys like `©nam`, `©ART`, `©cmt`, `©too`).
-    pub metadata: Vec<(String, String)>,
-}
-
-impl WriterOptions {
-    pub fn new(brand: Brand) -> Self {
-        WriterOptions { brand, movie_timescale: 1000, metadata: Vec::new() }
-    }
-}
-
-/// Per-track configuration.
-#[derive(Clone, Debug)]
-pub struct TrackConfig {
-    pub entry: SampleEntry,
-    /// Media timescale. For PCM it must equal the sample rate (one tick per audio frame).
-    pub timescale: u32,
-    /// ISO 639-2/T language (`und` by default).
-    pub language: String,
-    /// Explicit edit list (segment durations in the movie timescale). Takes precedence over `media_start`.
-    pub edits: Vec<Edit>,
-    /// Convenience: create one edit starting at this media time (e.g. AAC encoder delay / priming,
-    /// or the first pts of a B-frame stream) spanning the rest of the media.
-    pub media_start: Option<i64>,
-    /// `hdlr` name; a sensible default is used when `None`.
-    pub handler_name: Option<String>,
-}
-
-impl TrackConfig {
-    pub fn new(entry: SampleEntry, timescale: u32) -> Self {
-        TrackConfig { entry, timescale, language: "und".into(), edits: Vec::new(), media_start: None, handler_name: None }
-    }
-}
-
-/// A sample handed to the muxers.
-#[derive(Clone, Copy, Debug)]
-pub struct WriteSample<'a> {
-    pub data: &'a [u8],
-    /// Duration in the media timescale. Ignored for PCM (each frame lasts one tick).
-    pub duration: u32,
-    /// pts − dts in the media timescale.
-    pub composition_offset: i32,
-    pub is_sync: bool,
-}
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Handler {
-    Video,
-    Audio,
-    Timecode,
-    Other,
-}
-
-fn handler_of(e: &SampleEntry) -> Handler {
-    if matches!(e.codec, CodecConfig::Timecode(_)) {
-        Handler::Timecode
-    } else if e.video.is_some() {
-        Handler::Video
-    } else if e.audio.is_some() {
-        Handler::Audio
-    } else {
-        Handler::Other
-    }
-}
-
-/// Accumulated sample tables for one track.
-#[derive(Clone, Debug, Default)]
-struct Tables {
-    stts: Vec<(u32, u32)>,
-    ctts: Vec<(u32, i32)>,
-    sizes: Vec<u32>,
-    /// Constant sample size (PCM) — then `sizes` is unused.
-    const_size: Option<u32>,
-    sample_count: u64,
-    /// 1-based sync sample numbers.
-    sync: Vec<u32>,
-    all_sync: bool,
-    /// (offset relative to file start before shifting, sample count)
-    chunks: Vec<(u64, u32)>,
-    media_duration: u64,
-    /// End of the last sample on the composition timeline (decode time + composition offset +
-    /// duration, maximum over samples).
-    comp_end: u64,
-}
-
-impl Tables {
-    fn new() -> Self {
-        Tables { all_sync: true, ..Default::default() }
-    }
-    fn push_run<T: PartialEq + Copy>(runs: &mut Vec<(u32, T)>, count: u32, v: T) {
-        if let Some(last) = runs.last_mut()
-            && last.1 == v
-            && last.0.checked_add(count).is_some()
-        {
-            last.0 += count;
-            return;
-        }
-        runs.push((count, v));
-    }
-}
-
-struct WTrack {
-    cfg: TrackConfig,
-    id: u32,
-    handler: Handler,
-    pcm_frame_bytes: Option<u32>,
-    t: Tables,
-    /// Track id of a linked timecode track (`tref/tmcd`).
-    tmcd_ref: Option<u32>,
-    /// For timecode tracks: (video track index, start frame).
-    tmcd_source: Option<(usize, u32)>,
-}
-
-fn pack_language(lang: &str) -> u16 {
-    let b = lang.as_bytes();
-    if b.len() == 3 && b.iter().all(|c| c.is_ascii_lowercase()) {
-        (((b[0] - 0x60) as u16) << 10) | (((b[1] - 0x60) as u16) << 5) | ((b[2] - 0x60) as u16)
-    } else {
-        0x55C4 // "und"
-    }
-}
-
-fn rescale(v: u64, from: u32, to: u32) -> u64 {
-    if from == 0 {
-        return 0;
-    }
-    (v as u128 * to as u128 / from as u128).min(u64::MAX as u128) as u64
-}
-
-const MATRIX: [i32; 9] = [0x10000, 0, 0, 0, 0x10000, 0, 0, 0, 0x4000_0000];
-
-fn write_ftyp(b: &mut BoxBuf, brand: Brand) {
-    let m = b.start(b"ftyp");
-    match brand {
-        Brand::Mp4 => {
-            b.bytes(b"isom");
-            b.u32(0x200);
-            for c in [b"isom", b"iso2", b"avc1", b"mp41", b"mp42"] {
-                b.bytes(c);
-            }
-        }
-        Brand::Mov => {
-            b.bytes(b"qt  ");
-            b.u32(0x200);
-            b.bytes(b"qt  ");
-        }
-    }
-    b.end(m);
-}
-
-fn movie_duration(tracks: &[WTrack], movie_ts: u32) -> u64 {
-    tracks.iter().map(|t| presentation_duration(t, movie_ts)).max().unwrap_or(0)
-}
-
-fn effective_edits(t: &WTrack, movie_ts: u32) -> Vec<Edit> {
-    if !t.cfg.edits.is_empty() {
-        return t.cfg.edits.clone();
-    }
-    if let Some(start) = t.cfg.media_start {
-        // presentation runs from `start` to the end of the last sample in composition order (with
-        // B-frame reordering that is past the end of the decode timeline)
-        let rest = t.t.comp_end.max(t.t.media_duration).saturating_sub(start.max(0) as u64);
-        return vec![Edit { segment_duration: rescale(rest, t.cfg.timescale, movie_ts), media_time: start, media_rate: 0x10000 }];
-    }
-    Vec::new()
-}
-
-fn presentation_duration(t: &WTrack, movie_ts: u32) -> u64 {
-    let e = effective_edits(t, movie_ts);
-    if e.is_empty() { rescale(t.t.media_duration, t.cfg.timescale, movie_ts) } else { e.iter().map(|e| e.segment_duration).sum() }
-}
-
-fn write_mvhd(b: &mut BoxBuf, timescale: u32, duration: u64, next_id: u32) {
-    let v1 = duration > u32::MAX as u64;
-    let m = b.start_full(b"mvhd", v1 as u8, 0);
-    if v1 {
-        b.u64(0);
-        b.u64(0);
-        b.u32(timescale);
-        b.u64(duration);
-    } else {
-        b.u32(0);
-        b.u32(0);
-        b.u32(timescale);
-        b.u32(duration as u32);
-    }
-    b.u32(0x10000);
-    b.u16(0x100);
-    b.zeros(10);
-    for v in MATRIX {
-        b.i32(v);
-    }
-    b.zeros(24);
-    b.u32(next_id);
-    b.end(m);
-}
-
-fn write_trak(b: &mut BoxBuf, t: &WTrack, movie_ts: u32, qt: bool, shift: u64, force_co64: bool) -> Result<()> {
-    let trak = b.start(b"trak");
-    let dur = presentation_duration(t, movie_ts);
-    let v1 = dur > u32::MAX as u64;
-    let m = b.start_full(b"tkhd", v1 as u8, 3);
-    if v1 {
-        b.u64(0);
-        b.u64(0);
-        b.u32(t.id);
-        b.u32(0);
-        b.u64(dur);
-    } else {
-        b.u32(0);
-        b.u32(0);
-        b.u32(t.id);
-        b.u32(0);
-        b.u32(dur as u32);
-    }
-    b.zeros(8);
-    b.i16(0);
-    b.u16(0);
-    b.i16(if t.handler == Handler::Audio { 0x100 } else { 0 });
-    b.u16(0);
-    for v in MATRIX {
-        b.i32(v);
-    }
-    let (w, h) = match &t.cfg.entry.video {
-        Some(v) => {
-            let w = match v.pixel_aspect {
-                Some((hs, vs)) if hs > 0 && vs > 0 => (v.width as u64 * hs as u64 / vs as u64) as u32,
-                _ => v.width as u32,
-            };
-            (w, v.height as u32)
-        }
-        None => (0, 0),
-    };
-    b.u32(w << 16);
-    b.u32(h << 16);
-    b.end(m);
-    let edits = effective_edits(t, movie_ts);
-    if !edits.is_empty() {
-        let e = b.start(b"edts");
-        let v1 = edits.iter().any(|e| e.segment_duration > u32::MAX as u64 || e.media_time > i32::MAX as i64 || e.media_time < i32::MIN as i64);
-        let l = b.start_full(b"elst", v1 as u8, 0);
-        b.u32(edits.len() as u32);
-        for ed in &edits {
-            if v1 {
-                b.u64(ed.segment_duration);
-                b.i64(ed.media_time);
-            } else {
-                b.u32(ed.segment_duration as u32);
-                b.i32(ed.media_time as i32);
-            }
-            b.i32(ed.media_rate);
-        }
-        b.end(l);
-        b.end(e);
-    }
-    if let Some(id) = t.tmcd_ref {
-        let r = b.start(b"tref");
-        let m = b.start(b"tmcd");
-        b.u32(id);
-        b.end(m);
-        b.end(r);
-    }
-    let mdia = b.start(b"mdia");
-    let mv1 = t.t.media_duration > u32::MAX as u64;
-    let m = b.start_full(b"mdhd", mv1 as u8, 0);
-    if mv1 {
-        b.u64(0);
-        b.u64(0);
-        b.u32(t.cfg.timescale);
-        b.u64(t.t.media_duration);
-    } else {
-        b.u32(0);
-        b.u32(0);
-        b.u32(t.cfg.timescale);
-        b.u32(t.t.media_duration as u32);
-    }
-    b.u16(pack_language(&t.cfg.language));
-    b.u16(0);
-    b.end(m);
-    let (htype, default_name) = match t.handler {
-        Handler::Video => (b"vide", "VideoHandler"),
-        Handler::Audio => (b"soun", "SoundHandler"),
-        Handler::Timecode => (b"tmcd", "TimeCodeHandler"),
-        Handler::Other => (b"meta", "MetaHandler"),
-    };
-    let name = t.cfg.handler_name.clone().unwrap_or_else(|| default_name.into());
-    let m = b.start_full(b"hdlr", 0, 0);
-    b.bytes(if qt { b"mhlr" } else { &[0, 0, 0, 0] });
-    b.bytes(htype);
-    b.zeros(12);
-    if qt {
-        let n = name.len().min(255);
-        b.u8(n as u8);
-        b.bytes(&name.as_bytes()[..n]);
-    } else {
-        b.bytes(name.as_bytes());
-        b.u8(0);
-    }
-    b.end(m);
-    let minf = b.start(b"minf");
-    match t.handler {
-        Handler::Video => {
-            let m = b.start_full(b"vmhd", 0, 1);
-            b.zeros(8);
-            b.end(m);
-        }
-        Handler::Audio => {
-            let m = b.start_full(b"smhd", 0, 0);
-            b.zeros(4);
-            b.end(m);
-        }
-        Handler::Timecode => {
-            let g = b.start(b"gmhd");
-            let m = b.start_full(b"gmin", 0, 0);
-            b.u16(0x40);
-            b.u16(0x8000);
-            b.u16(0x8000);
-            b.u16(0x8000);
-            b.i16(0);
-            b.u16(0);
-            b.end(m);
-            let tm = b.start(b"tmcd");
-            let m = b.start_full(b"tcmi", 0, 0);
-            b.u16(0);
-            b.u16(0);
-            b.u16(12);
-            b.u16(0);
-            b.bytes(&[0xFF; 6]);
-            b.zeros(6);
-            b.u8(0);
-            b.end(m);
-            b.end(tm);
-            b.end(g);
-        }
-        Handler::Other => {
-            let m = b.start_full(b"nmhd", 0, 0);
-            b.end(m);
-        }
-    }
-    if qt {
-        // QuickTime data handler reference.
-        let m = b.start_full(b"hdlr", 0, 0);
-        b.bytes(b"dhlr");
-        b.bytes(b"url ");
-        b.zeros(12);
-        b.u8(0);
-        b.end(m);
-    }
-    let d = b.start(b"dinf");
-    let r = b.start_full(b"dref", 0, 0);
-    b.u32(1);
-    let u = b.start_full(b"url ", 0, 1);
-    b.end(u);
-    b.end(r);
-    b.end(d);
-    let stbl = b.start(b"stbl");
-    let m = b.start_full(b"stsd", 0, 0);
-    b.u32(1);
-    t.cfg.entry.write(b, qt)?;
-    b.end(m);
-    let tb = &t.t;
-    let m = b.start_full(b"stts", 0, 0);
-    b.u32(tb.stts.len() as u32);
-    for &(c, d) in &tb.stts {
-        b.u32(c);
-        b.u32(d);
-    }
-    b.end(m);
-    if tb.ctts.iter().any(|&(_, o)| o != 0) {
-        let neg = tb.ctts.iter().any(|&(_, o)| o < 0);
-        let m = b.start_full(b"ctts", neg as u8, 0);
-        b.u32(tb.ctts.len() as u32);
-        for &(c, o) in &tb.ctts {
-            b.u32(c);
-            b.i32(o);
-        }
-        b.end(m);
-    }
-    if !tb.all_sync {
-        let m = b.start_full(b"stss", 0, 0);
-        b.u32(tb.sync.len() as u32);
-        for &s in &tb.sync {
-            b.u32(s);
-        }
-        b.end(m);
-    }
-    let m = b.start_full(b"stsc", 0, 0);
-    let mut runs: Vec<(u32, u32)> = Vec::new();
-    for (i, &(_, n)) in tb.chunks.iter().enumerate() {
-        if runs.last().is_none_or(|r| r.1 != n) {
-            runs.push((i as u32 + 1, n));
-        }
-    }
-    b.u32(runs.len() as u32);
-    for (first, n) in runs {
-        b.u32(first);
-        b.u32(n);
-        b.u32(1);
-    }
-    b.end(m);
-    let m = b.start_full(b"stsz", 0, 0);
-    match tb.const_size {
-        Some(s) => {
-            b.u32(s);
-            b.u32(tb.sample_count.min(u32::MAX as u64) as u32);
-        }
-        None => {
-            let first = tb.sizes.first().copied().unwrap_or(0);
-            // A uniform size of 0 would mean "table follows" (ISO/IEC 14496-12 §8.7.3), so
-            // all-empty samples must still be written as a table.
-            if first != 0 && !tb.sizes.is_empty() && tb.sizes.iter().all(|&s| s == first) {
-                b.u32(first);
-                b.u32(tb.sizes.len() as u32);
-            } else {
-                b.u32(0);
-                b.u32(tb.sizes.len() as u32);
-                for &s in &tb.sizes {
-                    b.u32(s);
-                }
-            }
-        }
-    }
-    b.end(m);
-    let co64 = force_co64 || tb.chunks.iter().any(|&(o, _)| o + shift > u32::MAX as u64);
-    let m = b.start_full(if co64 { b"co64" } else { b"stco" }, 0, 0);
-    b.u32(tb.chunks.len() as u32);
-    for &(o, _) in &tb.chunks {
-        if co64 {
-            b.u64(o + shift);
-        } else {
-            b.u32((o + shift) as u32);
-        }
-    }
-    b.end(m);
-    b.end(stbl);
-    b.end(minf);
-    b.end(mdia);
-    b.end(trak);
-    Ok(())
-}
-
-fn write_udta(b: &mut BoxBuf, md: &[(String, String)]) {
-    let items: Vec<([u8; 4], &str)> = md
-        .iter()
-        .filter_map(|(k, v)| {
-            let mut chars = k.chars();
-            if chars.next()? != '©' {
-                return None;
-            }
-            let rest: Vec<u8> = chars.map(|c| c as u32 as u8).collect();
-            (rest.len() == 3).then(|| ([0xA9, rest[0], rest[1], rest[2]], v.as_str()))
-        })
-        .collect();
-    if items.is_empty() {
-        return;
-    }
-    let u = b.start(b"udta");
-    for (k, v) in items {
-        let m = b.start(&k);
-        b.u16(v.len() as u16);
-        b.u16(0x55C4);
-        b.bytes(v.as_bytes());
-        b.end(m);
-    }
-    b.end(u);
-}
-
-fn validate_track(cfg: &TrackConfig) -> Result<Option<u32>> {
-    if cfg.timescale == 0 {
-        return Err(Error::Mux("timescale must be non-zero".into()));
-    }
-    if let CodecConfig::Pcm(p) = &cfg.entry.codec {
-        if p.bits == 0 || p.channels == 0 {
-            return Err(Error::Mux("PCM needs bits and channels".into()));
-        }
-        if (p.sample_rate - cfg.timescale as f64).abs() > 0.5 {
-            return Err(Error::Mux("PCM track timescale must equal the sample rate".into()));
-        }
-        return Ok(Some(p.bytes_per_frame()));
-    }
-    Ok(None)
-}
-
-/// Progressive MP4/MOV writer: `ftyp`, then one `mdat` streamed to `W`, then `moov` at [`finish`](Self::finish)
-/// (or moved in front of `mdat` by [`finish_faststart`](Self::finish_faststart)).
-pub struct Mp4Writer<W: Write + Seek> {
-    w: W,
-    opts: WriterOptions,
-    tracks: Vec<WTrack>,
-    /// Offset of the placeholder box (8 bytes) preceding the mdat header.
-    pad_pos: u64,
-    mdat_pos: u64,
-    pos: u64,
-    last_track: Option<usize>,
-}
-
-impl<W: Write + Seek> Mp4Writer<W> {
-    /// Start a file: writes `ftyp`, a placeholder box and the `mdat` header.
-    pub fn new(mut w: W, opts: WriterOptions) -> Result<Self> {
-        let start = w.stream_position()?;
-        let mut b = BoxBuf::new();
-        write_ftyp(&mut b, opts.brand);
-        let pad_pos = start + b.len() as u64;
-        b.leaf(if opts.brand == Brand::Mov { b"wide" } else { b"free" }, &[]);
-        let mdat_pos = start + b.len() as u64;
-        b.leaf(b"mdat", &[]);
-        w.write_all(&b.buf)?;
-        let pos = start + b.len() as u64;
-        Ok(Mp4Writer { w, opts, tracks: Vec::new(), pad_pos, mdat_pos, pos, last_track: None })
-    }
-
-    /// Add a track; returns its index (track ids are index + 1).
-    pub fn add_track(&mut self, cfg: TrackConfig) -> Result<usize> {
-        let pcm = validate_track(&cfg)?;
-        let handler = handler_of(&cfg.entry);
-        let mut t = Tables::new();
-        t.const_size = pcm;
-        self.tracks.push(WTrack { id: self.tracks.len() as u32 + 1, handler, pcm_frame_bytes: pcm, t, cfg, tmcd_ref: None, tmcd_source: None });
-        Ok(self.tracks.len() - 1)
-    }
-
-    /// Replace a track's sample entry before the file is finished (the `moov` is written last), for
-    /// codecs whose configuration is only complete at the end, like the FLAC STREAMINFO in `dfLa`.
-    pub fn set_sample_entry(&mut self, track: usize, entry: SampleEntry) -> Result<()> {
-        let t = self.tracks.get_mut(track).ok_or_else(|| Error::Invalid(format!("no track {track}")))?;
-        t.cfg.entry = entry;
-        Ok(())
-    }
-
-    /// Add a QuickTime timecode track referenced by `video_track`. Its single sample (the start
-    /// frame number) is written at finish, spanning the video track's duration.
-    pub fn add_timecode_track(&mut self, video_track: usize, tc: TimecodeConfig, start_frame: u32) -> Result<usize> {
-        if video_track >= self.tracks.len() {
-            return Err(Error::NoSuchTrack(video_track));
-        }
-        if tc.timescale == 0 || tc.frame_duration == 0 || tc.frames_per_second == 0 {
-            return Err(Error::Mux("timecode needs timescale, frame duration and fps".into()));
-        }
-        let entry = SampleEntry {
-            format: crate::bytes::FourCc(*b"tmcd"),
-            data_reference_index: 1,
-            codec: CodecConfig::Timecode(tc.clone()),
-            video: None,
-            audio: None,
-            bitrate: None,
-        };
-        let idx = self.add_track(TrackConfig::new(entry, tc.timescale))?;
-        self.tracks[idx].tmcd_source = Some((video_track, start_frame));
-        let id = self.tracks[idx].id;
-        self.tracks[video_track].tmcd_ref = Some(id);
-        Ok(idx)
-    }
-
-    /// Append one sample to track `track` (decode order). For PCM tracks `data` may hold any whole
-    /// number of audio frames.
-    pub fn write_sample(&mut self, track: usize, s: WriteSample) -> Result<()> {
-        let tr = self.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        if tr.tmcd_source.is_some() {
-            return Err(Error::Mux("timecode track samples are written automatically".into()));
-        }
-        let (count, dur) = match tr.pcm_frame_bytes {
-            Some(fb) => {
-                if !s.data.len().is_multiple_of(fb as usize) {
-                    return Err(Error::Mux("PCM data is not a whole number of frames".into()));
-                }
-                ((s.data.len() / fb as usize) as u32, 1u32)
-            }
-            None => {
-                if s.data.len() > u32::MAX as usize {
-                    return Err(Error::Mux("sample larger than 4 GiB".into()));
-                }
-                (1, s.duration)
-            }
-        };
-        if count == 0 {
-            return Ok(());
-        }
-        self.w.write_all(s.data)?;
-        let offset = self.pos;
-        self.pos += s.data.len() as u64;
-        let contiguous = self.last_track == Some(track);
-        self.last_track = Some(track);
-        let tr = &mut self.tracks[track];
-        let t = &mut tr.t;
-        Tables::push_run(&mut t.stts, count, dur);
-        Tables::push_run(&mut t.ctts, count, if tr.pcm_frame_bytes.is_some() { 0 } else { s.composition_offset });
-        if tr.pcm_frame_bytes.is_none() {
-            t.sizes.push(s.data.len() as u32);
-            if s.is_sync {
-                t.sync.push(t.sample_count as u32 + 1);
-            } else {
-                t.all_sync = false;
-            }
-        }
-        t.sample_count += count as u64;
-        let ct = if tr.pcm_frame_bytes.is_some() { 0 } else { s.composition_offset as i64 };
-        t.comp_end = t.comp_end.max((t.media_duration as i64 + ct + count as i64 * dur as i64).max(0) as u64);
-        t.media_duration += count as u64 * dur as u64;
-        match t.chunks.last_mut() {
-            Some(c) if contiguous => c.1 += count,
-            _ => t.chunks.push((offset, count)),
-        }
-        Ok(())
-    }
-
-    fn finish_mdat(&mut self) -> Result<()> {
-        // Timecode samples.
-        for i in 0..self.tracks.len() {
-            let Some((vi, start)) = self.tracks[i].tmcd_source else { continue };
-            let v = &self.tracks[vi];
-            let vd = v.t.media_duration;
-            let vts = v.cfg.timescale;
-            let tts = self.tracks[i].cfg.timescale;
-            let tc_dur = match &self.tracks[i].cfg.entry.codec {
-                CodecConfig::Timecode(tc) => tc.frame_duration,
-                _ => 1,
-            };
-            let d = rescale(vd, vts, tts).max(tc_dur as u64).min(u32::MAX as u64) as u32;
-            self.w.write_all(&start.to_be_bytes())?;
-            let off = self.pos;
-            self.pos += 4;
-            self.last_track = None;
-            let t = &mut self.tracks[i].t;
-            t.stts.push((1, d));
-            t.sizes.push(4);
-            t.sync.push(1);
-            t.sample_count = 1;
-            t.media_duration = d as u64;
-            t.chunks.push((off, 1));
-        }
-        let size = self.pos - self.mdat_pos;
-        if size <= u32::MAX as u64 {
-            self.w.seek(SeekFrom::Start(self.mdat_pos))?;
-            self.w.write_all(&(size as u32).to_be_bytes())?;
-        } else {
-            // Merge the placeholder into a 16-byte large-size mdat header.
-            let mut h = [0u8; 16];
-            h[..4].copy_from_slice(&1u32.to_be_bytes());
-            h[4..8].copy_from_slice(b"mdat");
-            h[8..].copy_from_slice(&(self.pos - self.pad_pos).to_be_bytes());
-            self.w.seek(SeekFrom::Start(self.pad_pos))?;
-            self.w.write_all(&h)?;
-        }
-        self.w.seek(SeekFrom::Start(self.pos))?;
-        Ok(())
-    }
-
-    fn build_moov(&self, shift: u64, force_co64: bool) -> Result<Vec<u8>> {
-        let qt = self.opts.brand == Brand::Mov;
-        let ts = self.opts.movie_timescale.max(1);
-        let mut b = BoxBuf::new();
-        let m = b.start(b"moov");
-        write_mvhd(&mut b, ts, movie_duration(&self.tracks, ts), self.tracks.len() as u32 + 1);
-        for t in &self.tracks {
-            write_trak(&mut b, t, ts, qt, shift, force_co64)?;
-        }
-        write_udta(&mut b, &self.opts.metadata);
-        b.end(m);
-        Ok(b.buf)
-    }
-
-    /// Finish the file with `moov` after `mdat`. Returns the underlying writer.
-    pub fn finish(mut self) -> Result<W> {
-        self.finish_mdat()?;
-        let moov = self.build_moov(0, false)?;
-        self.w.write_all(&moov)?;
-        self.w.flush()?;
-        Ok(self.w)
-    }
-}
-
-impl<W: Read + Write + Seek> Mp4Writer<W> {
-    /// Finish with `moov` in front of `mdat` ("fast start"): media data is shifted forward in place.
-    pub fn finish_faststart(mut self) -> Result<W> {
-        self.finish_mdat()?;
-        let mut moov = self.build_moov(0, false)?;
-        let mut force = false;
-        loop {
-            let shift = moov.len() as u64;
-            let next = self.build_moov(shift, force)?;
-            if next.len() == moov.len() {
-                moov = next;
-                break;
-            }
-            // Offsets crossed the 32-bit boundary: switch to co64 (size only grows, so this converges).
-            force = true;
-            moov = next;
-        }
-        let shift = moov.len() as u64;
-        let start = self.pad_pos;
-        let end = self.pos;
-        let mut buf = vec![0u8; 1 << 20];
-        let mut cur = end;
-        while cur > start {
-            let n = (cur - start).min(buf.len() as u64) as usize;
-            cur -= n as u64;
-            self.w.seek(SeekFrom::Start(cur))?;
-            self.w.read_exact(&mut buf[..n])?;
-            self.w.seek(SeekFrom::Start(cur + shift))?;
-            self.w.write_all(&buf[..n])?;
-        }
-        self.w.seek(SeekFrom::Start(start))?;
-        self.w.write_all(&moov)?;
-        self.w.seek(SeekFrom::Start(end + shift))?;
-        self.w.flush()?;
-        Ok(self.w)
-    }
-}
-
-/// Buffered fragment sample: (data, duration, composition offset, sync).
-type PendingSample = (Vec<u8>, u32, i32, bool);
-
-/// Fragmented MP4 writer: an init segment (`ftyp` + `moov` with `mvex`) followed by
-/// `moof`+`mdat` fragments. Samples are buffered until [`flush_fragment`](Self::flush_fragment).
-pub struct FragmentedWriter<W: Write> {
-    w: W,
-    opts: WriterOptions,
-    tracks: Vec<WTrack>,
-    pending: Vec<Vec<PendingSample>>,
-    next_dts: Vec<u64>,
-    seq: u32,
-    init_written: bool,
-}
-
-impl<W: Write> FragmentedWriter<W> {
-    pub fn new(w: W, opts: WriterOptions) -> Self {
-        FragmentedWriter { w, opts, tracks: Vec::new(), pending: Vec::new(), next_dts: Vec::new(), seq: 0, init_written: false }
-    }
-
-    /// Add a track (before the first fragment). PCM is not supported in fragments.
-    pub fn add_track(&mut self, cfg: TrackConfig) -> Result<usize> {
-        if self.init_written {
-            return Err(Error::Mux("tracks must be added before the first fragment".into()));
-        }
-        if validate_track(&cfg)?.is_some() {
-            return Err(Error::Mux("PCM is not supported by the fragmented writer".into()));
-        }
-        let handler = handler_of(&cfg.entry);
-        self.tracks.push(WTrack { id: self.tracks.len() as u32 + 1, handler, pcm_frame_bytes: None, t: Tables::new(), cfg, tmcd_ref: None, tmcd_source: None });
-        self.pending.push(Vec::new());
-        self.next_dts.push(0);
-        Ok(self.tracks.len() - 1)
-    }
-
-    fn write_init(&mut self) -> Result<()> {
-        let qt = self.opts.brand == Brand::Mov;
-        let ts = self.opts.movie_timescale.max(1);
-        let mut b = BoxBuf::new();
-        write_ftyp(&mut b, self.opts.brand);
-        let m = b.start(b"moov");
-        write_mvhd(&mut b, ts, 0, self.tracks.len() as u32 + 1);
-        for t in &self.tracks {
-            write_trak(&mut b, t, ts, qt, 0, false)?;
-        }
-        let mv = b.start(b"mvex");
-        for t in &self.tracks {
-            let x = b.start_full(b"trex", 0, 0);
-            b.u32(t.id);
-            b.u32(1);
-            b.u32(0);
-            b.u32(0);
-            b.u32(0);
-            b.end(x);
-        }
-        b.end(mv);
-        write_udta(&mut b, &self.opts.metadata);
-        b.end(m);
-        self.w.write_all(&b.buf)?;
-        self.init_written = true;
-        Ok(())
-    }
-
-    /// Buffer a sample for the next fragment.
-    pub fn write_sample(&mut self, track: usize, s: WriteSample) -> Result<()> {
-        let p = self.pending.get_mut(track).ok_or(Error::NoSuchTrack(track))?;
-        if s.data.len() > u32::MAX as usize {
-            return Err(Error::Mux("sample larger than 4 GiB".into()));
-        }
-        p.push((s.data.to_vec(), s.duration, s.composition_offset, s.is_sync));
-        Ok(())
-    }
-
-    fn build_moof(&self, data_offsets: &[i32]) -> Vec<u8> {
-        let mut b = BoxBuf::new();
-        let m = b.start(b"moof");
-        let h = b.start_full(b"mfhd", 0, 0);
-        b.u32(self.seq);
-        b.end(h);
-        for (i, t) in self.tracks.iter().enumerate() {
-            let p = &self.pending[i];
-            if p.is_empty() {
-                continue;
-            }
-            let tf = b.start(b"traf");
-            let h = b.start_full(b"tfhd", 0, 0x20000);
-            b.u32(t.id);
-            b.end(h);
-            let h = b.start_full(b"tfdt", 1, 0);
-            b.u64(self.next_dts[i]);
-            b.end(h);
-            let neg = p.iter().any(|s| s.2 < 0);
-            let h = b.start_full(b"trun", neg as u8, 0x1 | 0x100 | 0x200 | 0x400 | 0x800);
-            b.u32(p.len() as u32);
-            b.i32(data_offsets[i]);
-            for (d, dur, cto, sync) in p {
-                b.u32(*dur);
-                b.u32(d.len() as u32);
-                b.u32(if *sync { 0x0200_0000 } else { 0x0101_0000 });
-                b.i32(*cto);
-            }
-            b.end(h);
-            b.end(tf);
-        }
-        b.end(m);
-        b.buf
-    }
-
-    /// Write all buffered samples as one `moof` + `mdat` fragment (no-op if nothing is buffered).
-    pub fn flush_fragment(&mut self) -> Result<()> {
-        if !self.init_written {
-            self.write_init()?;
-        }
-        if self.pending.iter().all(|p| p.is_empty()) {
-            return Ok(());
-        }
-        self.seq += 1;
-        let probe = self.build_moof(&vec![0; self.tracks.len()]);
-        let data_len: u64 = self.pending.iter().flatten().map(|s| s.0.len() as u64).sum();
-        let large = data_len + 8 > u32::MAX as u64;
-        let hdr = if large { 16 } else { 8 };
-        let mut offs = Vec::with_capacity(self.tracks.len());
-        let mut acc = probe.len() as u64 + hdr;
-        for p in &self.pending {
-            offs.push(i32::try_from(acc).map_err(|_| Error::Mux("fragment too large".into()))?);
-            acc += p.iter().map(|s| s.0.len() as u64).sum::<u64>();
-        }
-        let moof = self.build_moof(&offs);
-        self.w.write_all(&moof)?;
-        if large {
-            self.w.write_all(&1u32.to_be_bytes())?;
-            self.w.write_all(b"mdat")?;
-            self.w.write_all(&(data_len + 16).to_be_bytes())?;
-        } else {
-            self.w.write_all(&((data_len + 8) as u32).to_be_bytes())?;
-            self.w.write_all(b"mdat")?;
-        }
-        for (i, p) in self.pending.iter_mut().enumerate() {
-            for (d, dur, _, _) in p.drain(..) {
-                self.w.write_all(&d)?;
-                self.next_dts[i] += dur as u64;
-            }
-        }
-        Ok(())
-    }
-
-    /// Flush remaining samples and return the writer.
-    pub fn finish(mut self) -> Result<W> {
-        self.flush_fragment()?;
-        self.w.flush()?;
-        Ok(self.w)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::codec::{AvcConfig, PcmConfig};
-    use std::io::Cursor;
-
-    fn avc_entry() -> SampleEntry {
-        SampleEntry::avc(AvcConfig::new(vec![vec![0x67, 0x42, 0, 0x1E]], vec![vec![0x68, 0xCE]], 4), 64, 48)
-    }
-
-    #[test]
-    fn language_pack() {
-        assert_eq!(pack_language("und"), 0x55C4);
-        assert_eq!(pack_language("eng"), 0x15C7);
-        assert_eq!(pack_language("EN"), 0x55C4);
-    }
-
-    #[test]
-    fn simple_roundtrip_and_faststart() {
-        for fast in [false, true] {
-            let mut w = Mp4Writer::new(Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4)).unwrap();
-            let v = w.add_track(TrackConfig::new(avc_entry(), 12800)).unwrap();
-            let pcm = PcmConfig { bits: 16, float: false, big_endian: false, signed: true, channels: 2, sample_rate: 48000.0 };
-            let a = w.add_track(TrackConfig::new(SampleEntry::pcm(pcm), 48000)).unwrap();
-            for i in 0..10u8 {
-                let data = vec![i; 100 + i as usize];
-                w.write_sample(v, WriteSample { data: &data, duration: 512, composition_offset: if i % 2 == 0 { 1024 } else { 0 }, is_sync: i % 5 == 0 })
-                    .unwrap();
-                w.write_sample(a, WriteSample { data: &[i; 400], duration: 0, composition_offset: 0, is_sync: true }).unwrap();
-            }
-            let out = if fast { w.finish_faststart() } else { w.finish() }.unwrap().into_inner();
-            let f = crate::open(out.as_slice()).unwrap();
-            assert_eq!(f.tracks.len(), 2);
-            let t = &f.tracks[0];
-            assert_eq!(t.samples.len(), 10);
-            for (i, s) in t.samples.iter().enumerate() {
-                assert_eq!(s.size as usize, 100 + i);
-                assert_eq!(s.dts, 512 * i as i64);
-                assert_eq!(s.is_sync, i % 5 == 0);
-                assert_eq!(f.read_sample(out.as_slice(), 0, i).unwrap(), vec![i as u8; 100 + i]);
-            }
-            let at = &f.tracks[1];
-            assert!(at.pcm_chunked);
-            assert_eq!(at.samples.len(), 10);
-            assert_eq!(at.samples[3].size, 400);
-            assert_eq!(at.samples[3].duration, 100);
-            assert_eq!(f.read_sample(out.as_slice(), 1, 3).unwrap(), vec![3u8; 400]);
-            if fast {
-                assert!(f.moov_offset < t.samples[0].offset);
-            }
-        }
-    }
-
-    #[test]
-    fn fragmented_roundtrip() {
-        let mut w = FragmentedWriter::new(Vec::new(), WriterOptions::new(Brand::Mp4));
-        let v = w.add_track(TrackConfig::new(avc_entry(), 1000)).unwrap();
-        for i in 0..6u8 {
-            w.write_sample(v, WriteSample { data: &[i; 10], duration: 40, composition_offset: -(i as i32 % 2), is_sync: i % 3 == 0 }).unwrap();
-            if i % 3 == 2 {
-                w.flush_fragment().unwrap();
-            }
-        }
-        let out = w.finish().unwrap();
-        let f = crate::open(out.as_slice()).unwrap();
-        assert!(f.fragmented);
-        assert_eq!(f.fragment_count, 2);
-        let t = &f.tracks[0];
-        assert_eq!(t.samples.len(), 6);
-        for (i, s) in t.samples.iter().enumerate() {
-            assert_eq!(s.dts, 40 * i as i64);
-            assert_eq!(s.pts, s.dts - (i as i64 % 2));
-            assert_eq!(s.is_sync, i % 3 == 0);
-            assert_eq!(f.read_sample(out.as_slice(), 0, i).unwrap(), vec![i as u8; 10]);
-        }
-        assert_eq!(t.sync_sample_before(5), 3);
-    }
-}
diff --git a/crates/isobmff/src/source.rs b/crates/isobmff/src/source.rs
deleted file mode 100644
index 0dad82b20..000000000
--- a/crates/isobmff/src/source.rs
+++ /dev/null
@@ -1,123 +0,0 @@
-//! Random-access byte sources for the demuxer.
-
-use std::io;
-use std::sync::Arc;
-
-/// Random-access, read-only byte source (file, in-memory buffer, web Blob…).
-///
-/// Implementations must be able to serve reads at arbitrary offsets through `&self`.
-pub trait ByteSource {
-    /// Total length in bytes.
-    fn len(&self) -> u64;
-    /// Fill `buf` entirely with bytes starting at `offset`; fail with `UnexpectedEof` if past the end.
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()>;
-    /// True if the source holds no bytes.
-    fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-fn eof() -> io::Error {
-    io::Error::new(io::ErrorKind::UnexpectedEof, "read past end of byte source")
-}
-
-impl ByteSource for [u8] {
-    fn len(&self) -> u64 {
-        <[u8]>::len(self) as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        let start = usize::try_from(offset).map_err(|_| eof())?;
-        let end = start.checked_add(buf.len()).ok_or_else(eof)?;
-        let src = self.get(start..end).ok_or_else(eof)?;
-        buf.copy_from_slice(src);
-        Ok(())
-    }
-}
-
-impl ByteSource for Vec<u8> {
-    fn len(&self) -> u64 {
-        self.as_slice().len() as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        self.as_slice().read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for &T {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for Arc<T> {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for Box<T> {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl ByteSource for std::fs::File {
-    fn len(&self) -> u64 {
-        self.metadata().map(|m| m.len()).unwrap_or(0)
-    }
-    #[cfg(unix)]
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        std::os::unix::fs::FileExt::read_exact_at(self, buf, offset)
-    }
-    #[cfg(windows)]
-    fn read_at(&self, mut offset: u64, mut buf: &mut [u8]) -> io::Result<()> {
-        use std::os::windows::fs::FileExt;
-        while !buf.is_empty() {
-            let n = self.seek_read(buf, offset)?;
-            if n == 0 {
-                return Err(eof());
-            }
-            offset += n as u64;
-            buf = &mut buf[n..];
-        }
-        Ok(())
-    }
-    #[cfg(not(any(unix, windows)))]
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        use std::io::{Read, Seek, SeekFrom};
-        let mut f = self;
-        f.seek(SeekFrom::Start(offset))?;
-        f.read_exact(buf)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn slice_reads() {
-        let v = vec![1u8, 2, 3, 4];
-        let mut b = [0u8; 2];
-        v.read_at(1, &mut b).unwrap();
-        assert_eq!(b, [2, 3]);
-        assert!(v.read_at(3, &mut b).is_err());
-        assert!(v.read_at(u64::MAX, &mut b).is_err());
-        let a: Arc<[u8]> = Arc::from(v.clone());
-        a.read_at(2, &mut b).unwrap();
-        assert_eq!(b, [3, 4]);
-        assert_eq!(ByteSource::len(&a), 4);
-        let s: &[u8] = &v;
-        assert_eq!(ByteSource::len(&s), 4);
-    }
-}
diff --git a/crates/isobmff/tests/common/mod.rs b/crates/isobmff/tests/it/common/mod.rs
similarity index 100%
rename from crates/isobmff/tests/common/mod.rs
rename to crates/isobmff/tests/it/common/mod.rs
diff --git a/crates/isobmff/tests/fuzz.rs b/crates/isobmff/tests/it/fuzz.rs
similarity index 99%
rename from crates/isobmff/tests/fuzz.rs
rename to crates/isobmff/tests/it/fuzz.rs
index b6d2fcea6..17c376a5e 100644
--- a/crates/isobmff/tests/fuzz.rs
+++ b/crates/isobmff/tests/it/fuzz.rs
@@ -1,6 +1,6 @@
 //! Deterministic mutation fuzzing: the demuxer must never panic on corrupted input.
 
-mod common;
+use crate::common;
 
 use filmcraft_isobmff::*;
 use std::io::Cursor;
diff --git a/crates/isobmff/tests/it/main.rs b/crates/isobmff/tests/it/main.rs
new file mode 100644
index 000000000..48e623e19
--- /dev/null
+++ b/crates/isobmff/tests/it/main.rs
@@ -0,0 +1,5 @@
+mod common;
+mod fuzz;
+mod oracle_demux;
+mod oracle_mux;
+mod roundtrip;
diff --git a/crates/isobmff/tests/oracle_demux.rs b/crates/isobmff/tests/it/oracle_demux.rs
similarity index 99%
rename from crates/isobmff/tests/oracle_demux.rs
rename to crates/isobmff/tests/it/oracle_demux.rs
index 45ffe3b58..9e2cd0b28 100644
--- a/crates/isobmff/tests/oracle_demux.rs
+++ b/crates/isobmff/tests/it/oracle_demux.rs
@@ -1,6 +1,6 @@
 //! Oracle tests: compare our demuxer's sample tables and codec parameters with ffprobe.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_isobmff::{CodecConfig, Mp4File, TrackKind, open};
diff --git a/crates/isobmff/tests/oracle_mux.rs b/crates/isobmff/tests/it/oracle_mux.rs
similarity index 99%
rename from crates/isobmff/tests/oracle_mux.rs
rename to crates/isobmff/tests/it/oracle_mux.rs
index 4b9144241..5383211f6 100644
--- a/crates/isobmff/tests/oracle_mux.rs
+++ b/crates/isobmff/tests/it/oracle_mux.rs
@@ -1,6 +1,6 @@
 //! Muxer oracle tests: remux ffmpeg-made files with our writers and validate with ffmpeg/ffprobe.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_isobmff::*;
diff --git a/crates/isobmff/tests/roundtrip.rs b/crates/isobmff/tests/it/roundtrip.rs
similarity index 100%
rename from crates/isobmff/tests/roundtrip.rs
rename to crates/isobmff/tests/it/roundtrip.rs
diff --git a/crates/matroska/Cargo.toml b/crates/matroska/Cargo.toml
index 9f64162fb..1cebf9d31 100644
--- a/crates/matroska/Cargo.toml
+++ b/crates/matroska/Cargo.toml
@@ -10,6 +10,7 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
+craft-media = { workspace = true, features = ["matroska"] }
 
 [dev-dependencies]
 filmcraft-testkit = { workspace = true }
diff --git a/crates/matroska/README.md b/crates/matroska/README.md
index 40210ad0a..47b9cb623 100644
--- a/crates/matroska/README.md
+++ b/crates/matroska/README.md
@@ -1,115 +1,3 @@
 # filmcraft-matroska
 
-A clean-room Matroska (MKV) and WebM demuxer, plus a minimal muxer, written from the public
-specifications: RFC 8794 (EBML), RFC 9559 (Matroska), the Matroska codec mappings and the WebM
-container guidelines. Layer L0: it depends only on `std`, has no `unsafe`, and builds for
-`wasm32-unknown-unknown`. No GPL/LGPL code (FFmpeg, libmatroska, mkvtoolnix) was consulted;
-FFmpeg is used only as an external test oracle.
-
-## Demuxing
-
-```rust
-use filmcraft_matroska::{Demuxer, TrackKind, open};
-
-// Sample tables, same shape as filmcraft-isobmff (any ByteSource: &[u8], Vec<u8>, Arc<[u8]>, File…)
-let file = std::fs::File::open("clip.mkv")?;
-let mkv = open(&file)?;
-let v = mkv.track_of_kind(TrackKind::Video).unwrap();
-let k = mkv.keyframe_before(v, 2_000_000_000).unwrap();   // sample index
-let frame = mkv.read_sample(&file, v, k)?;
-
-// Streaming packets + seeking (from a ByteSource, any Read + Seek, or a byte slice)
-let mut d = Demuxer::from_reader(std::io::BufReader::new(std::fs::File::open("clip.webm")?))?;
-let sp = d.seek(v, 2_000_000_000)?;          // lands on the keyframe with pts ≤ 2 s
-while let Some(p) = d.next_packet()? {        // file order, all tracks
-    // p.track, p.pts (ticks), p.pts_ns, p.duration, p.keyframe, p.data
-}
-```
-
-- **Open** (`open`, `open_with(src, &OpenOptions { index, verify_crc })`): EBML header (DocType
-  `matroska`/`webm`), the first Segment, and its level-1 elements: SeekHead (followed for elements
-  after the clusters), Info, Tracks, Cues, Chapters, Tags, Attachments (listed; payload located by
-  offset/size, never read). With `index: true` (default) every Cluster is scanned — element and block
-  headers only, never frame payloads — to build per-track `Sample` tables (`offset`, `size`, `pts`,
-  `duration`, `keyframe`, cluster, block offset, lace index) and keyframe lists. With `index: false`
-  open stops at the first Cluster.
-- **Timestamps.** Matroska ticks are `TimestampScale` ns (usually 1 ms); `Track::timebase` is that
-  as a reduced fraction of a second. `pts` is in ticks, `pts_ns` in exact nanoseconds. `CodecDelay`
-  is subtracted (RFC 9559), as FFmpeg does (Opus/Vorbis priming gives negative pts). Laced frames get
-  `block ts + i × (BlockDuration or DefaultDuration)/n`; if neither is known, later laces repeat the
-  block timestamp and have `duration == 0` (`Packet::lace` tells which).
-- **Keyframes:** SimpleBlock keyframe flag; BlockGroup = keyframe iff it has no ReferenceBlock.
-- **Lacing:** Xiph, fixed-size, EBML. **Unknown sizes:** Segment (live/streamed output) and
-  Clusters end at the next top-level element. **CRC-32:** optional verification of level-1
-  elements and clusters; mismatches go to `MkvFile::crc_errors` (not fatal). **Void** skipped.
-- **Damage:** undecodable/oversized elements trigger a byte scan for the next plausible level-1
-  element (Cluster whose first child is Timestamp, or a sized metadata element); a truncated final
-  block is dropped. Problems are listed in `MkvFile::warnings`.
-- **Seeking** (`Demuxer::seek(track, time_ns)`): uses the sample index when present; otherwise Cues
-  (refined by scanning the cued cluster for the exact keyframe); otherwise builds the index by
-  scanning all clusters. `Demuxer::keyframe_index(track)` returns the keyframe list.
-- **Tracks:** number/UID/type/flags, `DefaultDuration`, name, language (+BCP 47), CodecID,
-  CodecPrivate, CodecName, `CodecDelay`, `SeekPreRoll`; `VideoInfo` (pixel/display size, crop,
-  interlacing, stereo, alpha mode, `pixel_aspect()`), `Colour` (matrix, range, transfer, primaries,
-  subsampling/siting, MaxCLL/MaxFALL, SMPTE 2086 mastering metadata); `AudioInfo` (rate, output
-  rate, channels, bit depth); `ContentEncoding`s.
-- **Content encodings:** header stripping is undone in every packet / `read_sample`. zlib/bzlib/
-  lzo compression and encryption are reported (`Track::frames_readable() == false`); packets are
-  then returned as stored and `read_sample` fails with `Unsupported`.
-
-### Codec mapping (`Codec`)
-
-| CodecID | `Codec` | payload |
-|---|---|---|
-| `V_MPEG4/ISO/AVC` | `Avc` | avcC (CodecPrivate) |
-| `V_MPEGH/ISO/HEVC` | `Hevc` | hvcC |
-| `V_VP8`, `V_VP9` | `Vp8`, `Vp9` | VP9 CodecPrivate features |
-| `V_AV1` | `Av1` | av1C |
-| `V_PRORES` | `ProRes` | FourCC; frames get the 8-byte `size`+`icpf` header re-added |
-| `V_MJPEG`, `V_MS/VFW/FOURCC` (MJPG) | `Mjpeg` | |
-| `V_MS/VFW/FOURCC` (other) | `VfwFourcc` | BITMAPINFOHEADER |
-| `A_AAC`, legacy `A_AAC/MPEG{2,4}/…` | `Aac` | AudioSpecificConfig (synthesised for legacy IDs, incl. SBR) |
-| `A_OPUS` | `Opus` | OpusHead |
-| `A_VORBIS` | `Vorbis` | three headers split from Xiph-laced CodecPrivate |
-| `A_FLAC` | `Flac` | `fLaC` + metadata blocks |
-| `A_PCM/INT/LIT`, `A_PCM/INT/BIG`, `A_PCM/FLOAT/IEEE` | `Pcm` | bit depth from Audio |
-| `A_AC3`, `A_EAC3`, `A_MPEG/L3`, `A_MPEG/L2`, `A_MPEG/L1` | `Ac3`, `Eac3`, `Mp3`, `Mp2`, `Mp1` | |
-| `S_TEXT/UTF8` | `SubRip` | |
-| `S_TEXT/WEBVTT`, `D_WEBVTT/*` (WebM) | `WebVtt` | WebM blocks keep `id\nsettings\npayload` |
-| `S_TEXT/ASS`, `S_TEXT/SSA` | `Ass` | script header |
-| anything else | `Other(id)` | `Track::codec_private` |
-
-`Codec::name()` matches FFmpeg's `codec_name` for these.
-
-## Muxing (minimal)
-
-`MkvWriter::new(w: Write + Seek, Vec<TrackSpec>, MuxOptions)` → `write_frame(track, pts_ns,
-keyframe, data, duration_ns)` → `finish()`. Writes the EBML header, Segment, SeekHead, Info (with
-Duration), Tracks, Clusters of SimpleBlocks (new cluster at a video keyframe after
-`cluster_duration_ns`), BlockGroups for explicit durations, optional audio lacing (Xiph, EBML,
-fixed-size), and Cues (video keyframes, or the first frame of each track per cluster). No
-CRC-32, Chapters, Tags, Attachments, or content encodings.
-
-## Tests
-
-- Unit: EBML VINTs (known/unknown sizes, IDs, signed lace deltas), typed values, CRC-32, all lacing
-  modes, codec mapping, a hand-built file (unknown-size Segment/Clusters, header stripping,
-  BlockGroups, Colour + mastering metadata, Chapters, Tags, Attachments, CRC-32 pass/fail, Cue-less
-  seek), and mux → demux round trips for every lacing mode.
-- Oracle (`tests/oracle.rs`, skipped without ffmpeg/ffprobe; fixtures in `target/fixtures/matroska`):
-  H.264+AAC, VP9+Opus WebM, FLAC, Vorbis, SRT+ASS subtitles, WebVTT WebM, Cues at front, a
-  streamed (pipe) file without Cues, HEVC with HDR colour, ProRes+PCM, MJPEG+AC-3, AV1. Every packet
-  is compared with `ffprobe -show_packets` (stream, size, keyframe flag, pts, duration), plus codec
-  names, time bases, dimensions, audio params and duration; the sample index must equal the packet
-  stream. Seeks (indexed, Cues-only, and index-on-demand) must land on the latest keyframe ≤ target.
-  Our muxer's laced output (Xiph/EBML/fixed) is read back by ffprobe and compared the same way.
-  A damaged file must resync and deliver the packets after the damage; truncated files must not fail.
-
-## Limitations
-
-- Only the first Segment is read (no linked/chained segments, no ordered-chapter editions playback).
-- zlib/bzlib/lzo compressed and encrypted tracks are detected but their frames are not decoded.
-- BlockAdditions (e.g. VP9 alpha, WebVTT settings in Matroska) are skipped; `EncryptedBlock` ignored.
-- `TrackTimestampScale` (deprecated) is ignored.
-- Lace timestamps without any duration information repeat the block timestamp (FFmpeg derives them
-  from codec parsers).
+A re-export of `craft_media::matroska`. Documentation: https://github.com/storytold/craft-libs/blob/main/crates/media/README.md
diff --git a/crates/matroska/src/codec.rs b/crates/matroska/src/codec.rs
deleted file mode 100644
index 8d83a974b..000000000
--- a/crates/matroska/src/codec.rs
+++ /dev/null
@@ -1,236 +0,0 @@
-//! Matroska CodecID → codec mapping (Matroska codec specifications, RFC 9559 §5.1.4.1.21 and the
-//! codec mappings registry).
-
-/// Codec of a track, derived from `CodecID` and `CodecPrivate`.
-///
-/// Configuration records are passed through as the raw bytes found in `CodecPrivate`, which for
-/// the ISO codecs are exactly the ISOBMFF configuration boxes' payloads (avcC, hvcC, av1C, ASC…).
-#[derive(Clone, Debug, PartialEq)]
-pub enum Codec {
-    /// `V_MPEG4/ISO/AVC`; payload is an `AVCDecoderConfigurationRecord` (avcC).
-    Avc { avcc: Vec<u8> },
-    /// `V_MPEGH/ISO/HEVC`; payload is an `HEVCDecoderConfigurationRecord` (hvcC).
-    Hevc { hvcc: Vec<u8> },
-    /// `V_VP8`.
-    Vp8,
-    /// `V_VP9`; `CodecPrivate` (optional) holds VP9 codec feature metadata.
-    Vp9 { private: Vec<u8> },
-    /// `V_AV1`; payload is an `AV1CodecConfigurationRecord` (av1C).
-    Av1 { av1c: Vec<u8> },
-    /// `V_APV`; payload is an `APVDecoderConfigurationRecord` (apvC), if present.
-    Apv { apvc: Vec<u8> },
-    /// `V_PRORES`; `fourcc` from `CodecPrivate` (e.g. `apcn`), if present.
-    ProRes { fourcc: Option<[u8; 4]> },
-    /// `V_MJPEG`, or `V_MS/VFW/FOURCC` with an `MJPG` compression FourCC.
-    Mjpeg,
-    /// `V_MS/VFW/FOURCC` with any other FourCC; `bitmap_info_header` is the whole `CodecPrivate`.
-    VfwFourcc { fourcc: [u8; 4], bitmap_info_header: Vec<u8> },
-    /// `A_AAC` (and the legacy `A_AAC/MPEG{2,4}/<profile>` IDs); `asc` is the
-    /// `AudioSpecificConfig` (synthesised for legacy IDs without `CodecPrivate`).
-    Aac { asc: Vec<u8> },
-    /// `A_OPUS`; `head` is the `OpusHead` identification header.
-    Opus { head: Vec<u8> },
-    /// `A_VORBIS`; the three Vorbis headers (identification, comment, setup), split from the
-    /// Xiph-laced `CodecPrivate`.
-    Vorbis { headers: Vec<Vec<u8>> },
-    /// `A_FLAC`; `private` is `fLaC` + metadata blocks (STREAMINFO first).
-    Flac { private: Vec<u8> },
-    /// `A_PCM/INT/LIT`, `A_PCM/INT/BIG`, `A_PCM/FLOAT/IEEE`. Bit depth comes from the Audio element.
-    Pcm { float: bool, big_endian: bool, bits: u16 },
-    /// `A_AC3`.
-    Ac3,
-    /// `A_EAC3`.
-    Eac3,
-    /// `A_MPEG/L3`.
-    Mp3,
-    /// `A_MPEG/L2`.
-    Mp2,
-    /// `A_MPEG/L1`.
-    Mp1,
-    /// `S_TEXT/UTF8` (SubRip-style plain text).
-    SubRip,
-    /// `S_TEXT/WEBVTT`, or WebM's `D_WEBVTT/{SUBTITLES,CAPTIONS,DESCRIPTIONS,METADATA}`.
-    WebVtt,
-    /// `S_TEXT/ASS` / `S_TEXT/SSA`; `header` is the script header from `CodecPrivate`.
-    Ass { header: Vec<u8>, ssa: bool },
-    /// Any other CodecID (kept verbatim along with `Track::codec_private`).
-    Other(String),
-}
-
-impl Codec {
-    /// Short codec name, matching FFmpeg's `codec_name` where one exists (useful for logs/UI).
-    pub fn name(&self) -> String {
-        match self {
-            Codec::Avc { .. } => "h264".into(),
-            Codec::Hevc { .. } => "hevc".into(),
-            Codec::Vp8 => "vp8".into(),
-            Codec::Vp9 { .. } => "vp9".into(),
-            Codec::Av1 { .. } => "av1".into(),
-            Codec::Apv { .. } => "apv".into(),
-            Codec::ProRes { .. } => "prores".into(),
-            Codec::Mjpeg => "mjpeg".into(),
-            Codec::VfwFourcc { fourcc, .. } => String::from_utf8_lossy(fourcc).trim().to_ascii_lowercase(),
-            Codec::Aac { .. } => "aac".into(),
-            Codec::Opus { .. } => "opus".into(),
-            Codec::Vorbis { .. } => "vorbis".into(),
-            Codec::Flac { .. } => "flac".into(),
-            Codec::Pcm { float, big_endian, bits } => {
-                let k = if *float {
-                    'f'
-                } else if *bits == 8 {
-                    'u'
-                } else {
-                    's'
-                };
-                if *bits == 8 { format!("pcm_{k}8") } else { format!("pcm_{k}{bits}{}", if *big_endian { "be" } else { "le" }) }
-            }
-            Codec::Ac3 => "ac3".into(),
-            Codec::Eac3 => "eac3".into(),
-            Codec::Mp3 => "mp3".into(),
-            Codec::Mp2 => "mp2".into(),
-            Codec::Mp1 => "mp1".into(),
-            Codec::SubRip => "subrip".into(),
-            Codec::WebVtt => "webvtt".into(),
-            Codec::Ass { ssa, .. } => if *ssa { "ssa" } else { "ass" }.into(),
-            Codec::Other(id) => id.clone(),
-        }
-    }
-}
-
-const AAC_RATES: [u32; 13] = [96000, 88200, 64000, 48000, 44100, 32000, 24000, 22050, 16000, 12000, 11025, 8000, 7350];
-
-/// Build a 2-byte (or 5-byte with SBR extension) AudioSpecificConfig for legacy `A_AAC/...` IDs.
-fn synth_asc(object_type: u8, rate: f64, out_rate: Option<f64>, channels: u64, sbr: bool) -> Vec<u8> {
-    let rate_index = |r: f64| AAC_RATES.iter().position(|&x| x as f64 == r).unwrap_or(4) as u8;
-    let ri = rate_index(rate);
-    let ch = channels.min(7) as u8;
-    let mut v = vec![(object_type << 3) | (ri >> 1), ((ri & 1) << 7) | (ch << 3)];
-    if sbr {
-        // backward-compatible explicit signalling: sync 0x2b7, SBR object type 5, flag, ext rate index
-        let ext = rate_index(out_rate.unwrap_or(rate * 2.0));
-        v.push(0x56);
-        v.push(0xE5);
-        v.push(0x80 | (ext << 3));
-    }
-    v
-}
-
-/// Split a Xiph-laced `CodecPrivate` (Vorbis/Theora headers).
-fn split_xiph(p: &[u8]) -> Vec<Vec<u8>> {
-    let Some(&n) = p.first() else { return Vec::new() };
-    let mut pos = 1;
-    let mut sizes = Vec::new();
-    for _ in 0..n {
-        let mut s = 0usize;
-        loop {
-            let Some(&b) = p.get(pos) else { return Vec::new() };
-            pos += 1;
-            s += b as usize;
-            if b != 255 {
-                break;
-            }
-        }
-        sizes.push(s);
-    }
-    let mut out = Vec::new();
-    for s in sizes {
-        let Some(h) = p.get(pos..pos + s) else { return Vec::new() };
-        out.push(h.to_vec());
-        pos += s;
-    }
-    out.push(p[pos.min(p.len())..].to_vec());
-    out
-}
-
-/// Map a CodecID + CodecPrivate (+ audio params for legacy AAC / PCM) to a [`Codec`].
-pub(crate) fn map_codec(id: &str, private: &[u8], audio: Option<&crate::AudioInfo>) -> Codec {
-    let p = private.to_vec();
-    match id {
-        "V_MPEG4/ISO/AVC" => Codec::Avc { avcc: p },
-        "V_MPEGH/ISO/HEVC" => Codec::Hevc { hvcc: p },
-        "V_VP8" => Codec::Vp8,
-        "V_VP9" => Codec::Vp9 { private: p },
-        "V_AV1" => Codec::Av1 { av1c: p },
-        "V_APV" => Codec::Apv { apvc: p },
-        "V_PRORES" => Codec::ProRes { fourcc: private.get(..4).and_then(|f| f.try_into().ok()) },
-        "V_MJPEG" => Codec::Mjpeg,
-        "V_MS/VFW/FOURCC" => {
-            let fourcc: [u8; 4] = private.get(16..20).and_then(|f| f.try_into().ok()).unwrap_or(*b"    ");
-            match &fourcc {
-                b"MJPG" | b"mjpg" | b"AVRn" | b"AVDJ" => Codec::Mjpeg,
-                b"H264" | b"h264" | b"avc1" | b"X264" | b"x264" => Codec::Avc { avcc: Vec::new() },
-                b"apch" | b"apcn" | b"apcs" | b"apco" | b"ap4h" | b"ap4x" => Codec::ProRes { fourcc: Some(fourcc) },
-                b"apv1" | b"APV1" => Codec::Apv { apvc: Vec::new() },
-                _ => Codec::VfwFourcc { fourcc, bitmap_info_header: p },
-            }
-        }
-        "A_AAC" => Codec::Aac { asc: p },
-        "A_OPUS" => Codec::Opus { head: p },
-        "A_VORBIS" => Codec::Vorbis { headers: split_xiph(private) },
-        "A_FLAC" => Codec::Flac { private: p },
-        "A_PCM/INT/LIT" | "A_PCM/INT/BIG" | "A_PCM/FLOAT/IEEE" => {
-            let bits = audio.and_then(|a| a.bit_depth).unwrap_or(if id == "A_PCM/FLOAT/IEEE" { 32 } else { 16 }) as u16;
-            Codec::Pcm { float: id == "A_PCM/FLOAT/IEEE", big_endian: id == "A_PCM/INT/BIG", bits }
-        }
-        "A_AC3" | "A_AC3/BSID9" | "A_AC3/BSID10" => Codec::Ac3,
-        "A_EAC3" => Codec::Eac3,
-        "A_MPEG/L3" => Codec::Mp3,
-        "A_MPEG/L2" => Codec::Mp2,
-        "A_MPEG/L1" => Codec::Mp1,
-        "S_TEXT/UTF8" => Codec::SubRip,
-        "S_TEXT/WEBVTT" | "D_WEBVTT/SUBTITLES" | "D_WEBVTT/CAPTIONS" | "D_WEBVTT/DESCRIPTIONS" | "D_WEBVTT/METADATA" => Codec::WebVtt,
-        "S_TEXT/ASS" | "S_ASS" => Codec::Ass { header: p, ssa: false },
-        "S_TEXT/SSA" | "S_SSA" => Codec::Ass { header: p, ssa: true },
-        _ if id.starts_with("A_AAC/") => {
-            if !private.is_empty() {
-                return Codec::Aac { asc: p };
-            }
-            let (rate, out_rate, ch) = audio.map_or((48000.0, None, 2), |a| (a.sampling_frequency, a.output_sampling_frequency, a.channels));
-            let object_type = if id.ends_with("/MAIN") {
-                1
-            } else if id.ends_with("/SSR") {
-                3
-            } else if id.ends_with("/LTP") {
-                4
-            } else {
-                2
-            };
-            let sbr = id.ends_with("/SBR");
-            Codec::Aac { asc: synth_asc(object_type, rate, out_rate, ch, sbr) }
-        }
-        _ => Codec::Other(id.to_string()),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn mapping() {
-        assert_eq!(map_codec("V_MPEG4/ISO/AVC", &[1, 2], None), Codec::Avc { avcc: vec![1, 2] });
-        assert_eq!(map_codec("V_APV", &[1, 2, 3], None), Codec::Apv { apvc: vec![1, 2, 3] });
-        assert_eq!(map_codec("V_APV", &[], None).name(), "apv");
-        assert_eq!(map_codec("V_PRORES", b"apcn", None), Codec::ProRes { fourcc: Some(*b"apcn") });
-        let mut bih = vec![0u8; 40];
-        bih[16..20].copy_from_slice(b"MJPG");
-        assert_eq!(map_codec("V_MS/VFW/FOURCC", &bih, None), Codec::Mjpeg);
-        bih[16..20].copy_from_slice(b"FFV1");
-        assert!(matches!(map_codec("V_MS/VFW/FOURCC", &bih, None), Codec::VfwFourcc { fourcc, .. } if &fourcc == b"FFV1"));
-        let a = crate::AudioInfo { sampling_frequency: 44100.0, channels: 2, bit_depth: Some(24), output_sampling_frequency: None };
-        assert_eq!(map_codec("A_PCM/INT/LIT", &[], Some(&a)).name(), "pcm_s24le");
-        assert_eq!(map_codec("A_PCM/FLOAT/IEEE", &[], Some(&a)), Codec::Pcm { float: true, big_endian: false, bits: 24 });
-        // legacy AAC LC 44.1k stereo → 0x12 0x10
-        assert_eq!(map_codec("A_AAC/MPEG4/LC", &[], Some(&a)), Codec::Aac { asc: vec![0x12, 0x10] });
-        assert_eq!(map_codec("S_TEXT/UTF8", &[], None).name(), "subrip");
-        assert_eq!(map_codec("X_WHATEVER", &[], None), Codec::Other("X_WHATEVER".into()));
-    }
-
-    #[test]
-    fn xiph_split() {
-        let mut p = vec![2u8, 3, 2];
-        p.extend_from_slice(&[1, 1, 1, 2, 2, 3, 3, 3, 3]);
-        let h = split_xiph(&p);
-        assert_eq!(h, vec![vec![1, 1, 1], vec![2, 2], vec![3, 3, 3, 3]]);
-    }
-}
diff --git a/crates/matroska/src/demux.rs b/crates/matroska/src/demux.rs
deleted file mode 100644
index 4278a1b83..000000000
--- a/crates/matroska/src/demux.rs
+++ /dev/null
@@ -1,1219 +0,0 @@
-//! Matroska / WebM demuxer: EBML header, Segment walk, cluster scanning, packet reading, seeking.
-
-use std::collections::{HashSet, VecDeque};
-
-use crate::ebml::{self, Children, Lacing, Size, parse_lacing, read_id, read_size};
-use crate::error::{Error, Result};
-use crate::ids::*;
-use crate::meta::*;
-use crate::source::{ByteSource, ReadSeekSource};
-use crate::track::{Sample, Track, TrackKind, gcd};
-
-const WIN: usize = 64 * 1024;
-/// Upper bound for level-1 metadata elements read into memory (Info, Tracks, Cues, Tags…).
-const MAX_META: u64 = 256 << 20;
-
-/// Options for [`open_with`] / [`Demuxer::with_options`].
-#[derive(Clone, Debug)]
-pub struct OpenOptions {
-    /// Scan every cluster at open to build per-track sample tables and keyframe indices
-    /// (reads only element and block headers, never frame payloads). Default `true`.
-    ///
-    /// With `false`, open stops at the first Cluster and uses the SeekHead to find Cues, Tags,
-    /// Chapters… placed after the clusters; [`Demuxer::seek`] then uses Cues (or builds the index
-    /// on first use if there are none).
-    pub index: bool,
-    /// Verify CRC-32 elements of level-1 elements (and clusters while indexing). Mismatches are
-    /// recorded in [`MkvFile::crc_errors`]; parsing continues. Default `false`.
-    pub verify_crc: bool,
-}
-
-impl Default for OpenOptions {
-    fn default() -> Self {
-        Self { index: true, verify_crc: false }
-    }
-}
-
-/// A parsed Matroska / WebM file (first Segment).
-#[derive(Clone, Debug)]
-pub struct MkvFile {
-    /// EBML `DocType`: `matroska` or `webm`.
-    pub doc_type: String,
-    pub doc_type_version: u64,
-    pub doc_type_read_version: u64,
-    /// Absolute offset of the Segment's data (base for SeekHead and Cues positions).
-    pub segment_data_start: u64,
-    /// Absolute end of the Segment (file end for unknown-size / live segments).
-    pub segment_end: u64,
-    /// Segment size field was "unknown" (live / streamed output).
-    pub live: bool,
-    pub info: SegmentInfo,
-    pub tracks: Vec<Track>,
-    pub seek_head: Vec<SeekEntry>,
-    /// Cue points, sorted by time.
-    pub cues: Vec<CuePoint>,
-    /// Clusters in file order (complete only when [`MkvFile::indexed`]).
-    pub clusters: Vec<ClusterInfo>,
-    pub chapters: Vec<Edition>,
-    pub tags: Vec<Tag>,
-    pub attachments: Vec<Attachment>,
-    /// Absolute offset of the first Cluster.
-    pub first_cluster: Option<u64>,
-    /// Sample tables have been built by scanning all clusters.
-    pub indexed: bool,
-    /// Number of CRC-32 elements verified (with `verify_crc`).
-    pub crc_checked: u32,
-    /// Absolute offsets of elements whose CRC-32 did not match.
-    pub crc_errors: Vec<u64>,
-    /// Non-fatal problems met while parsing (damage, resyncs, truncation).
-    pub warnings: Vec<String>,
-}
-
-/// One demuxed frame.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Packet {
-    /// Index into [`MkvFile::tracks`].
-    pub track: usize,
-    /// Matroska `TrackNumber`.
-    pub track_number: u64,
-    /// Presentation timestamp in timestamp ticks (the track timebase, [`Track::timebase`]).
-    pub pts: i64,
-    /// Presentation timestamp in nanoseconds.
-    pub pts_ns: i64,
-    /// Duration in ticks (0 if unknown).
-    pub duration: u64,
-    /// Duration in nanoseconds (0 if unknown).
-    pub duration_ns: u64,
-    pub keyframe: bool,
-    pub discardable: bool,
-    pub invisible: bool,
-    /// `DiscardPadding` (ns) from the enclosing BlockGroup.
-    pub discard_padding_ns: Option<i64>,
-    /// Absolute offset of the stored frame data.
-    pub offset: u64,
-    /// Index of the frame within a laced block (0 when not laced). Laced frames after the first
-    /// only have exact timestamps when the block or track carries a duration; otherwise they
-    /// repeat the block timestamp and `duration` is 0.
-    pub lace: u16,
-    /// Frame bytes with header stripping undone. Frames of tracks with other content encodings
-    /// (zlib, encryption) are returned as stored; see [`Track::frames_readable`].
-    pub data: Vec<u8>,
-}
-
-/// Result of [`Demuxer::seek`].
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct SeekPoint {
-    pub track: usize,
-    /// Keyframe timestamp in ticks and ns.
-    pub pts: i64,
-    pub pts_ns: i64,
-    /// Sample index of the keyframe when the file is indexed.
-    pub sample: Option<usize>,
-    pub cluster_offset: u64,
-    pub block_offset: u64,
-}
-
-/// A keyframe index entry ([`Demuxer::keyframe_index`]).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Keyframe {
-    pub sample: usize,
-    pub pts: i64,
-    pub pts_ns: i64,
-    pub block_offset: u64,
-}
-
-// ---------------------------------------------------------------------------------------------
-// I/O with a small read window
-// ---------------------------------------------------------------------------------------------
-
-#[derive(Default, Clone, Debug)]
-struct Cache {
-    buf: Vec<u8>,
-    start: u64,
-}
-
-struct Io<'a, S: ByteSource + ?Sized> {
-    src: &'a S,
-    len: u64,
-    cache: &'a mut Cache,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct Hdr {
-    id: u32,
-    pos: u64,
-    size: Size,
-    hlen: usize,
-}
-
-impl Hdr {
-    fn data_start(&self) -> u64 {
-        self.pos + self.hlen as u64
-    }
-    /// End offset, clamped to `limit`; unknown sizes run to `limit`.
-    fn end(&self, limit: u64) -> u64 {
-        match self.size {
-            Size::Known(n) => self.data_start().saturating_add(n).min(limit),
-            Size::Unknown => limit,
-        }
-    }
-    fn overruns(&self, limit: u64) -> bool {
-        matches!(self.size, Size::Known(n) if self.data_start().saturating_add(n) > limit)
-    }
-}
-
-impl<'a, S: ByteSource + ?Sized> Io<'a, S> {
-    fn new(src: &'a S, cache: &'a mut Cache) -> Self {
-        let len = src.len();
-        Self { src, len, cache }
-    }
-
-    /// Up to `n` (≤ WIN) bytes at `pos` (fewer at EOF).
-    fn peek(&mut self, pos: u64, n: usize) -> Result<&[u8]> {
-        let n = n.min(WIN);
-        if pos >= self.len {
-            return Ok(&[]);
-        }
-        let want_end = (pos + n as u64).min(self.len);
-        let c = &*self.cache;
-        if !(pos >= c.start && want_end <= c.start + c.buf.len() as u64) {
-            let fill = ((self.len - pos) as usize).min(WIN);
-            let mut buf = std::mem::take(&mut self.cache.buf);
-            buf.resize(fill, 0);
-            self.src.read_at(pos, &mut buf)?;
-            self.cache.buf = buf;
-            self.cache.start = pos;
-        }
-        let o = (pos - self.cache.start) as usize;
-        Ok(&self.cache.buf[o..o + (want_end - pos) as usize])
-    }
-
-    /// Exactly `n` bytes at `pos`.
-    fn read_vec(&mut self, pos: u64, n: u64) -> Result<Vec<u8>> {
-        if pos.checked_add(n).is_none_or(|e| e > self.len) {
-            return Err(Error::Io(std::io::Error::new(std::io::ErrorKind::UnexpectedEof, "read past end of file")));
-        }
-        if n as usize <= WIN / 2 {
-            return Ok(self.peek(pos, n as usize)?.to_vec());
-        }
-        let mut v = vec![0u8; n as usize];
-        self.src.read_at(pos, &mut v)?;
-        Ok(v)
-    }
-
-    /// Element header at `pos` (`None` if undecodable or past `limit`).
-    fn header(&mut self, pos: u64, limit: u64) -> Result<Option<Hdr>> {
-        if pos >= limit {
-            return Ok(None);
-        }
-        let b = self.peek(pos, 12)?;
-        let Some((id, il)) = read_id(b) else { return Ok(None) };
-        let Some((size, sl)) = read_size(&b[il..]) else { return Ok(None) };
-        let hlen = il + sl;
-        if pos + hlen as u64 > limit {
-            return Ok(None);
-        }
-        Ok(Some(Hdr { id, pos, size, hlen }))
-    }
-
-    /// Scan forward from `from` for a plausible level-1 element (Cluster preferred), up to `limit`.
-    fn resync(&mut self, from: u64, limit: u64) -> Result<Option<u64>> {
-        let mut pos = from;
-        while pos + 4 <= limit {
-            let chunk = self.peek(pos, WIN)?.to_vec();
-            if chunk.len() < 4 {
-                return Ok(None);
-            }
-            for i in 0..chunk.len() - 3 {
-                if chunk[i] & 0xF0 != 0x10 {
-                    continue;
-                }
-                let id = u32::from_be_bytes([chunk[i], chunk[i + 1], chunk[i + 2], chunk[i + 3]]);
-                if !is_top_level(id) || id == EBML || id == SEGMENT {
-                    continue;
-                }
-                let p = pos + i as u64;
-                if self.plausible(p, id, limit)? {
-                    return Ok(Some(p));
-                }
-            }
-            pos += (chunk.len() - 3) as u64;
-        }
-        Ok(None)
-    }
-
-    fn plausible(&mut self, p: u64, id: u32, limit: u64) -> Result<bool> {
-        let Some(h) = self.header(p, limit)? else { return Ok(false) };
-        if h.id != id || h.overruns(limit) {
-            return Ok(false);
-        }
-        if h.size == Size::Unknown && id != CLUSTER {
-            return Ok(false);
-        }
-        // first child must decode and fit; clusters must start with Timestamp (after CRC-32/Void)
-        let mut cp = h.data_start();
-        let end = h.end(limit);
-        for _ in 0..3 {
-            let Some(c) = self.header(cp, end)? else { return Ok(false) };
-            if c.overruns(end) {
-                return Ok(false);
-            }
-            if id != CLUSTER {
-                return Ok(true);
-            }
-            match c.id {
-                TIMESTAMP => return Ok(true),
-                CRC32 | VOID => cp = c.end(end),
-                _ => return Ok(false),
-            }
-        }
-        Ok(false)
-    }
-
-    /// End of an unknown-size master element: the first child that is a top-level ID or undecodable.
-    fn unknown_end(&mut self, data_start: u64, limit: u64) -> Result<u64> {
-        let mut pos = data_start;
-        while pos < limit {
-            let Some(h) = self.header(pos, limit)? else { return Ok(pos) };
-            if is_top_level(h.id) || h.size == Size::Unknown {
-                return Ok(pos);
-            }
-            pos = h.end(limit);
-        }
-        Ok(limit)
-    }
-}
-
-// ---------------------------------------------------------------------------------------------
-// Blocks
-// ---------------------------------------------------------------------------------------------
-
-#[derive(Clone, Debug)]
-struct BlockRef {
-    track: usize,
-    block_offset: u64,
-    /// Timestamp in ticks (cluster + relative).
-    ts: i64,
-    /// Absolute (offset, size) of each frame.
-    frames: Vec<(u64, u32)>,
-    block_duration: Option<u64>,
-    keyframe: bool,
-    discardable: bool,
-    invisible: bool,
-    discard_padding: Option<i64>,
-    /// (offset, size) of the `BlockAdditional` with `BlockAddID` 1 (WebM: the VP8/VP9 alpha
-    /// layer), kept for unlaced blocks only.
-    addition: Option<(u64, u32)>,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct FrameRef {
-    track: usize,
-    offset: u64,
-    size: u32,
-    pts: i64,
-    pts_ns: i64,
-    duration: u64,
-    duration_ns: u64,
-    keyframe: bool,
-    discardable: bool,
-    invisible: bool,
-    discard_padding: Option<i64>,
-    block_offset: u64,
-    lace: u16,
-    addition: Option<(u64, u32)>,
-}
-
-fn track_lookup(tracks: &[Track]) -> impl Fn(u64) -> Option<usize> + '_ {
-    move |n| tracks.iter().position(|t| t.number == n)
-}
-
-/// Parse the Block/SimpleBlock header at `data_start` (`len` bytes).
-/// Returns (track index, relative ts, flags, frames) or `None` for unknown tracks / damage.
-fn parse_block<S: ByteSource + ?Sized>(
-    io: &mut Io<'_, S>,
-    data_start: u64,
-    len: u64,
-    lookup: &dyn Fn(u64) -> Option<usize>,
-) -> Result<Option<(usize, i16, u8, Vec<(u64, u32)>)>> {
-    let head = io.peek(data_start, 16.min(len as usize))?;
-    let Some((tn, tl, _)) = ebml::read_vint(head) else { return Ok(None) };
-    if head.len() < tl + 3 {
-        return Ok(None);
-    }
-    let rel = i16::from_be_bytes([head[tl], head[tl + 1]]);
-    let flags = head[tl + 2];
-    let Some(track) = lookup(tn) else { return Ok(None) };
-    let hdr = (tl + 3) as u64;
-    let lacing = Lacing::from_flags(flags);
-    let frames = if lacing == Lacing::None {
-        vec![(data_start + hdr, (len - hdr) as u32)]
-    } else {
-        let body = io.read_vec(data_start + hdr, len - hdr)?;
-        match parse_lacing(lacing, &body) {
-            Ok(f) => f.into_iter().map(|(o, l)| (data_start + hdr + o as u64, l as u32)).collect(),
-            Err(_) => return Ok(None),
-        }
-    };
-    Ok(Some((track, rel, flags, frames)))
-}
-
-/// The `BlockAdditional` with `BlockAddID` 1 (the default ID) in a `BlockAdditions` element:
-/// (offset, size) of its data. Other IDs, empty additions and damaged children are skipped.
-fn block_addition<S: ByteSource + ?Sized>(io: &mut Io<'_, S>, start: u64, end: u64) -> Result<Option<(u64, u32)>> {
-    let mut pos = start;
-    while pos < end {
-        let Some(more) = io.header(pos, end)? else { break };
-        let me = more.end(end);
-        if more.id == BLOCK_MORE {
-            let (mut id, mut data) = (1u64, None);
-            let mut p = more.data_start();
-            while p < me {
-                let Some(c) = io.header(p, me)? else { break };
-                let ce = c.end(me);
-                let len = ce.saturating_sub(c.data_start());
-                match c.id {
-                    BLOCK_ADD_ID => id = ebml::uint(io.peek(c.data_start(), len.min(8) as usize)?),
-                    BLOCK_ADDITIONAL => data = u32::try_from(len).ok().filter(|&n| n > 0).map(|n| (c.data_start(), n)),
-                    _ => {}
-                }
-                p = ce;
-            }
-            if id == 1 && data.is_some() {
-                return Ok(data);
-            }
-        }
-        pos = me;
-    }
-    Ok(None)
-}
-
-/// Parse one SimpleBlock or BlockGroup element.
-fn parse_block_elem<S: ByteSource + ?Sized>(
-    io: &mut Io<'_, S>,
-    h: &Hdr,
-    end: u64,
-    cluster_ts: i64,
-    lookup: &dyn Fn(u64) -> Option<usize>,
-) -> Result<Option<BlockRef>> {
-    let ds = h.data_start();
-    match h.id {
-        SIMPLE_BLOCK => {
-            let Some((track, rel, flags, frames)) = parse_block(io, ds, end - ds, lookup)? else { return Ok(None) };
-            Ok(Some(BlockRef {
-                track,
-                block_offset: h.pos,
-                ts: cluster_ts + rel as i64,
-                frames,
-                block_duration: None,
-                keyframe: flags & 0x80 != 0,
-                discardable: flags & 0x01 != 0,
-                invisible: flags & 0x08 != 0,
-                discard_padding: None,
-                addition: None,
-            }))
-        }
-        BLOCK_GROUP => {
-            let mut pos = ds;
-            let mut block = None;
-            let (mut dur, mut has_ref, mut pad, mut addition) = (None, false, None, None);
-            while pos < end {
-                let Some(c) = io.header(pos, end)? else { break };
-                let ce = c.end(end);
-                match c.id {
-                    BLOCK => block = parse_block(io, c.data_start(), ce - c.data_start(), lookup)?,
-                    BLOCK_ADDITIONS => addition = block_addition(io, c.data_start(), ce)?,
-                    BLOCK_DURATION => dur = Some(ebml::uint(io.peek(c.data_start(), (ce - c.data_start()) as usize)?)),
-                    REFERENCE_BLOCK => has_ref = true,
-                    DISCARD_PADDING => pad = Some(ebml::int(io.peek(c.data_start(), (ce - c.data_start()) as usize)?)),
-                    _ => {}
-                }
-                pos = ce;
-            }
-            let Some((track, rel, flags, frames)) = block else { return Ok(None) };
-            // with lacing, an addition belongs to the block, not to one of its frames
-            let addition = addition.filter(|_| frames.len() == 1);
-            Ok(Some(BlockRef {
-                track,
-                block_offset: h.pos,
-                ts: cluster_ts + rel as i64,
-                frames,
-                block_duration: dur,
-                keyframe: !has_ref,
-                discardable: false,
-                invisible: flags & 0x08 != 0,
-                discard_padding: pad,
-                addition,
-            }))
-        }
-        _ => Ok(None),
-    }
-}
-
-/// Expand a block into frames with per-lace timestamps.
-fn expand(b: &BlockRef, t: &Track, scale: u64, skip: u16, out: &mut impl Extend<FrameRef>) {
-    let n = b.frames.len() as u64;
-    // total block duration in ns
-    let block_ns: Option<u128> = match (b.block_duration, t.default_duration_ns) {
-        (Some(d), _) => Some(d as u128 * scale as u128),
-        (None, Some(dd)) => Some(dd as u128 * n as u128),
-        _ => None,
-    };
-    let scale_i = scale as i128;
-    // round half away from zero
-    let to_ticks = |ns: i128| -> i64 { (if ns >= 0 { (ns + scale_i / 2) / scale_i } else { (ns - scale_i / 2) / scale_i }) as i64 };
-    // CodecDelay is subtracted from every timestamp (RFC 9559 §5.1.4.1.25); in ticks it is rounded
-    // once, so tick timestamps stay on the block grid.
-    let delay_ns = t.codec_delay_ns as i128;
-    let delay_ticks = to_ticks(delay_ns);
-    let base_ns = b.ts as i128 * scale_i;
-    out.extend(b.frames.iter().enumerate().skip(skip as usize).map(|(i, &(offset, size))| {
-        let (start, end) = match block_ns {
-            Some(total) => ((total * i as u128 / n as u128) as i128, Some((total * (i as u128 + 1) / n as u128) as i128)),
-            None => (0, None),
-        };
-        let pts_ns = base_ns + start - delay_ns;
-        let pts = to_ticks(base_ns + start) - delay_ticks;
-        let duration = end.map_or(0, |e| (to_ticks(e) - to_ticks(start)).max(0) as u64);
-        FrameRef {
-            track: b.track,
-            offset,
-            size,
-            pts,
-            pts_ns: pts_ns as i64,
-            duration,
-            duration_ns: end.map_or(0, |e| (e - start).max(0) as u64),
-            keyframe: b.keyframe,
-            discardable: b.discardable,
-            invisible: b.invisible,
-            discard_padding: b.discard_padding,
-            block_offset: b.block_offset,
-            lace: i as u16,
-            addition: b.addition,
-        }
-    }));
-}
-
-/// Scan a whole cluster (headers only), returning its info and blocks.
-fn scan_cluster<S: ByteSource + ?Sized>(
-    io: &mut Io<'_, S>,
-    h: &Hdr,
-    limit: u64,
-    tracks: &[Track],
-    warnings: &mut Vec<String>,
-) -> Result<(ClusterInfo, Vec<BlockRef>)> {
-    let lookup = track_lookup(tracks);
-    let ds = h.data_start();
-    let known_end = match h.size {
-        Size::Known(_) => Some(h.end(limit)),
-        Size::Unknown => None,
-    };
-    let lim = known_end.unwrap_or(limit);
-    let mut ts: i64 = 0;
-    let mut blocks = Vec::new();
-    let mut pos = ds;
-    let end = loop {
-        if pos >= lim {
-            break lim;
-        }
-        let Some(c) = io.header(pos, lim)? else {
-            warnings.push(format!("damaged cluster at {}: undecodable element at {pos}", h.pos));
-            break io.resync(pos + 1, limit)?.unwrap_or(limit);
-        };
-        if known_end.is_none() && is_top_level(c.id) {
-            break pos;
-        }
-        if c.size == Size::Unknown || c.overruns(lim) {
-            warnings.push(format!("damaged cluster at {}: element 0x{:X} at {pos} overruns", h.pos, c.id));
-            if c.overruns(lim) && matches!(c.id, SIMPLE_BLOCK | BLOCK_GROUP) && io.len <= c.data_start() + c.size.known().unwrap_or(0) {
-                break lim; // truncated file: drop the partial block
-            }
-            break io.resync(pos + 1, limit)?.unwrap_or(limit);
-        }
-        let ce = c.end(lim);
-        match c.id {
-            TIMESTAMP => ts = ebml::uint(io.peek(c.data_start(), (ce - c.data_start()) as usize)?) as i64,
-            SIMPLE_BLOCK | BLOCK_GROUP => {
-                if let Some(b) = parse_block_elem(io, &c, ce, ts, &lookup)? {
-                    blocks.push(b);
-                }
-            }
-            _ => {}
-        }
-        pos = ce;
-    };
-    Ok((ClusterInfo { offset: h.pos, data_start: ds, end, timestamp: ts.max(0) as u64 }, blocks))
-}
-
-// ---------------------------------------------------------------------------------------------
-// Open
-// ---------------------------------------------------------------------------------------------
-
-/// Open a Matroska/WebM file with default options (full sample index).
-pub fn open<S: ByteSource>(src: S) -> Result<MkvFile> {
-    open_with(src, &OpenOptions::default())
-}
-
-/// Open with explicit options.
-pub fn open_with<S: ByteSource>(src: S, opts: &OpenOptions) -> Result<MkvFile> {
-    let mut cache = Cache::default();
-    open_impl(&src, opts, &mut cache)
-}
-
-fn open_impl<S: ByteSource + ?Sized>(src: &S, opts: &OpenOptions, cache: &mut Cache) -> Result<MkvFile> {
-    let mut io = Io::new(src, cache);
-    let len = io.len;
-    // EBML header (tolerate leading junk in the first 64 KiB)
-    let start = {
-        let b = io.peek(0, WIN)?;
-        let magic = [0x1A, 0x45, 0xDF, 0xA3];
-        b.windows(4).position(|w| w == magic).ok_or_else(|| Error::NotMatroska("no EBML header".into()))? as u64
-    };
-    let eh = io.header(start, len)?.ok_or_else(|| Error::NotMatroska("bad EBML header".into()))?;
-    let hdr_end = eh.end(len);
-    let hdr = io.read_vec(eh.data_start(), hdr_end - eh.data_start())?;
-    let (mut doc_type, mut dtv, mut dtrv) = ("matroska".to_string(), 1, 1);
-    for e in Children::new(&hdr) {
-        match e.id {
-            DOC_TYPE => doc_type = ebml::string(e.data),
-            DOC_TYPE_VERSION => dtv = ebml::uint(e.data),
-            DOC_TYPE_READ_VERSION => dtrv = ebml::uint(e.data),
-            EBML_MAX_ID_LENGTH if ebml::uint(e.data) > 4 => return Err(Error::Unsupported("EBMLMaxIDLength > 4".into())),
-            EBML_MAX_SIZE_LENGTH if ebml::uint(e.data) > 8 => return Err(Error::Unsupported("EBMLMaxSizeLength > 8".into())),
-            _ => {}
-        }
-    }
-    if doc_type != "matroska" && doc_type != "webm" {
-        return Err(Error::NotMatroska(format!("DocType {doc_type:?}")));
-    }
-    // Segment
-    let mut pos = hdr_end;
-    let seg = loop {
-        let h = io.header(pos, len)?.ok_or_else(|| Error::Invalid("no Segment".into()))?;
-        if h.id == SEGMENT {
-            break h;
-        }
-        if h.size == Size::Unknown {
-            return Err(Error::Invalid("unknown-size element before Segment".into()));
-        }
-        pos = h.end(len);
-    };
-    let mut file = MkvFile {
-        doc_type,
-        doc_type_version: dtv,
-        doc_type_read_version: dtrv,
-        segment_data_start: seg.data_start(),
-        segment_end: seg.end(len),
-        live: seg.size == Size::Unknown,
-        info: SegmentInfo::default(),
-        tracks: Vec::new(),
-        seek_head: Vec::new(),
-        cues: Vec::new(),
-        clusters: Vec::new(),
-        chapters: Vec::new(),
-        tags: Vec::new(),
-        attachments: Vec::new(),
-        first_cluster: None,
-        indexed: false,
-        crc_checked: 0,
-        crc_errors: Vec::new(),
-        warnings: Vec::new(),
-    };
-    if seg.overruns(len) {
-        file.warnings.push("Segment extends past end of file (truncated)".into());
-    }
-    let mut w = Walker { opts, parsed: HashSet::new(), blocks_seen: false };
-    w.walk(&mut io, &mut file)?;
-    finish_tracks(&mut file);
-    Ok(file)
-}
-
-struct Walker<'o> {
-    opts: &'o OpenOptions,
-    parsed: HashSet<u64>,
-    blocks_seen: bool,
-}
-
-impl Walker<'_> {
-    fn walk<S: ByteSource + ?Sized>(&mut self, io: &mut Io<'_, S>, file: &mut MkvFile) -> Result<()> {
-        let seg_end = file.segment_end;
-        let mut pos = file.segment_data_start;
-        while pos < seg_end {
-            let Some(h) = io.header(pos, seg_end)? else {
-                match io.resync(pos + 1, seg_end)? {
-                    Some(p) => {
-                        file.warnings.push(format!("undecodable element at {pos}; resynced at {p}"));
-                        pos = p;
-                        continue;
-                    }
-                    None => break,
-                }
-            };
-            match h.id {
-                CLUSTER => {
-                    if file.first_cluster.is_none() {
-                        file.first_cluster = Some(h.pos);
-                        // make sure Info/Tracks are known before interpreting blocks
-                        self.follow_seek_head(io, file, &[INFO, TRACKS])?;
-                        if !self.opts.index {
-                            break;
-                        }
-                    }
-                    let (ci, blocks) = scan_cluster(io, &h, seg_end, &file.tracks, &mut file.warnings)?;
-                    if self.opts.verify_crc && h.size != Size::Unknown {
-                        let data = io.read_vec(h.data_start(), ci.end - h.data_start())?;
-                        self.check_crc(file, h.pos, &data);
-                    }
-                    add_blocks(file, file.clusters.len() as u32, &blocks);
-                    self.blocks_seen = true;
-                    file.clusters.push(ci);
-                    pos = ci.end.max(h.data_start());
-                }
-                SEEK_HEAD | INFO | TRACKS | CUES | CHAPTERS | TAGS | ATTACHMENTS => {
-                    pos = self.level1(io, file, &h, seg_end)?;
-                }
-                EBML | SEGMENT => break, // chained segment: only the first one is read
-                _ => {
-                    if h.size == Size::Unknown {
-                        pos = io.unknown_end(h.data_start(), seg_end)?;
-                    } else if h.overruns(seg_end) && h.id != VOID {
-                        match io.resync(pos + 1, seg_end)? {
-                            Some(p) => {
-                                file.warnings.push(format!("oversized element 0x{:X} at {pos}; resynced at {p}", h.id));
-                                pos = p;
-                            }
-                            None => break,
-                        }
-                    } else {
-                        pos = h.end(seg_end);
-                    }
-                }
-            }
-        }
-        self.follow_seek_head(io, file, &[INFO, TRACKS, CUES, CHAPTERS, TAGS, ATTACHMENTS, SEEK_HEAD])?;
-        // follow a second-level SeekHead reached through the first one
-        self.follow_seek_head(io, file, &[CUES, CHAPTERS, TAGS, ATTACHMENTS])?;
-        file.cues.sort_by_key(|c| c.time);
-        file.indexed = self.opts.index;
-        Ok(())
-    }
-
-    fn follow_seek_head<S: ByteSource + ?Sized>(&mut self, io: &mut Io<'_, S>, file: &mut MkvFile, ids: &[u32]) -> Result<()> {
-        let entries = file.seek_head.clone();
-        for e in entries {
-            if !ids.contains(&e.id) {
-                continue;
-            }
-            let Some(abs) = file.segment_data_start.checked_add(e.position) else { continue };
-            if self.parsed.contains(&abs) || abs >= file.segment_end {
-                continue;
-            }
-            match io.header(abs, file.segment_end)? {
-                Some(h) if h.id == e.id => {
-                    self.level1(io, file, &h, file.segment_end)?;
-                }
-                _ => file.warnings.push(format!("SeekHead entry 0x{:X} -> {abs} does not point at that element", e.id)),
-            }
-        }
-        Ok(())
-    }
-
-    fn check_crc(&self, file: &mut MkvFile, pos: u64, data: &[u8]) {
-        if let Some(ok) = ebml::verify_crc(data) {
-            file.crc_checked += 1;
-            if !ok {
-                file.crc_errors.push(pos);
-                file.warnings.push(format!("CRC-32 mismatch in element at {pos}"));
-            }
-        }
-    }
-
-    /// Parse a level-1 metadata element; returns its end.
-    fn level1<S: ByteSource + ?Sized>(&mut self, io: &mut Io<'_, S>, file: &mut MkvFile, h: &Hdr, limit: u64) -> Result<u64> {
-        let end = if h.size == Size::Unknown { io.unknown_end(h.data_start(), limit)? } else { h.end(limit) };
-        if h.overruns(limit) {
-            file.warnings.push(format!("element 0x{:X} at {} truncated", h.id, h.pos));
-        }
-        if !self.parsed.insert(h.pos) {
-            return Ok(end);
-        }
-        if h.id == ATTACHMENTS {
-            self.attachments(io, file, h.data_start(), end)?;
-            return Ok(end);
-        }
-        let n = end - h.data_start();
-        if n > MAX_META {
-            file.warnings.push(format!("element 0x{:X} at {} too large ({n} bytes); skipped", h.id, h.pos));
-            return Ok(end);
-        }
-        let data = io.read_vec(h.data_start(), n)?;
-        if self.opts.verify_crc {
-            self.check_crc(file, h.pos, &data);
-        }
-        match h.id {
-            SEEK_HEAD => file.seek_head.extend(parse_seekhead(&data)),
-            INFO => file.info = parse_info(&data),
-            TRACKS if file.tracks.is_empty() => {
-                file.tracks = parse_tracks(&data, file.info.timestamp_scale);
-            }
-            CUES => parse_cues(&data, &mut file.cues),
-            CHAPTERS => parse_chapters(&data, &mut file.chapters),
-            TAGS => parse_tags(&data, &mut file.tags),
-            _ => {}
-        }
-        Ok(end)
-    }
-
-    fn attachments<S: ByteSource + ?Sized>(&mut self, io: &mut Io<'_, S>, file: &mut MkvFile, start: u64, end: u64) -> Result<()> {
-        let mut pos = start;
-        while pos < end {
-            let Some(h) = io.header(pos, end)? else { break };
-            let he = h.end(end);
-            if h.id == ATTACHED_FILE {
-                let mut a = Attachment::default();
-                let mut p = h.data_start();
-                while p < he {
-                    let Some(c) = io.header(p, he)? else { break };
-                    let ce = c.end(he);
-                    let n = ce - c.data_start();
-                    if c.id == FILE_DATA {
-                        a.data_offset = c.data_start();
-                        a.data_size = n;
-                    } else if n <= 4096 {
-                        let d = io.peek(c.data_start(), n as usize)?;
-                        match c.id {
-                            FILE_NAME => a.name = ebml::string(d),
-                            FILE_MEDIA_TYPE => a.media_type = ebml::string(d),
-                            FILE_DESCRIPTION => a.description = Some(ebml::string(d)),
-                            FILE_UID => a.uid = ebml::uint(d),
-                            _ => {}
-                        }
-                    }
-                    p = ce;
-                }
-                file.attachments.push(a);
-            }
-            pos = he;
-        }
-        Ok(())
-    }
-}
-
-fn add_blocks(file: &mut MkvFile, cluster: u32, blocks: &[BlockRef]) {
-    let scale = file.info.timestamp_scale;
-    let mut frames: Vec<FrameRef> = Vec::new();
-    for b in blocks {
-        frames.clear();
-        let t = &file.tracks[b.track];
-        expand(b, t, scale, 0, &mut frames);
-        let t = &mut file.tracks[b.track];
-        for f in &frames {
-            if f.keyframe {
-                t.sync.push(t.samples.len() as u32);
-            }
-            t.samples.push(Sample {
-                offset: f.offset,
-                size: f.size,
-                pts: f.pts,
-                duration: f.duration,
-                keyframe: f.keyframe,
-                cluster,
-                block_offset: f.block_offset,
-                lace: f.lace,
-                addition: f.addition,
-            });
-        }
-    }
-}
-
-fn finish_tracks(file: &mut MkvFile) {
-    let scale = file.info.timestamp_scale;
-    let g = gcd(scale, 1_000_000_000);
-    for t in &mut file.tracks {
-        t.timebase = (scale / g, 1_000_000_000 / g);
-    }
-}
-
-// ---------------------------------------------------------------------------------------------
-// MkvFile helpers
-// ---------------------------------------------------------------------------------------------
-
-impl MkvFile {
-    /// True for WebM (`DocType` = `webm`).
-    pub fn is_webm(&self) -> bool {
-        self.doc_type == "webm"
-    }
-
-    /// Segment duration in ns: `Info/Duration` if present, else the end of the last indexed sample.
-    pub fn duration_ns(&self) -> Option<u64> {
-        if let Some(d) = self.info.duration {
-            return Some((d * self.info.timestamp_scale as f64).round() as u64);
-        }
-        let end = self.tracks.iter().flat_map(|t| t.samples.iter().map(|s| s.pts + s.duration as i64)).max()?;
-        Some((end.max(0) as u64).saturating_mul(self.info.timestamp_scale))
-    }
-
-    /// Index of the track with this `TrackNumber`.
-    pub fn track_by_number(&self, number: u64) -> Option<usize> {
-        self.tracks.iter().position(|t| t.number == number)
-    }
-
-    /// Index of the first track of the given kind (preferring the default flag).
-    pub fn track_of_kind(&self, kind: TrackKind) -> Option<usize> {
-        let mut it = self.tracks.iter().enumerate().filter(|(_, t)| t.kind == kind);
-        let first = it.clone().next().map(|x| x.0);
-        it.find(|(_, t)| t.default).map(|x| x.0).or(first)
-    }
-
-    /// Read sample `index` of `track` (header stripping undone).
-    pub fn read_sample<S: ByteSource + ?Sized>(&self, src: &S, track: usize, index: usize) -> Result<Vec<u8>> {
-        let t = self.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        let s = t.samples.get(index).ok_or(Error::NoSuchSample(index))?;
-        if !t.frames_readable() {
-            return Err(Error::Unsupported(format!("content encoding of track {} (compression/encryption)", t.number)));
-        }
-        let mut data = t.frame_prefix(s.size as u64);
-        let at = data.len();
-        data.resize(at + s.size as usize, 0);
-        src.read_at(s.offset, &mut data[at..])?;
-        Ok(data)
-    }
-
-    /// The `BlockAdditional` (ID 1) of sample `index` of `track`, `None` when the block has none
-    /// (see [`Sample::addition`]). Stored as is: header stripping applies to frames only.
-    pub fn read_sample_addition<S: ByteSource + ?Sized>(&self, src: &S, track: usize, index: usize) -> Result<Option<Vec<u8>>> {
-        let t = self.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        let s = t.samples.get(index).ok_or(Error::NoSuchSample(index))?;
-        let Some((offset, size)) = s.addition else { return Ok(None) };
-        if offset.checked_add(size as u64).is_none_or(|end| end > src.len()) {
-            return Err(Error::Invalid("block addition past end of file".into()));
-        }
-        let mut data = vec![0; size as usize];
-        src.read_at(offset, &mut data)?;
-        Ok(Some(data))
-    }
-
-    /// Keyframe sample of `track` with the greatest pts ≤ `time_ns` (indexed files only).
-    pub fn keyframe_before(&self, track: usize, time_ns: i64) -> Option<usize> {
-        let t = self.tracks.get(track)?;
-        t.keyframe_before_pts(t.ns_to_ticks(time_ns))
-    }
-}
-
-// ---------------------------------------------------------------------------------------------
-// Demuxer (streaming packets + seeking)
-// ---------------------------------------------------------------------------------------------
-
-#[derive(Clone, Copy, Debug)]
-struct InCluster {
-    ts: i64,
-    end: Option<u64>,
-}
-
-/// Packet reader over a [`ByteSource`]: iterates frames in file order and seeks to keyframes.
-pub struct Demuxer<S> {
-    src: S,
-    file: MkvFile,
-    opts: OpenOptions,
-    cache: Cache,
-    pos: u64,
-    cluster: Option<InCluster>,
-    pending: VecDeque<FrameRef>,
-    skip_laces: Option<(u64, u16)>,
-    done: bool,
-}
-
-impl<R: std::io::Read + std::io::Seek> Demuxer<ReadSeekSource<R>> {
-    /// Open from any `Read + Seek` stream.
-    pub fn from_reader(r: R) -> Result<Self> {
-        Self::new(ReadSeekSource::new(r)?)
-    }
-}
-
-impl<'a> Demuxer<&'a [u8]> {
-    /// Open from an in-memory byte slice.
-    pub fn from_slice(data: &'a [u8]) -> Result<Self> {
-        Self::new(data)
-    }
-}
-
-impl<S: ByteSource> Demuxer<S> {
-    /// Open with default options (full index).
-    pub fn new(src: S) -> Result<Self> {
-        Self::with_options(src, OpenOptions::default())
-    }
-
-    pub fn with_options(src: S, opts: OpenOptions) -> Result<Self> {
-        let mut cache = Cache::default();
-        let file = open_impl(&src, &opts, &mut cache)?;
-        let pos = file.first_cluster.unwrap_or(file.segment_end);
-        Ok(Self { src, file, opts, cache, pos, cluster: None, pending: VecDeque::new(), skip_laces: None, done: false })
-    }
-
-    pub fn file(&self) -> &MkvFile {
-        &self.file
-    }
-    pub fn tracks(&self) -> &[Track] {
-        &self.file.tracks
-    }
-    pub fn source(&self) -> &S {
-        &self.src
-    }
-    pub fn into_parts(self) -> (S, MkvFile) {
-        (self.src, self.file)
-    }
-    /// Segment duration in ns.
-    pub fn duration_ns(&self) -> Option<u64> {
-        self.file.duration_ns()
-    }
-
-    /// Scan all clusters and build sample tables (no-op if already indexed).
-    pub fn build_index(&mut self) -> Result<()> {
-        if self.file.indexed {
-            return Ok(());
-        }
-        let opts = OpenOptions { index: true, verify_crc: self.opts.verify_crc };
-        self.file = open_impl(&self.src, &opts, &mut self.cache)?;
-        Ok(())
-    }
-
-    /// Keyframes of `track` (builds the index if needed).
-    pub fn keyframe_index(&mut self, track: usize) -> Result<Vec<Keyframe>> {
-        self.build_index()?;
-        let t = self.file.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        Ok(t.keyframes()
-            .iter()
-            .map(|&k| {
-                let s = &t.samples[k as usize];
-                Keyframe { sample: k as usize, pts: s.pts, pts_ns: t.ticks_to_ns(s.pts), block_offset: s.block_offset }
-            })
-            .collect())
-    }
-
-    /// Rewind to the first cluster.
-    pub fn rewind(&mut self) {
-        self.pos = self.file.first_cluster.unwrap_or(self.file.segment_end);
-        self.cluster = None;
-        self.pending.clear();
-        self.skip_laces = None;
-        self.done = false;
-    }
-
-    /// Read sample `index` of `track` (requires an index).
-    pub fn read_sample(&self, track: usize, index: usize) -> Result<Vec<u8>> {
-        self.file.read_sample(&self.src, track, index)
-    }
-
-    /// Position the packet stream at the keyframe of `track` with the greatest pts ≤ `time_ns`
-    /// (or the track's first keyframe if none precedes it). The next [`Demuxer::next_packet`]
-    /// call returns packets starting at that keyframe's block (all tracks).
-    ///
-    /// Uses the sample index when present, else Cues (refined by scanning the cued cluster), else
-    /// builds the index first.
-    pub fn seek(&mut self, track: usize, time_ns: i64) -> Result<SeekPoint> {
-        let t = self.file.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        let ticks = t.ns_to_ticks(time_ns);
-        if !self.file.indexed {
-            let tn = t.number;
-            let cue = self
-                .file
-                .cues
-                .iter()
-                .filter(|c| c.time as i64 <= ticks)
-                .filter_map(|c| c.positions.iter().find(|p| p.track == tn).map(|p| (c.time, *p)))
-                .next_back()
-                .or_else(|| self.file.cues.iter().find_map(|c| c.positions.iter().find(|p| p.track == tn).map(|p| (c.time, *p))));
-            if let Some((_, cp)) = cue
-                && let Some(sp) = self.seek_via_cue(track, ticks, cp.cluster_position)?
-            {
-                return Ok(sp);
-            }
-            self.build_index()?;
-        }
-        let t = &self.file.tracks[track];
-        let k = t.keyframe_before_pts(ticks).ok_or_else(|| Error::Invalid(format!("track {} has no keyframes", t.number)))?;
-        let s = t.samples[k];
-        let c = self.file.clusters[s.cluster as usize];
-        let sp = SeekPoint { track, pts: s.pts, pts_ns: t.ticks_to_ns(s.pts), sample: Some(k), cluster_offset: c.offset, block_offset: s.block_offset };
-        self.position_at(c, s.block_offset, s.lace);
-        Ok(sp)
-    }
-
-    fn position_at(&mut self, c: ClusterInfo, block_offset: u64, lace: u16) {
-        self.pending.clear();
-        self.done = false;
-        self.pos = block_offset;
-        let known = c.end;
-        self.cluster = Some(InCluster { ts: c.timestamp as i64, end: Some(known) });
-        self.skip_laces = (lace > 0).then_some((block_offset, lace));
-    }
-
-    fn seek_via_cue(&mut self, track: usize, ticks: i64, cluster_position: u64) -> Result<Option<SeekPoint>> {
-        let abs = self.file.segment_data_start + cluster_position;
-        let mut io = Io::new(&self.src, &mut self.cache);
-        let Some(h) = io.header(abs, self.file.segment_end)? else { return Ok(None) };
-        if h.id != CLUSTER {
-            self.file.warnings.push(format!("cue points at {abs}, which is not a Cluster"));
-            return Ok(None);
-        }
-        let mut warnings = Vec::new();
-        let (ci, blocks) = scan_cluster(&mut io, &h, self.file.segment_end, &self.file.tracks, &mut warnings)?;
-        let t = &self.file.tracks[track];
-        let mut frames = Vec::new();
-        for b in blocks.iter().filter(|b| b.track == track && b.keyframe) {
-            expand(b, t, self.file.info.timestamp_scale, 0, &mut frames);
-        }
-        let best = frames.iter().filter(|f| f.pts <= ticks).max_by_key(|f| f.pts).or_else(|| frames.iter().min_by_key(|f| f.pts)).copied();
-        let Some(f) = best else { return Ok(None) };
-        let sp = SeekPoint { track, pts: f.pts, pts_ns: f.pts_ns, sample: None, cluster_offset: ci.offset, block_offset: f.block_offset };
-        self.position_at(ci, f.block_offset, f.lace);
-        Ok(Some(sp))
-    }
-
-    /// Next frame in file order, or `None` at the end of the Segment.
-    pub fn next_packet(&mut self) -> Result<Option<Packet>> {
-        loop {
-            if let Some(f) = self.pending.pop_front() {
-                return self.materialize(f).map(Some);
-            }
-            if self.done || !self.fill()? {
-                self.done = true;
-                return Ok(None);
-            }
-        }
-    }
-
-    fn materialize(&mut self, f: FrameRef) -> Result<Packet> {
-        let t = &self.file.tracks[f.track];
-        let mut data = if t.frames_readable() { t.frame_prefix(f.size as u64) } else { Vec::new() };
-        let at = data.len();
-        data.resize(at + f.size as usize, 0);
-        let mut io = Io::new(&self.src, &mut self.cache);
-        if (f.size as usize) <= WIN / 2 {
-            let b = io.peek(f.offset, f.size as usize)?;
-            if b.len() != f.size as usize {
-                return Err(Error::Invalid("frame data past end of file".into()));
-            }
-            data[at..].copy_from_slice(b);
-        } else {
-            self.src.read_at(f.offset, &mut data[at..])?;
-        }
-        Ok(Packet {
-            track: f.track,
-            track_number: t.number,
-            pts: f.pts,
-            pts_ns: f.pts_ns,
-            duration: f.duration,
-            duration_ns: f.duration_ns,
-            keyframe: f.keyframe,
-            discardable: f.discardable,
-            invisible: f.invisible,
-            discard_padding_ns: f.discard_padding,
-            offset: f.offset,
-            lace: f.lace,
-            data,
-        })
-    }
-
-    /// Advance over elements until at least one frame is pending. Returns false at the end.
-    fn fill(&mut self) -> Result<bool> {
-        let seg_end = self.file.segment_end;
-        let scale = self.file.info.timestamp_scale;
-        let mut io = Io::new(&self.src, &mut self.cache);
-        let lookup = track_lookup(&self.file.tracks);
-        loop {
-            if let Some(c) = self.cluster {
-                let lim = c.end.unwrap_or(seg_end);
-                if self.pos >= lim {
-                    self.cluster = None;
-                    continue;
-                }
-                let Some(h) = io.header(self.pos, lim)? else {
-                    self.cluster = None;
-                    match io.resync(self.pos + 1, seg_end)? {
-                        Some(p) => {
-                            self.pos = p;
-                            continue;
-                        }
-                        None => return Ok(false),
-                    }
-                };
-                if c.end.is_none() && is_top_level(h.id) {
-                    self.cluster = None;
-                    continue;
-                }
-                if h.size == Size::Unknown || h.overruns(lim) {
-                    self.cluster = None;
-                    match io.resync(self.pos + 1, seg_end)? {
-                        Some(p) => {
-                            self.pos = p;
-                            continue;
-                        }
-                        None => return Ok(false),
-                    }
-                }
-                let he = h.end(lim);
-                self.pos = he;
-                match h.id {
-                    TIMESTAMP => {
-                        let v = ebml::uint(io.peek(h.data_start(), (he - h.data_start()) as usize)?) as i64;
-                        self.cluster = Some(InCluster { ts: v, end: c.end });
-                    }
-                    SIMPLE_BLOCK | BLOCK_GROUP => {
-                        if let Some(b) = parse_block_elem(&mut io, &h, he, c.ts, &lookup)? {
-                            let skip = match self.skip_laces.take() {
-                                Some((off, n)) if off == h.pos => n,
-                                _ => 0,
-                            };
-                            expand(&b, &self.file.tracks[b.track], scale, skip, &mut self.pending);
-                            if !self.pending.is_empty() {
-                                return Ok(true);
-                            }
-                        }
-                    }
-                    _ => {}
-                }
-                continue;
-            }
-            if self.pos >= seg_end {
-                return Ok(false);
-            }
-            let Some(h) = io.header(self.pos, seg_end)? else {
-                match io.resync(self.pos + 1, seg_end)? {
-                    Some(p) => {
-                        self.pos = p;
-                        continue;
-                    }
-                    None => return Ok(false),
-                }
-            };
-            match h.id {
-                CLUSTER => {
-                    self.cluster = Some(InCluster { ts: 0, end: h.size.known().map(|_| h.end(seg_end)) });
-                    self.pos = h.data_start();
-                }
-                EBML | SEGMENT => return Ok(false),
-                _ => {
-                    self.pos = if h.size == Size::Unknown { io.unknown_end(h.data_start(), seg_end)? } else { h.end(seg_end) };
-                    if self.pos <= h.pos {
-                        return Ok(false);
-                    }
-                }
-            }
-        }
-    }
-}
-
-impl<S: ByteSource> Iterator for Demuxer<S> {
-    type Item = Result<Packet>;
-    fn next(&mut self) -> Option<Result<Packet>> {
-        match self.next_packet() {
-            Ok(Some(p)) => Some(Ok(p)),
-            Ok(None) => None,
-            Err(e) => {
-                self.done = true;
-                Some(Err(e))
-            }
-        }
-    }
-}
diff --git a/crates/matroska/src/ebml.rs b/crates/matroska/src/ebml.rs
deleted file mode 100644
index 6c2db76de..000000000
--- a/crates/matroska/src/ebml.rs
+++ /dev/null
@@ -1,476 +0,0 @@
-//! EBML primitives (RFC 8794): variable-length integers, element headers, typed values, CRC-32,
-//! and Matroska block lacing (RFC 9559 §10.3).
-
-use crate::error::{Result, invalid};
-
-/// Length in bytes of a VINT whose first byte is `b` (1..=8), or `None` for a zero first byte.
-#[inline]
-pub fn vint_len(b: u8) -> Option<usize> {
-    if b == 0 { None } else { Some(b.leading_zeros() as usize + 1) }
-}
-
-/// Element data size: known, or "unknown" (all value bits set).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Size {
-    Known(u64),
-    Unknown,
-}
-
-impl Size {
-    pub fn known(self) -> Option<u64> {
-        match self {
-            Size::Known(n) => Some(n),
-            Size::Unknown => None,
-        }
-    }
-}
-
-/// Decode an unsigned VINT (marker bit stripped). Returns `(value, length, all_ones)`.
-pub fn read_vint(data: &[u8]) -> Option<(u64, usize, bool)> {
-    let first = *data.first()?;
-    let len = vint_len(first)?;
-    if data.len() < len {
-        return None;
-    }
-    let mask = if len == 8 { 0 } else { 0xFFu8 >> len };
-    let mut v = (first & mask) as u64;
-    for &b in &data[1..len] {
-        v = (v << 8) | b as u64;
-    }
-    let all_ones = v == (1u64 << (7 * len)) - 1;
-    Some((v, len, all_ones))
-}
-
-/// Decode an element data size. All-ones is the reserved "unknown size".
-pub fn read_size(data: &[u8]) -> Option<(Size, usize)> {
-    let (v, len, ones) = read_vint(data)?;
-    Some((if ones { Size::Unknown } else { Size::Known(v) }, len))
-}
-
-/// Decode an element ID (marker bits kept, 1..=4 bytes). Rejects all-ones value bits (reserved).
-/// All-zero value bits are accepted, because Matroska's `ChapterDisplay` uses ID `0x80`.
-pub fn read_id(data: &[u8]) -> Option<(u32, usize)> {
-    let first = *data.first()?;
-    let len = vint_len(first)?;
-    if len > 4 || data.len() < len {
-        return None;
-    }
-    let (v, _, ones) = read_vint(&data[..len])?;
-    if ones || (v == 0 && len > 1) {
-        return None;
-    }
-    let mut id = 0u32;
-    for &b in &data[..len] {
-        id = (id << 8) | b as u32;
-    }
-    Some((id, len))
-}
-
-/// Decode a signed VINT as used by EBML lacing (value − (2^(7·len−1) − 1)).
-pub fn read_svint(data: &[u8]) -> Option<(i64, usize)> {
-    let (v, len, _) = read_vint(data)?;
-    let bias = (1i64 << (7 * len - 1)) - 1;
-    Some((v as i64 - bias, len))
-}
-
-/// Encode an element ID (already carrying its marker bits).
-pub fn write_id(out: &mut Vec<u8>, id: u32) {
-    let n = if id >= 0x100_0000 {
-        4
-    } else if id >= 0x1_0000 {
-        3
-    } else if id >= 0x100 {
-        2
-    } else {
-        1
-    };
-    out.extend_from_slice(&id.to_be_bytes()[4 - n..]);
-}
-
-/// Encode a data size as a VINT using the shortest length (or `min_len` if larger).
-pub fn write_size(out: &mut Vec<u8>, size: u64, min_len: usize) {
-    let mut len = 1;
-    while len < 8 && size >= (1u64 << (7 * len)) - 1 {
-        len += 1;
-    }
-    let len = len.max(min_len).min(8);
-    let v = size | (1u64 << (7 * len));
-    out.extend_from_slice(&v.to_be_bytes()[8 - len..]);
-}
-
-/// Encode the "unknown size" marker of the given length.
-pub fn write_unknown_size(out: &mut Vec<u8>, len: usize) {
-    out.push(0xFFu8 >> (len - 1));
-    out.extend(std::iter::repeat_n(0xFF, len - 1));
-}
-
-/// Big-endian unsigned integer of 0..=8 bytes.
-pub fn uint(data: &[u8]) -> u64 {
-    data.iter().take(8).fold(0u64, |a, &b| (a << 8) | b as u64)
-}
-
-/// Big-endian two's-complement signed integer of 0..=8 bytes.
-pub fn int(data: &[u8]) -> i64 {
-    let n = data.len().min(8);
-    if n == 0 {
-        return 0;
-    }
-    let v = uint(&data[..n]);
-    let shift = 64 - 8 * n as u32;
-    ((v << shift) as i64) >> shift
-}
-
-/// IEEE float of 0, 4 or 8 bytes.
-pub fn float(data: &[u8]) -> f64 {
-    match data.len() {
-        4 => f32::from_be_bytes(data.try_into().unwrap_or([0; 4])) as f64,
-        8 => f64::from_be_bytes(data.try_into().unwrap_or([0; 8])),
-        _ => 0.0,
-    }
-}
-
-/// String / UTF-8 value: bytes up to the first NUL, lossily decoded.
-pub fn string(data: &[u8]) -> String {
-    let end = data.iter().position(|&b| b == 0).unwrap_or(data.len());
-    String::from_utf8_lossy(&data[..end]).into_owned()
-}
-
-/// One element inside an in-memory master element.
-#[derive(Clone, Copy, Debug)]
-pub struct Elem<'a> {
-    pub id: u32,
-    /// Offset of the element header, relative to the start of the parent's data.
-    pub offset: usize,
-    pub header_len: usize,
-    pub data: &'a [u8],
-    /// The size field was "unknown" (data runs to the end of the parent).
-    pub unknown_size: bool,
-    /// The declared size overran the parent and was truncated.
-    pub truncated: bool,
-}
-
-/// Iterator over the children of an in-memory master element.
-///
-/// Damaged data ends the iteration (see [`Children::damaged`]); oversize elements are truncated to
-/// the parent's end.
-pub struct Children<'a> {
-    data: &'a [u8],
-    pos: usize,
-    damaged: bool,
-}
-
-impl<'a> Children<'a> {
-    pub fn new(data: &'a [u8]) -> Self {
-        Self { data, pos: 0, damaged: false }
-    }
-    /// True if iteration stopped on an undecodable header.
-    pub fn damaged(&self) -> bool {
-        self.damaged
-    }
-}
-
-impl<'a> Iterator for Children<'a> {
-    type Item = Elem<'a>;
-    fn next(&mut self) -> Option<Elem<'a>> {
-        let rest = self.data.get(self.pos..)?;
-        if rest.is_empty() {
-            return None;
-        }
-        let Some((id, il)) = read_id(rest) else {
-            self.damaged = true;
-            self.pos = self.data.len();
-            return None;
-        };
-        let Some((size, sl)) = read_size(&rest[il..]) else {
-            self.damaged = true;
-            self.pos = self.data.len();
-            return None;
-        };
-        let hl = il + sl;
-        let avail = (rest.len() - hl) as u64;
-        let (len, unknown, truncated) = match size {
-            Size::Known(n) if n <= avail => (n as usize, false, false),
-            Size::Known(_) => (avail as usize, false, true),
-            Size::Unknown => (avail as usize, true, false),
-        };
-        let e = Elem { id, offset: self.pos, header_len: hl, data: &rest[hl..hl + len], unknown_size: unknown, truncated };
-        self.pos += hl + len;
-        Some(e)
-    }
-}
-
-/// CRC-32 (ISO 3309 / IEEE 802.3, reflected polynomial 0xEDB88320), as used by EBML CRC-32 elements.
-pub fn crc32(data: &[u8]) -> u32 {
-    crc32_update(0xFFFF_FFFF, data) ^ 0xFFFF_FFFF
-}
-
-/// Incremental form: start with `0xFFFF_FFFF`, finish with `^ 0xFFFF_FFFF`.
-pub fn crc32_update(mut crc: u32, data: &[u8]) -> u32 {
-    static TABLE: std::sync::OnceLock<[u32; 256]> = std::sync::OnceLock::new();
-    let t = TABLE.get_or_init(|| {
-        let mut t = [0u32; 256];
-        for (i, e) in t.iter_mut().enumerate() {
-            let mut c = i as u32;
-            for _ in 0..8 {
-                c = if c & 1 != 0 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
-            }
-            *e = c;
-        }
-        t
-    });
-    for &b in data {
-        crc = t[((crc ^ b as u32) & 0xFF) as usize] ^ (crc >> 8);
-    }
-    crc
-}
-
-/// Check a master element's leading CRC-32 child, if present. `Some(true/false)` if there is one.
-pub fn verify_crc(master_data: &[u8]) -> Option<bool> {
-    let mut it = Children::new(master_data);
-    let first = it.next()?;
-    if first.id != crate::ids::CRC32 || first.data.len() != 4 {
-        return None;
-    }
-    let stored = u32::from_le_bytes(first.data.try_into().ok()?);
-    let rest = &master_data[first.offset + first.header_len + 4..];
-    Some(crc32(rest) == stored)
-}
-
-/// Block lacing mode (flags bits 1–2).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Lacing {
-    None,
-    Xiph,
-    FixedSize,
-    Ebml,
-}
-
-impl Lacing {
-    pub fn from_flags(flags: u8) -> Lacing {
-        match (flags >> 1) & 3 {
-            0 => Lacing::None,
-            1 => Lacing::Xiph,
-            2 => Lacing::FixedSize,
-            _ => Lacing::Ebml,
-        }
-    }
-}
-
-/// Split laced block payload. `data` starts right after the block's flags byte and runs to the end
-/// of the block. Returns `(offset, len)` of each frame relative to `data`.
-pub fn parse_lacing(lacing: Lacing, data: &[u8]) -> Result<Vec<(usize, usize)>> {
-    if lacing == Lacing::None {
-        return Ok(vec![(0, data.len())]);
-    }
-    let Some(&n1) = data.first() else { return invalid("laced block without frame count") };
-    let count = n1 as usize + 1;
-    let mut pos = 1usize;
-    let mut sizes = Vec::with_capacity(count);
-    match lacing {
-        Lacing::None => return Ok(vec![(0, data.len())]),
-        Lacing::Xiph => {
-            for _ in 0..count - 1 {
-                let mut s = 0usize;
-                loop {
-                    let Some(&b) = data.get(pos) else { return invalid("truncated Xiph lace header") };
-                    pos += 1;
-                    s += b as usize;
-                    if b != 255 {
-                        break;
-                    }
-                }
-                sizes.push(s);
-            }
-        }
-        Lacing::Ebml => {
-            if count > 1 {
-                let Some((first, l, _)) = read_vint(&data[pos..]) else { return invalid("bad EBML lace size") };
-                pos += l;
-                let mut prev = first as i64;
-                sizes.push(first as usize);
-                for _ in 1..count - 1 {
-                    let Some((d, l)) = read_svint(&data[pos..]) else { return invalid("bad EBML lace delta") };
-                    pos += l;
-                    prev += d;
-                    if prev < 0 {
-                        return invalid("negative EBML lace size");
-                    }
-                    sizes.push(prev as usize);
-                }
-            }
-        }
-        Lacing::FixedSize => {
-            let rest = data.len() - pos;
-            if !rest.is_multiple_of(count) {
-                return invalid("fixed-size lacing does not divide block");
-            }
-            sizes.extend(std::iter::repeat_n(rest / count, count - 1));
-        }
-    }
-    let used: usize = sizes.iter().try_fold(0usize, |a, &s| a.checked_add(s)).unwrap_or(usize::MAX);
-    if pos > data.len() || used > data.len() - pos {
-        return invalid("lace sizes exceed block");
-    }
-    sizes.push(data.len() - pos - used);
-    let mut out = Vec::with_capacity(count);
-    for s in sizes {
-        out.push((pos, s));
-        pos += s;
-    }
-    Ok(out)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn vint_roundtrip() {
-        for &v in &[0u64, 1, 126, 127, 128, 16382, 16383, 16384, 1 << 20, (1 << 56) - 2] {
-            let mut b = Vec::new();
-            write_size(&mut b, v, 1);
-            let (s, l) = read_size(&b).unwrap();
-            assert_eq!(s, Size::Known(v), "value {v}");
-            assert_eq!(l, b.len());
-        }
-        // 127 needs 2 bytes because 0xFF is "unknown"
-        let mut b = Vec::new();
-        write_size(&mut b, 127, 1);
-        assert_eq!(b, [0x40, 0x7F]);
-        // padded length
-        let mut b = Vec::new();
-        write_size(&mut b, 5, 8);
-        assert_eq!(b, [1, 0, 0, 0, 0, 0, 0, 5]);
-        assert_eq!(read_size(&b).unwrap(), (Size::Known(5), 8));
-    }
-
-    #[test]
-    fn vint_unknown_and_invalid() {
-        assert_eq!(read_size(&[0xFF]).unwrap(), (Size::Unknown, 1));
-        assert_eq!(read_size(&[0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]).unwrap(), (Size::Unknown, 8));
-        for l in 1..=8 {
-            let mut b = Vec::new();
-            write_unknown_size(&mut b, l);
-            assert_eq!(read_size(&b).unwrap(), (Size::Unknown, l));
-        }
-        assert!(read_size(&[0x00, 1, 2]).is_none());
-        assert!(read_size(&[0x40]).is_none()); // truncated
-        assert_eq!(read_vint(&[0x81]).unwrap(), (1, 1, false));
-        assert_eq!(read_vint(&[0x10, 0x00, 0x00, 0x01]).unwrap(), (1, 4, false));
-    }
-
-    #[test]
-    fn ids() {
-        assert_eq!(read_id(&[0x1A, 0x45, 0xDF, 0xA3, 0x99]).unwrap(), (crate::ids::EBML, 4));
-        assert_eq!(read_id(&[0xA3]).unwrap(), (0xA3, 1));
-        assert_eq!(read_id(&[0x42, 0x86]).unwrap(), (0x4286, 2));
-        assert!(read_id(&[0xFF]).is_none()); // reserved
-        assert_eq!(read_id(&[0x80]).unwrap(), (0x80, 1)); // ChapterDisplay
-        assert!(read_id(&[0x40, 0x00]).is_none()); // zero value
-        assert!(read_id(&[0x08, 0, 0, 0, 1]).is_none()); // 5-byte ID
-        for id in [0xA3u32, 0x4286, 0x2AD7B1, 0x1F43B675] {
-            let mut b = Vec::new();
-            write_id(&mut b, id);
-            assert_eq!(read_id(&b).unwrap(), (id, b.len()));
-        }
-    }
-
-    #[test]
-    fn signed_vint() {
-        assert_eq!(read_svint(&[0xBF]).unwrap(), (0, 1)); // 63 - 63
-        assert_eq!(read_svint(&[0x80]).unwrap(), (-63, 1));
-        assert_eq!(read_svint(&[0xC0]).unwrap(), (1, 1));
-        assert_eq!(read_svint(&[0x5F, 0xFF]).unwrap(), (0, 2));
-        assert_eq!(read_svint(&[0x60, 0x00]).unwrap(), (1, 2));
-    }
-
-    #[test]
-    fn values() {
-        assert_eq!(uint(&[]), 0);
-        assert_eq!(uint(&[1, 0]), 256);
-        assert_eq!(int(&[0xFF]), -1);
-        assert_eq!(int(&[0xFF, 0xFE]), -2);
-        assert_eq!(int(&[0x7F]), 127);
-        assert_eq!(float(&1.5f32.to_be_bytes()), 1.5);
-        assert_eq!(float(&2.25f64.to_be_bytes()), 2.25);
-        assert_eq!(string(b"abc\0\0"), "abc");
-    }
-
-    #[test]
-    fn crc() {
-        assert_eq!(crc32(b"123456789"), 0xCBF4_3926);
-        let payload = [0x42u8, 0x86, 0x81, 0x01];
-        let mut m = vec![0xBF, 0x84];
-        m.extend_from_slice(&crc32(&payload).to_le_bytes());
-        m.extend_from_slice(&payload);
-        assert_eq!(verify_crc(&m), Some(true));
-        m[7] ^= 1;
-        assert_eq!(verify_crc(&m), Some(false));
-        assert_eq!(verify_crc(&payload), None);
-    }
-
-    #[test]
-    fn children_iter() {
-        // two elements, then one whose size overruns
-        let d = [0x42, 0x86, 0x81, 0x01, 0xEC, 0x82, 0, 0, 0xA3, 0x85, 1, 2];
-        let v: Vec<_> = Children::new(&d).collect();
-        assert_eq!(v.len(), 3);
-        assert_eq!(v[0].id, 0x4286);
-        assert_eq!(v[0].data, &[1]);
-        assert_eq!(v[1].id, 0xEC);
-        assert_eq!(v[2].data, &[1, 2]);
-        assert!(v[2].truncated);
-        let mut it = Children::new(&[0x00, 0x01]);
-        assert!(it.next().is_none());
-        assert!(it.damaged());
-    }
-
-    fn frames<'a>(d: &'a [u8], f: &[(usize, usize)]) -> Vec<&'a [u8]> {
-        f.iter().map(|&(o, l)| &d[o..o + l]).collect()
-    }
-
-    #[test]
-    fn lacing_xiph() {
-        // 3 frames: 300, 2, rest(3)
-        let mut d = vec![2u8, 255, 45, 2];
-        d.extend(std::iter::repeat_n(7u8, 300));
-        d.extend_from_slice(&[1, 2]);
-        d.extend_from_slice(&[3, 4, 5]);
-        let f = parse_lacing(Lacing::Xiph, &d).unwrap();
-        assert_eq!(f.iter().map(|x| x.1).collect::<Vec<_>>(), [300, 2, 3]);
-        assert_eq!(frames(&d, &f)[2], &[3, 4, 5]);
-        // exact multiple of 255 needs a terminating 0
-        let mut d = vec![1u8, 255, 0];
-        d.extend(std::iter::repeat_n(1u8, 255));
-        d.push(9);
-        let f = parse_lacing(Lacing::Xiph, &d).unwrap();
-        assert_eq!(f.iter().map(|x| x.1).collect::<Vec<_>>(), [255, 1]);
-        assert!(parse_lacing(Lacing::Xiph, &[1, 200, 1]).is_err());
-    }
-
-    #[test]
-    fn lacing_ebml() {
-        // 4 frames: 5, 3 (delta -2), 4 (delta +1), rest 2
-        let mut d = vec![3u8, 0x85, 0xBF - 2, 0xBF + 1];
-        d.extend_from_slice(&[1; 5]);
-        d.extend_from_slice(&[2; 3]);
-        d.extend_from_slice(&[3; 4]);
-        d.extend_from_slice(&[4; 2]);
-        let f = parse_lacing(Lacing::Ebml, &d).unwrap();
-        assert_eq!(f.iter().map(|x| x.1).collect::<Vec<_>>(), [5, 3, 4, 2]);
-        assert_eq!(frames(&d, &f), [&[1u8; 5][..], &[2; 3], &[3; 4], &[4; 2]]);
-        assert!(parse_lacing(Lacing::Ebml, &[1, 0x90]).is_err());
-    }
-
-    #[test]
-    fn lacing_fixed_and_none() {
-        let d = [2u8, 1, 1, 2, 2, 3, 3];
-        let f = parse_lacing(Lacing::FixedSize, &d).unwrap();
-        assert_eq!(frames(&d, &f), [&[1u8, 1][..], &[2, 2], &[3, 3]]);
-        assert!(parse_lacing(Lacing::FixedSize, &[2, 1, 1]).is_err());
-        assert_eq!(parse_lacing(Lacing::None, &[9, 9]).unwrap(), [(0, 2)]);
-        assert_eq!(Lacing::from_flags(0x80 | 0x06), Lacing::Ebml);
-        assert_eq!(Lacing::from_flags(0x02), Lacing::Xiph);
-        assert_eq!(Lacing::from_flags(0x04), Lacing::FixedSize);
-    }
-}
diff --git a/crates/matroska/src/error.rs b/crates/matroska/src/error.rs
deleted file mode 100644
index 718c5c505..000000000
--- a/crates/matroska/src/error.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-use std::fmt;
-use std::io;
-
-/// Errors produced by the demuxer.
-#[derive(Debug)]
-pub enum Error {
-    /// Underlying I/O failure.
-    Io(io::Error),
-    /// Structurally invalid data that could not be recovered from.
-    Invalid(String),
-    /// Valid but unsupported feature (e.g. zlib-compressed or encrypted tracks when reading data).
-    Unsupported(String),
-    /// Not an EBML file, or an EBML file whose DocType is not `matroska`/`webm`.
-    NotMatroska(String),
-    /// A track index was out of range.
-    NoSuchTrack(usize),
-    /// A sample index was out of range.
-    NoSuchSample(usize),
-}
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Error::Io(e) => write!(f, "I/O error: {e}"),
-            Error::Invalid(s) => write!(f, "invalid data: {s}"),
-            Error::Unsupported(s) => write!(f, "unsupported: {s}"),
-            Error::NotMatroska(s) => write!(f, "not a Matroska/WebM file: {s}"),
-            Error::NoSuchTrack(i) => write!(f, "track index {i} out of range"),
-            Error::NoSuchSample(i) => write!(f, "sample index {i} out of range"),
-        }
-    }
-}
-
-impl std::error::Error for Error {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Error::Io(e) => Some(e),
-            _ => None,
-        }
-    }
-}
-
-impl From<io::Error> for Error {
-    fn from(e: io::Error) -> Self {
-        Error::Io(e)
-    }
-}
-
-pub type Result<T> = std::result::Result<T, Error>;
-
-pub(crate) fn invalid<T>(msg: impl Into<String>) -> Result<T> {
-    Err(Error::Invalid(msg.into()))
-}
diff --git a/crates/matroska/src/ids.rs b/crates/matroska/src/ids.rs
deleted file mode 100644
index 3b7e025c4..000000000
--- a/crates/matroska/src/ids.rs
+++ /dev/null
@@ -1,214 +0,0 @@
-//! EBML / Matroska element IDs (RFC 8794, RFC 9559). IDs keep their VINT marker bits.
-#![allow(dead_code)]
-
-// EBML header + global elements
-pub const EBML: u32 = 0x1A45_DFA3;
-pub const EBML_VERSION: u32 = 0x4286;
-pub const EBML_READ_VERSION: u32 = 0x42F7;
-pub const EBML_MAX_ID_LENGTH: u32 = 0x42F2;
-pub const EBML_MAX_SIZE_LENGTH: u32 = 0x42F3;
-pub const DOC_TYPE: u32 = 0x4282;
-pub const DOC_TYPE_VERSION: u32 = 0x4287;
-pub const DOC_TYPE_READ_VERSION: u32 = 0x4285;
-pub const CRC32: u32 = 0xBF;
-pub const VOID: u32 = 0xEC;
-
-// Segment and level-1 elements
-pub const SEGMENT: u32 = 0x1853_8067;
-pub const SEEK_HEAD: u32 = 0x114D_9B74;
-pub const INFO: u32 = 0x1549_A966;
-pub const TRACKS: u32 = 0x1654_AE6B;
-pub const CLUSTER: u32 = 0x1F43_B675;
-pub const CUES: u32 = 0x1C53_BB6B;
-pub const ATTACHMENTS: u32 = 0x1941_A469;
-pub const CHAPTERS: u32 = 0x1043_A770;
-pub const TAGS: u32 = 0x1254_C367;
-
-/// True for IDs that can only appear directly inside a Segment (or are the EBML/Segment headers):
-/// used to find the end of unknown-size elements.
-pub fn is_top_level(id: u32) -> bool {
-    matches!(id, EBML | SEGMENT | SEEK_HEAD | INFO | TRACKS | CLUSTER | CUES | ATTACHMENTS | CHAPTERS | TAGS)
-}
-
-// SeekHead
-pub const SEEK: u32 = 0x4DBB;
-pub const SEEK_ID: u32 = 0x53AB;
-pub const SEEK_POSITION: u32 = 0x53AC;
-
-// Info
-pub const SEGMENT_UUID: u32 = 0x73A4;
-pub const SEGMENT_FILENAME: u32 = 0x7384;
-pub const TIMESTAMP_SCALE: u32 = 0x2A_D7B1;
-pub const DURATION: u32 = 0x4489;
-pub const DATE_UTC: u32 = 0x4461;
-pub const TITLE: u32 = 0x7BA9;
-pub const MUXING_APP: u32 = 0x4D80;
-pub const WRITING_APP: u32 = 0x5741;
-
-// Cluster
-pub const TIMESTAMP: u32 = 0xE7;
-pub const POSITION: u32 = 0xA7;
-pub const PREV_SIZE: u32 = 0xAB;
-pub const SIMPLE_BLOCK: u32 = 0xA3;
-pub const BLOCK_GROUP: u32 = 0xA0;
-pub const ENCRYPTED_BLOCK: u32 = 0xAF;
-pub const SILENT_TRACKS: u32 = 0x5854;
-pub const BLOCK: u32 = 0xA1;
-pub const BLOCK_ADDITIONS: u32 = 0x75A1;
-pub const BLOCK_MORE: u32 = 0xA6;
-pub const BLOCK_ADD_ID: u32 = 0xEE;
-pub const BLOCK_ADDITIONAL: u32 = 0xA5;
-pub const BLOCK_DURATION: u32 = 0x9B;
-pub const REFERENCE_PRIORITY: u32 = 0xFA;
-pub const REFERENCE_BLOCK: u32 = 0xFB;
-pub const CODEC_STATE: u32 = 0xA4;
-pub const DISCARD_PADDING: u32 = 0x75A2;
-
-pub fn is_cluster_child(id: u32) -> bool {
-    matches!(id, TIMESTAMP | POSITION | PREV_SIZE | SIMPLE_BLOCK | BLOCK_GROUP | ENCRYPTED_BLOCK | SILENT_TRACKS | CRC32 | VOID)
-}
-
-// Tracks
-pub const TRACK_ENTRY: u32 = 0xAE;
-pub const TRACK_NUMBER: u32 = 0xD7;
-pub const TRACK_UID: u32 = 0x73C5;
-pub const TRACK_TYPE: u32 = 0x83;
-pub const FLAG_ENABLED: u32 = 0xB9;
-pub const FLAG_DEFAULT: u32 = 0x88;
-pub const FLAG_FORCED: u32 = 0x55AA;
-pub const FLAG_HEARING_IMPAIRED: u32 = 0x55AB;
-pub const FLAG_VISUAL_IMPAIRED: u32 = 0x55AC;
-pub const FLAG_ORIGINAL: u32 = 0x55AE;
-pub const FLAG_COMMENTARY: u32 = 0x55AF;
-pub const FLAG_LACING: u32 = 0x9C;
-pub const DEFAULT_DURATION: u32 = 0x23_E383;
-pub const TRACK_TIMESTAMP_SCALE: u32 = 0x23_314F;
-pub const NAME: u32 = 0x536E;
-pub const LANGUAGE: u32 = 0x22_B59C;
-pub const LANGUAGE_BCP47: u32 = 0x22_B59D;
-pub const CODEC_ID: u32 = 0x86;
-pub const CODEC_PRIVATE: u32 = 0x63A2;
-pub const CODEC_NAME: u32 = 0x25_8688;
-pub const CODEC_DELAY: u32 = 0x56AA;
-pub const SEEK_PRE_ROLL: u32 = 0x56BB;
-
-// Video
-pub const VIDEO: u32 = 0xE0;
-pub const FLAG_INTERLACED: u32 = 0x9A;
-pub const FIELD_ORDER: u32 = 0x9D;
-pub const STEREO_MODE: u32 = 0x53B8;
-pub const ALPHA_MODE: u32 = 0x53C0;
-pub const PIXEL_WIDTH: u32 = 0xB0;
-pub const PIXEL_HEIGHT: u32 = 0xBA;
-pub const PIXEL_CROP_BOTTOM: u32 = 0x54AA;
-pub const PIXEL_CROP_TOP: u32 = 0x54BB;
-pub const PIXEL_CROP_LEFT: u32 = 0x54CC;
-pub const PIXEL_CROP_RIGHT: u32 = 0x54DD;
-pub const DISPLAY_WIDTH: u32 = 0x54B0;
-pub const DISPLAY_HEIGHT: u32 = 0x54BA;
-pub const DISPLAY_UNIT: u32 = 0x54B2;
-pub const COLOUR_SPACE: u32 = 0x2E_B524;
-pub const COLOUR: u32 = 0x55B0;
-pub const PROJECTION: u32 = 0x7670;
-pub const PROJECTION_TYPE: u32 = 0x7671;
-pub const PROJECTION_POSE_YAW: u32 = 0x7673;
-pub const PROJECTION_POSE_PITCH: u32 = 0x7674;
-pub const PROJECTION_POSE_ROLL: u32 = 0x7675;
-
-// Colour
-pub const MATRIX_COEFFICIENTS: u32 = 0x55B1;
-pub const BITS_PER_CHANNEL: u32 = 0x55B2;
-pub const CHROMA_SUBSAMPLING_HORZ: u32 = 0x55B3;
-pub const CHROMA_SUBSAMPLING_VERT: u32 = 0x55B4;
-pub const CB_SUBSAMPLING_HORZ: u32 = 0x55B5;
-pub const CB_SUBSAMPLING_VERT: u32 = 0x55B6;
-pub const CHROMA_SITING_HORZ: u32 = 0x55B7;
-pub const CHROMA_SITING_VERT: u32 = 0x55B8;
-pub const RANGE: u32 = 0x55B9;
-pub const TRANSFER_CHARACTERISTICS: u32 = 0x55BA;
-pub const PRIMARIES: u32 = 0x55BB;
-pub const MAX_CLL: u32 = 0x55BC;
-pub const MAX_FALL: u32 = 0x55BD;
-pub const MASTERING_METADATA: u32 = 0x55D0;
-pub const PRIMARY_R_X: u32 = 0x55D1;
-pub const PRIMARY_R_Y: u32 = 0x55D2;
-pub const PRIMARY_G_X: u32 = 0x55D3;
-pub const PRIMARY_G_Y: u32 = 0x55D4;
-pub const PRIMARY_B_X: u32 = 0x55D5;
-pub const PRIMARY_B_Y: u32 = 0x55D6;
-pub const WHITE_POINT_X: u32 = 0x55D7;
-pub const WHITE_POINT_Y: u32 = 0x55D8;
-pub const LUMINANCE_MAX: u32 = 0x55D9;
-pub const LUMINANCE_MIN: u32 = 0x55DA;
-
-// Audio
-pub const AUDIO: u32 = 0xE1;
-pub const SAMPLING_FREQUENCY: u32 = 0xB5;
-pub const OUTPUT_SAMPLING_FREQUENCY: u32 = 0x78B5;
-pub const CHANNELS: u32 = 0x9F;
-pub const BIT_DEPTH: u32 = 0x6264;
-
-// ContentEncodings
-pub const CONTENT_ENCODINGS: u32 = 0x6D80;
-pub const CONTENT_ENCODING: u32 = 0x6240;
-pub const CONTENT_ENCODING_ORDER: u32 = 0x5031;
-pub const CONTENT_ENCODING_SCOPE: u32 = 0x5032;
-pub const CONTENT_ENCODING_TYPE: u32 = 0x5033;
-pub const CONTENT_COMPRESSION: u32 = 0x5034;
-pub const CONTENT_COMP_ALGO: u32 = 0x4254;
-pub const CONTENT_COMP_SETTINGS: u32 = 0x4255;
-pub const CONTENT_ENCRYPTION: u32 = 0x5035;
-
-// Cues
-pub const CUE_POINT: u32 = 0xBB;
-pub const CUE_TIME: u32 = 0xB3;
-pub const CUE_TRACK_POSITIONS: u32 = 0xB7;
-pub const CUE_TRACK: u32 = 0xF7;
-pub const CUE_CLUSTER_POSITION: u32 = 0xF1;
-pub const CUE_RELATIVE_POSITION: u32 = 0xF0;
-pub const CUE_DURATION: u32 = 0xB2;
-pub const CUE_BLOCK_NUMBER: u32 = 0x5378;
-
-// Attachments
-pub const ATTACHED_FILE: u32 = 0x61A7;
-pub const FILE_DESCRIPTION: u32 = 0x467E;
-pub const FILE_NAME: u32 = 0x466E;
-pub const FILE_MEDIA_TYPE: u32 = 0x4660;
-pub const FILE_DATA: u32 = 0x465C;
-pub const FILE_UID: u32 = 0x46AE;
-
-// Chapters
-pub const EDITION_ENTRY: u32 = 0x45B9;
-pub const EDITION_UID: u32 = 0x45BC;
-pub const EDITION_FLAG_HIDDEN: u32 = 0x45BD;
-pub const EDITION_FLAG_DEFAULT: u32 = 0x45DB;
-pub const EDITION_FLAG_ORDERED: u32 = 0x45DD;
-pub const CHAPTER_ATOM: u32 = 0xB6;
-pub const CHAPTER_UID: u32 = 0x73C4;
-pub const CHAPTER_STRING_UID: u32 = 0x5654;
-pub const CHAPTER_TIME_START: u32 = 0x91;
-pub const CHAPTER_TIME_END: u32 = 0x92;
-pub const CHAPTER_FLAG_HIDDEN: u32 = 0x98;
-pub const CHAPTER_FLAG_ENABLED: u32 = 0x4598;
-pub const CHAPTER_DISPLAY: u32 = 0x80;
-pub const CHAP_STRING: u32 = 0x85;
-pub const CHAP_LANGUAGE: u32 = 0x437C;
-pub const CHAP_LANGUAGE_BCP47: u32 = 0x437D;
-pub const CHAP_COUNTRY: u32 = 0x437E;
-
-// Tags
-pub const TAG: u32 = 0x7373;
-pub const TARGETS: u32 = 0x63C0;
-pub const TARGET_TYPE_VALUE: u32 = 0x68CA;
-pub const TARGET_TYPE: u32 = 0x63CA;
-pub const TAG_TRACK_UID: u32 = 0x63C5;
-pub const TAG_EDITION_UID: u32 = 0x63C9;
-pub const TAG_CHAPTER_UID: u32 = 0x63C4;
-pub const TAG_ATTACHMENT_UID: u32 = 0x63C6;
-pub const SIMPLE_TAG: u32 = 0x67C8;
-pub const TAG_NAME: u32 = 0x45A3;
-pub const TAG_LANGUAGE: u32 = 0x447A;
-pub const TAG_LANGUAGE_BCP47: u32 = 0x447B;
-pub const TAG_DEFAULT: u32 = 0x4484;
-pub const TAG_STRING: u32 = 0x4487;
-pub const TAG_BINARY: u32 = 0x4485;
diff --git a/crates/matroska/src/lib.rs b/crates/matroska/src/lib.rs
index 5901e5e97..94428f619 100644
--- a/crates/matroska/src/lib.rs
+++ b/crates/matroska/src/lib.rs
@@ -1,38 +1,6 @@
-//! Clean-room Matroska (MKV) and WebM demuxer, written from RFC 8794 (EBML), RFC 9559 (Matroska)
-//! and the WebM container guidelines.
-//!
-//! - [`open`] / [`open_with`] parse the EBML header and the first Segment (Info, Tracks, SeekHead,
-//!   Cues, Chapters, Tags, Attachments) and, by default, scan every Cluster's block headers to build
-//!   per-track [`Sample`] tables — the same shape as `filmcraft-isobmff`, so callers can treat both
-//!   containers alike. Frame data is read on demand with [`MkvFile::read_sample`].
-//! - [`Demuxer`] iterates [`Packet`]s in file order (from any [`ByteSource`], `Read + Seek`, or a
-//!   byte slice) and seeks to the keyframe preceding a time, via the index, Cues, or a cluster scan.
-//!
-//! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
+//! Matroska (MKV) and WebM demuxer and muxer: a re-export of [`craft_media::matroska`] from
+//! craft-libs. Supported elements and limitations are in the craft-media README.
 
 #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
 
-mod codec;
-mod demux;
-pub mod ebml;
-mod error;
-mod ids;
-mod meta;
-mod mux;
-mod source;
-#[cfg(test)]
-mod synthetic_tests;
-mod track;
-
-pub use codec::Codec;
-pub use demux::{Demuxer, Keyframe, MkvFile, OpenOptions, Packet, SeekPoint, open, open_with};
-pub use error::{Error, Result};
-pub use meta::{Attachment, Chapter, ChapterDisplay, ClusterInfo, CuePoint, CuePosition, Edition, SeekEntry, SegmentInfo, SimpleTag, Tag, TagTargets};
-pub use mux::{LacingMode, MkvWriter, MuxOptions, TrackSpec};
-pub use source::{ByteSource, ReadSeekSource};
-pub use track::{AudioInfo, Colour, ContentEncoding, MasteringMetadata, Projection, Sample, Track, TrackKind, VideoInfo};
-
-/// Element IDs used by the demuxer (marker bits included), for callers inspecting raw elements.
-pub mod element_ids {
-    pub use crate::ids::*;
-}
+pub use craft_media::matroska::*;
diff --git a/crates/matroska/src/meta.rs b/crates/matroska/src/meta.rs
deleted file mode 100644
index 7406be14f..000000000
--- a/crates/matroska/src/meta.rs
+++ /dev/null
@@ -1,572 +0,0 @@
-//! Segment-level metadata: Info, SeekHead, Cues, Chapters, Tags, Attachments — types and parsers
-//! for their in-memory element data.
-
-use crate::codec::map_codec;
-use crate::ebml::{Children, float, int, string, uint};
-use crate::ids::*;
-use crate::track::{AudioInfo, Colour, ContentEncoding, MasteringMetadata, Projection, Track, TrackKind, VideoInfo, gcd};
-
-// A malformed Matroska file may contain arbitrarily deep ChapterAtom and SimpleTag chains.
-const MAX_META_DEPTH: usize = 64;
-
-/// `Info` element.
-#[derive(Clone, Debug, PartialEq)]
-pub struct SegmentInfo {
-    /// Nanoseconds per timestamp tick (default 1 000 000 = 1 ms).
-    pub timestamp_scale: u64,
-    /// `Duration` in timestamp ticks (float), if present.
-    pub duration: Option<f64>,
-    pub title: Option<String>,
-    pub muxing_app: String,
-    pub writing_app: String,
-    /// `DateUTC`: nanoseconds since 2001-01-01T00:00:00 UTC.
-    pub date_utc: Option<i64>,
-    pub segment_uuid: Option<[u8; 16]>,
-}
-
-impl Default for SegmentInfo {
-    fn default() -> Self {
-        Self {
-            timestamp_scale: 1_000_000,
-            duration: None,
-            title: None,
-            muxing_app: String::new(),
-            writing_app: String::new(),
-            date_utc: None,
-            segment_uuid: None,
-        }
-    }
-}
-
-/// One `SeekHead` entry: level-1 element ID and its position relative to the Segment data start.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct SeekEntry {
-    pub id: u32,
-    pub position: u64,
-}
-
-/// One `CueTrackPositions` of a `CuePoint`.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct CuePosition {
-    pub track: u64,
-    /// Cluster position relative to the Segment data start.
-    pub cluster_position: u64,
-    /// Block position relative to the Cluster data start.
-    pub relative_position: Option<u64>,
-    pub block_number: Option<u64>,
-    pub duration: Option<u64>,
-}
-
-/// One `CuePoint`.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CuePoint {
-    /// In timestamp ticks.
-    pub time: u64,
-    pub positions: Vec<CuePosition>,
-}
-
-/// A cluster found while scanning.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct ClusterInfo {
-    /// Absolute offset of the Cluster element header.
-    pub offset: u64,
-    /// Absolute offset of the first child.
-    pub data_start: u64,
-    /// Absolute end offset (for unknown-size clusters, where the next top-level element starts).
-    pub end: u64,
-    /// Cluster `Timestamp` in ticks.
-    pub timestamp: u64,
-}
-
-/// One `ChapterDisplay`.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct ChapterDisplay {
-    pub string: String,
-    pub languages: Vec<String>,
-    pub languages_bcp47: Vec<String>,
-    pub countries: Vec<String>,
-}
-
-/// `ChapterAtom` (possibly nested).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Chapter {
-    pub uid: u64,
-    pub string_uid: Option<String>,
-    pub start_ns: u64,
-    pub end_ns: Option<u64>,
-    pub hidden: bool,
-    pub enabled: bool,
-    pub displays: Vec<ChapterDisplay>,
-    pub children: Vec<Chapter>,
-}
-
-impl Chapter {
-    /// First display string, if any.
-    pub fn title(&self) -> Option<&str> {
-        self.displays.first().map(|d| d.string.as_str())
-    }
-}
-
-/// `EditionEntry`.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Edition {
-    pub uid: Option<u64>,
-    pub hidden: bool,
-    pub default: bool,
-    pub ordered: bool,
-    pub chapters: Vec<Chapter>,
-}
-
-/// `Targets` of a `Tag`. Empty UID lists mean "the whole segment".
-#[derive(Clone, Debug, PartialEq)]
-pub struct TagTargets {
-    pub type_value: u64,
-    pub type_name: Option<String>,
-    pub track_uids: Vec<u64>,
-    pub edition_uids: Vec<u64>,
-    pub chapter_uids: Vec<u64>,
-    pub attachment_uids: Vec<u64>,
-}
-
-impl Default for TagTargets {
-    fn default() -> Self {
-        Self { type_value: 50, type_name: None, track_uids: Vec::new(), edition_uids: Vec::new(), chapter_uids: Vec::new(), attachment_uids: Vec::new() }
-    }
-}
-
-/// `SimpleTag` (possibly nested).
-#[derive(Clone, Debug, PartialEq)]
-pub struct SimpleTag {
-    pub name: String,
-    pub language: String,
-    pub default: bool,
-    pub string: Option<String>,
-    pub binary: Option<Vec<u8>>,
-    pub children: Vec<SimpleTag>,
-}
-
-/// `Tag`.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Tag {
-    pub targets: TagTargets,
-    pub simple: Vec<SimpleTag>,
-}
-
-/// `AttachedFile` (listed only; the payload is located by `data_offset`/`data_size`).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Attachment {
-    pub uid: u64,
-    pub name: String,
-    pub media_type: String,
-    pub description: Option<String>,
-    pub data_offset: u64,
-    pub data_size: u64,
-}
-
-pub(crate) fn parse_info(d: &[u8]) -> SegmentInfo {
-    let mut info = SegmentInfo::default();
-    for e in Children::new(d) {
-        match e.id {
-            TIMESTAMP_SCALE => {
-                let v = uint(e.data);
-                if v > 0 {
-                    info.timestamp_scale = v;
-                }
-            }
-            DURATION => info.duration = Some(float(e.data)).filter(|v| v.is_finite() && *v >= 0.0),
-            TITLE => info.title = Some(string(e.data)),
-            MUXING_APP => info.muxing_app = string(e.data),
-            WRITING_APP => info.writing_app = string(e.data),
-            DATE_UTC => info.date_utc = Some(int(e.data)),
-            SEGMENT_UUID => info.segment_uuid = e.data.try_into().ok(),
-            _ => {}
-        }
-    }
-    info
-}
-
-pub(crate) fn parse_seekhead(d: &[u8]) -> Vec<SeekEntry> {
-    let mut out = Vec::new();
-    for s in Children::new(d).filter(|e| e.id == SEEK) {
-        let (mut id, mut pos) = (None, None);
-        for e in Children::new(s.data) {
-            match e.id {
-                SEEK_ID => id = Some(uint(e.data) as u32),
-                SEEK_POSITION => pos = Some(uint(e.data)),
-                _ => {}
-            }
-        }
-        if let (Some(id), Some(position)) = (id, pos) {
-            out.push(SeekEntry { id, position });
-        }
-    }
-    out
-}
-
-pub(crate) fn parse_cues(d: &[u8], out: &mut Vec<CuePoint>) {
-    for cp in Children::new(d).filter(|e| e.id == CUE_POINT) {
-        let mut time = None;
-        let mut positions = Vec::new();
-        for e in Children::new(cp.data) {
-            match e.id {
-                CUE_TIME => time = Some(uint(e.data)),
-                CUE_TRACK_POSITIONS => {
-                    let mut p = CuePosition { track: 0, cluster_position: u64::MAX, relative_position: None, block_number: None, duration: None };
-                    for c in Children::new(e.data) {
-                        match c.id {
-                            CUE_TRACK => p.track = uint(c.data),
-                            CUE_CLUSTER_POSITION => p.cluster_position = uint(c.data),
-                            CUE_RELATIVE_POSITION => p.relative_position = Some(uint(c.data)),
-                            CUE_BLOCK_NUMBER => p.block_number = Some(uint(c.data)),
-                            CUE_DURATION => p.duration = Some(uint(c.data)),
-                            _ => {}
-                        }
-                    }
-                    if p.track != 0 && p.cluster_position != u64::MAX {
-                        positions.push(p);
-                    }
-                }
-                _ => {}
-            }
-        }
-        if let Some(time) = time
-            && !positions.is_empty()
-        {
-            out.push(CuePoint { time, positions });
-        }
-    }
-}
-
-fn parse_chapter(d: &[u8], depth: usize) -> Chapter {
-    let mut c = Chapter { uid: 0, string_uid: None, start_ns: 0, end_ns: None, hidden: false, enabled: true, displays: Vec::new(), children: Vec::new() };
-    for e in Children::new(d) {
-        match e.id {
-            CHAPTER_UID => c.uid = uint(e.data),
-            CHAPTER_STRING_UID => c.string_uid = Some(string(e.data)),
-            CHAPTER_TIME_START => c.start_ns = uint(e.data),
-            CHAPTER_TIME_END => c.end_ns = Some(uint(e.data)),
-            CHAPTER_FLAG_HIDDEN => c.hidden = uint(e.data) != 0,
-            CHAPTER_FLAG_ENABLED => c.enabled = uint(e.data) != 0,
-            CHAPTER_DISPLAY => {
-                let mut disp = ChapterDisplay::default();
-                for x in Children::new(e.data) {
-                    match x.id {
-                        CHAP_STRING => disp.string = string(x.data),
-                        CHAP_LANGUAGE => disp.languages.push(string(x.data)),
-                        CHAP_LANGUAGE_BCP47 => disp.languages_bcp47.push(string(x.data)),
-                        CHAP_COUNTRY => disp.countries.push(string(x.data)),
-                        _ => {}
-                    }
-                }
-                if disp.languages.is_empty() {
-                    disp.languages.push("eng".into());
-                }
-                c.displays.push(disp);
-            }
-            CHAPTER_ATOM if depth < MAX_META_DEPTH => c.children.push(parse_chapter(e.data, depth + 1)),
-            _ => {}
-        }
-    }
-    c
-}
-
-pub(crate) fn parse_chapters(d: &[u8], out: &mut Vec<Edition>) {
-    for ed in Children::new(d).filter(|e| e.id == EDITION_ENTRY) {
-        let mut edition = Edition::default();
-        for e in Children::new(ed.data) {
-            match e.id {
-                EDITION_UID => edition.uid = Some(uint(e.data)),
-                EDITION_FLAG_HIDDEN => edition.hidden = uint(e.data) != 0,
-                EDITION_FLAG_DEFAULT => edition.default = uint(e.data) != 0,
-                EDITION_FLAG_ORDERED => edition.ordered = uint(e.data) != 0,
-                CHAPTER_ATOM => edition.chapters.push(parse_chapter(e.data, 0)),
-                _ => {}
-            }
-        }
-        out.push(edition);
-    }
-}
-
-fn parse_simple_tag(d: &[u8], depth: usize) -> SimpleTag {
-    let mut t = SimpleTag { name: String::new(), language: "und".into(), default: true, string: None, binary: None, children: Vec::new() };
-    for e in Children::new(d) {
-        match e.id {
-            TAG_NAME => t.name = string(e.data),
-            TAG_LANGUAGE => t.language = string(e.data),
-            TAG_DEFAULT => t.default = uint(e.data) != 0,
-            TAG_STRING => t.string = Some(string(e.data)),
-            TAG_BINARY => t.binary = Some(e.data.to_vec()),
-            SIMPLE_TAG if depth < MAX_META_DEPTH => t.children.push(parse_simple_tag(e.data, depth + 1)),
-            _ => {}
-        }
-    }
-    t
-}
-
-pub(crate) fn parse_tags(d: &[u8], out: &mut Vec<Tag>) {
-    for tg in Children::new(d).filter(|e| e.id == TAG) {
-        let mut tag = Tag::default();
-        for e in Children::new(tg.data) {
-            match e.id {
-                TARGETS => {
-                    for x in Children::new(e.data) {
-                        match x.id {
-                            TARGET_TYPE_VALUE => tag.targets.type_value = uint(x.data),
-                            TARGET_TYPE => tag.targets.type_name = Some(string(x.data)),
-                            TAG_TRACK_UID => tag.targets.track_uids.push(uint(x.data)),
-                            TAG_EDITION_UID => tag.targets.edition_uids.push(uint(x.data)),
-                            TAG_CHAPTER_UID => tag.targets.chapter_uids.push(uint(x.data)),
-                            TAG_ATTACHMENT_UID => tag.targets.attachment_uids.push(uint(x.data)),
-                            _ => {}
-                        }
-                    }
-                }
-                SIMPLE_TAG => tag.simple.push(parse_simple_tag(e.data, 0)),
-                _ => {}
-            }
-        }
-        out.push(tag);
-    }
-}
-
-fn parse_colour(d: &[u8]) -> Colour {
-    let mut c = Colour::default();
-    for e in Children::new(d) {
-        let v = || Some(uint(e.data));
-        match e.id {
-            MATRIX_COEFFICIENTS => c.matrix_coefficients = v(),
-            BITS_PER_CHANNEL => c.bits_per_channel = v(),
-            CHROMA_SUBSAMPLING_HORZ => c.chroma_subsampling_horz = v(),
-            CHROMA_SUBSAMPLING_VERT => c.chroma_subsampling_vert = v(),
-            CB_SUBSAMPLING_HORZ => c.cb_subsampling_horz = v(),
-            CB_SUBSAMPLING_VERT => c.cb_subsampling_vert = v(),
-            CHROMA_SITING_HORZ => c.chroma_siting_horz = v(),
-            CHROMA_SITING_VERT => c.chroma_siting_vert = v(),
-            RANGE => c.range = v(),
-            TRANSFER_CHARACTERISTICS => c.transfer_characteristics = v(),
-            PRIMARIES => c.primaries = v(),
-            MAX_CLL => c.max_cll = v(),
-            MAX_FALL => c.max_fall = v(),
-            MASTERING_METADATA => {
-                let mut m = MasteringMetadata::default();
-                for x in Children::new(e.data) {
-                    let f = float(x.data);
-                    match x.id {
-                        PRIMARY_R_X => m.primaries[0].0 = f,
-                        PRIMARY_R_Y => m.primaries[0].1 = f,
-                        PRIMARY_G_X => m.primaries[1].0 = f,
-                        PRIMARY_G_Y => m.primaries[1].1 = f,
-                        PRIMARY_B_X => m.primaries[2].0 = f,
-                        PRIMARY_B_Y => m.primaries[2].1 = f,
-                        WHITE_POINT_X => m.white_point.0 = f,
-                        WHITE_POINT_Y => m.white_point.1 = f,
-                        LUMINANCE_MAX => m.luminance_max = f,
-                        LUMINANCE_MIN => m.luminance_min = f,
-                        _ => {}
-                    }
-                }
-                c.mastering = Some(m);
-            }
-            _ => {}
-        }
-    }
-    c
-}
-
-fn parse_video(d: &[u8]) -> VideoInfo {
-    let mut v = VideoInfo::default();
-    for e in Children::new(d) {
-        let u = uint(e.data);
-        match e.id {
-            PIXEL_WIDTH => v.pixel_width = u as u32,
-            PIXEL_HEIGHT => v.pixel_height = u as u32,
-            DISPLAY_WIDTH => v.display_width = Some(u as u32),
-            DISPLAY_HEIGHT => v.display_height = Some(u as u32),
-            DISPLAY_UNIT => v.display_unit = u,
-            PIXEL_CROP_TOP => v.crop.0 = u as u32,
-            PIXEL_CROP_BOTTOM => v.crop.1 = u as u32,
-            PIXEL_CROP_LEFT => v.crop.2 = u as u32,
-            PIXEL_CROP_RIGHT => v.crop.3 = u as u32,
-            FLAG_INTERLACED => v.flag_interlaced = u,
-            FIELD_ORDER => v.field_order = Some(u),
-            STEREO_MODE => v.stereo_mode = Some(u),
-            ALPHA_MODE => v.alpha_mode = u,
-            COLOUR_SPACE => v.colour_space = e.data.try_into().ok(),
-            COLOUR => v.colour = Some(parse_colour(e.data)),
-            PROJECTION => {
-                let mut p = Projection::default();
-                for x in Children::new(e.data) {
-                    match x.id {
-                        PROJECTION_TYPE => p.projection_type = uint(x.data),
-                        PROJECTION_POSE_YAW => p.yaw = float(x.data),
-                        PROJECTION_POSE_PITCH => p.pitch = float(x.data),
-                        PROJECTION_POSE_ROLL => p.roll = float(x.data),
-                        _ => {}
-                    }
-                }
-                v.projection = Some(p);
-            }
-            _ => {}
-        }
-    }
-    v
-}
-
-fn parse_audio(d: &[u8]) -> AudioInfo {
-    let mut a = AudioInfo::default();
-    for e in Children::new(d) {
-        match e.id {
-            SAMPLING_FREQUENCY => a.sampling_frequency = float(e.data),
-            OUTPUT_SAMPLING_FREQUENCY => a.output_sampling_frequency = Some(float(e.data)),
-            CHANNELS => a.channels = uint(e.data),
-            BIT_DEPTH => a.bit_depth = Some(uint(e.data)),
-            _ => {}
-        }
-    }
-    a
-}
-
-fn parse_encodings(d: &[u8]) -> Vec<ContentEncoding> {
-    let mut list: Vec<(u64, ContentEncoding)> = Vec::new();
-    for ce in Children::new(d).filter(|e| e.id == CONTENT_ENCODING) {
-        let (mut order, mut scope, mut ty) = (0u64, 1u64, 0u64);
-        let mut comp: Option<(u64, Vec<u8>)> = None;
-        for e in Children::new(ce.data) {
-            match e.id {
-                CONTENT_ENCODING_ORDER => order = uint(e.data),
-                CONTENT_ENCODING_SCOPE => scope = uint(e.data),
-                CONTENT_ENCODING_TYPE => ty = uint(e.data),
-                CONTENT_COMPRESSION => {
-                    let (mut algo, mut settings) = (0u64, Vec::new());
-                    for x in Children::new(e.data) {
-                        match x.id {
-                            CONTENT_COMP_ALGO => algo = uint(x.data),
-                            CONTENT_COMP_SETTINGS => settings = x.data.to_vec(),
-                            _ => {}
-                        }
-                    }
-                    comp = Some((algo, settings));
-                }
-                _ => {}
-            }
-        }
-        let enc = if ty == 1 {
-            ContentEncoding::Encryption { scope }
-        } else {
-            let (algo, settings) = comp.unwrap_or((0, Vec::new()));
-            if algo == 3 { ContentEncoding::HeaderStripping { bytes: settings, scope } } else { ContentEncoding::Compression { algo, settings, scope } }
-        };
-        list.push((order, enc));
-    }
-    // highest order is applied last on muxing → first to undo; keep decode order
-    list.sort_by_key(|e| std::cmp::Reverse(e.0));
-    list.into_iter().map(|e| e.1).collect()
-}
-
-pub(crate) fn parse_tracks(d: &[u8], timestamp_scale: u64) -> Vec<Track> {
-    let g = gcd(timestamp_scale, 1_000_000_000);
-    let timebase = (timestamp_scale / g, 1_000_000_000 / g);
-    let mut out = Vec::new();
-    for te in Children::new(d).filter(|e| e.id == TRACK_ENTRY) {
-        let mut t = Track {
-            number: 0,
-            uid: 0,
-            kind: TrackKind::Other(0),
-            enabled: true,
-            default: true,
-            forced: false,
-            hearing_impaired: false,
-            lacing: true,
-            default_duration_ns: None,
-            name: String::new(),
-            language: "eng".into(),
-            language_bcp47: None,
-            codec_id: String::new(),
-            codec_private: Vec::new(),
-            codec_name: String::new(),
-            codec: crate::Codec::Other(String::new()),
-            codec_delay_ns: 0,
-            seek_pre_roll_ns: 0,
-            video: None,
-            audio: None,
-            encodings: Vec::new(),
-            timebase,
-            samples: Vec::new(),
-            sync: Vec::new(),
-        };
-        for e in Children::new(te.data) {
-            match e.id {
-                TRACK_NUMBER => t.number = uint(e.data),
-                TRACK_UID => t.uid = uint(e.data),
-                TRACK_TYPE => t.kind = TrackKind::from_type(uint(e.data)),
-                FLAG_ENABLED => t.enabled = uint(e.data) != 0,
-                FLAG_DEFAULT => t.default = uint(e.data) != 0,
-                FLAG_FORCED => t.forced = uint(e.data) != 0,
-                FLAG_HEARING_IMPAIRED => t.hearing_impaired = uint(e.data) != 0,
-                FLAG_LACING => t.lacing = uint(e.data) != 0,
-                DEFAULT_DURATION => t.default_duration_ns = Some(uint(e.data)).filter(|&v| v > 0),
-                NAME => t.name = string(e.data),
-                LANGUAGE => t.language = string(e.data),
-                LANGUAGE_BCP47 => t.language_bcp47 = Some(string(e.data)),
-                CODEC_ID => t.codec_id = string(e.data),
-                CODEC_PRIVATE => t.codec_private = e.data.to_vec(),
-                CODEC_NAME => t.codec_name = string(e.data),
-                CODEC_DELAY => t.codec_delay_ns = uint(e.data),
-                SEEK_PRE_ROLL => t.seek_pre_roll_ns = uint(e.data),
-                VIDEO => t.video = Some(parse_video(e.data)),
-                AUDIO => t.audio = Some(parse_audio(e.data)),
-                CONTENT_ENCODINGS => t.encodings = parse_encodings(e.data),
-                _ => {}
-            }
-        }
-        if t.number == 0 {
-            continue;
-        }
-        if t.kind == TrackKind::Audio && t.audio.is_none() {
-            t.audio = Some(AudioInfo::default());
-        }
-        // CodecPrivate may itself be header-stripped (scope bit 2 = private data)
-        for enc in &t.encodings {
-            if let ContentEncoding::HeaderStripping { bytes, scope } = enc
-                && scope & 2 != 0
-            {
-                let mut p = bytes.clone();
-                p.extend_from_slice(&t.codec_private);
-                t.codec_private = p;
-            }
-        }
-        t.codec = map_codec(&t.codec_id, &t.codec_private, t.audio.as_ref());
-        out.push(t);
-    }
-    out
-}
-
-#[cfg(test)]
-mod metadata_depth_tests {
-    use super::*;
-
-    #[test]
-    fn deeply_nested_chapters_stop_at_depth_limit() {
-        // Unknown-size elements make every pair the sole child of the previous ChapterAtom.
-        let data = [0xB6, 0xFF].repeat(100_000);
-        let chapter = parse_chapter(&data, 0);
-        let mut current = &chapter;
-        for _ in 0..MAX_META_DEPTH {
-            assert_eq!(current.children.len(), 1);
-            current = &current.children[0];
-        }
-        assert!(current.children.is_empty());
-    }
-
-    #[test]
-    fn deeply_nested_simple_tags_stop_at_depth_limit() {
-        let data = [0x67, 0xC8, 0xFF].repeat(100_000);
-        let tag = parse_simple_tag(&data, 0);
-        let mut current = &tag;
-        for _ in 0..MAX_META_DEPTH {
-            assert_eq!(current.children.len(), 1);
-            current = &current.children[0];
-        }
-        assert!(current.children.is_empty());
-    }
-}
diff --git a/crates/matroska/src/mux.rs b/crates/matroska/src/mux.rs
deleted file mode 100644
index f809b1beb..000000000
--- a/crates/matroska/src/mux.rs
+++ /dev/null
@@ -1,539 +0,0 @@
-//! Minimal Matroska / WebM muxer: SimpleBlocks (optionally laced), BlockGroups for explicit
-//! durations, Cues, SeekHead, Info with Duration. Output must be `Write + Seek` (sizes and the
-//! SeekHead are back-patched on [`MkvWriter::finish`]).
-
-use std::io::{Seek, SeekFrom, Write};
-
-use crate::ebml::{write_id, write_size, write_unknown_size};
-use crate::error::{Error, Result};
-use crate::ids::*;
-use crate::track::TrackKind;
-
-/// Lacing used for audio tracks.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LacingMode {
-    None,
-    Xiph,
-    Ebml,
-    /// Fixed-size lacing when consecutive frames have equal sizes, otherwise EBML lacing.
-    FixedOrEbml,
-}
-
-/// Track description for [`MkvWriter`].
-#[derive(Clone, Debug)]
-pub struct TrackSpec {
-    pub kind: TrackKind,
-    pub codec_id: String,
-    pub codec_private: Vec<u8>,
-    pub default_duration_ns: Option<u64>,
-    pub language: Option<String>,
-    pub name: Option<String>,
-    /// Pixel width/height for video tracks.
-    pub video_size: Option<(u32, u32)>,
-    /// (sampling frequency, channels, bit depth) for audio tracks.
-    pub audio: Option<(f64, u64, Option<u64>)>,
-    pub codec_delay_ns: u64,
-    pub seek_pre_roll_ns: u64,
-}
-
-impl TrackSpec {
-    pub fn new(kind: TrackKind, codec_id: impl Into<String>) -> Self {
-        Self {
-            kind,
-            codec_id: codec_id.into(),
-            codec_private: Vec::new(),
-            default_duration_ns: None,
-            language: None,
-            name: None,
-            video_size: None,
-            audio: None,
-            codec_delay_ns: 0,
-            seek_pre_roll_ns: 0,
-        }
-    }
-}
-
-/// Muxer options.
-#[derive(Clone, Debug)]
-pub struct MuxOptions {
-    /// `webm` or `matroska`.
-    pub doc_type: String,
-    /// Nanoseconds per tick (default 1 000 000).
-    pub timestamp_scale: u64,
-    /// Start a new cluster at the next video keyframe (or any frame without video) after this long.
-    pub cluster_duration_ns: u64,
-    pub lacing: LacingMode,
-    /// Maximum frames per laced block.
-    pub max_lace_frames: usize,
-    pub title: Option<String>,
-    pub writing_app: String,
-}
-
-impl Default for MuxOptions {
-    fn default() -> Self {
-        Self {
-            doc_type: "matroska".into(),
-            timestamp_scale: 1_000_000,
-            cluster_duration_ns: 1_000_000_000,
-            lacing: LacingMode::None,
-            max_lace_frames: 8,
-            title: None,
-            writing_app: "filmcraft".into(),
-        }
-    }
-}
-
-pub(crate) fn el(out: &mut Vec<u8>, id: u32, data: &[u8]) {
-    write_id(out, id);
-    write_size(out, data.len() as u64, 1);
-    out.extend_from_slice(data);
-}
-
-pub(crate) fn el_uint(out: &mut Vec<u8>, id: u32, v: u64) {
-    let n = (8 - v.leading_zeros() as usize / 8).max(1);
-    el(out, id, &v.to_be_bytes()[8 - n..]);
-}
-
-pub(crate) fn el_float(out: &mut Vec<u8>, id: u32, v: f64) {
-    el(out, id, &v.to_be_bytes());
-}
-
-pub(crate) fn el_str(out: &mut Vec<u8>, id: u32, s: &str) {
-    el(out, id, s.as_bytes());
-}
-
-fn void(out: &mut Vec<u8>, total: usize) {
-    debug_assert!(total >= 2);
-    let sl = if total - 2 <= 126 { 1 } else { 8 };
-    write_id(out, VOID);
-    write_size(out, (total - 1 - sl) as u64, sl);
-    out.resize(out.len() + total - 1 - sl, 0);
-}
-
-#[derive(Clone, Debug)]
-struct Pending {
-    track: usize,
-    ts: i64,
-    frames: Vec<Vec<u8>>,
-}
-
-const SEEK_HEAD_SPACE: usize = 128;
-
-/// Streaming Matroska/WebM writer.
-pub struct MkvWriter<W: Write + Seek> {
-    w: W,
-    opts: MuxOptions,
-    tracks: Vec<TrackSpec>,
-    segment_size_pos: u64,
-    segment_data_start: u64,
-    seek_head_pos: u64,
-    duration_pos: u64,
-    info_pos: u64,
-    tracks_pos: u64,
-    cluster: Vec<u8>,
-    cluster_ts: Option<i64>,
-    cluster_start_ns: i64,
-    pending: Option<Pending>,
-    cues: Vec<(u64, u64, u64)>, // (time ticks, track number, cluster position)
-    cued_tracks_in_cluster: Vec<bool>,
-    end_ns: i64,
-    has_video: bool,
-}
-
-impl<W: Write + Seek> MkvWriter<W> {
-    pub fn new(mut w: W, tracks: Vec<TrackSpec>, opts: MuxOptions) -> Result<Self> {
-        if tracks.is_empty() || opts.timestamp_scale == 0 {
-            return Err(Error::Invalid("muxer needs at least one track and a non-zero timestamp scale".into()));
-        }
-        let mut out = Vec::new();
-        let mut h = Vec::new();
-        el_uint(&mut h, EBML_VERSION, 1);
-        el_uint(&mut h, EBML_READ_VERSION, 1);
-        el_uint(&mut h, EBML_MAX_ID_LENGTH, 4);
-        el_uint(&mut h, EBML_MAX_SIZE_LENGTH, 8);
-        el_str(&mut h, DOC_TYPE, &opts.doc_type);
-        el_uint(&mut h, DOC_TYPE_VERSION, 4);
-        el_uint(&mut h, DOC_TYPE_READ_VERSION, 2);
-        el(&mut out, EBML, &h);
-        write_id(&mut out, SEGMENT);
-        let base = w.stream_position()?;
-        let segment_size_pos = base + out.len() as u64;
-        write_unknown_size(&mut out, 8);
-        let segment_data_start = base + out.len() as u64;
-        let seek_head_pos = segment_data_start;
-        void(&mut out, SEEK_HEAD_SPACE);
-        // Info
-        let info_pos = base + out.len() as u64;
-        let mut info = Vec::new();
-        el_uint(&mut info, TIMESTAMP_SCALE, opts.timestamp_scale);
-        el_str(&mut info, MUXING_APP, "filmcraft-matroska");
-        el_str(&mut info, WRITING_APP, &opts.writing_app);
-        if let Some(t) = &opts.title {
-            el_str(&mut info, TITLE, t);
-        }
-        let dur_off_in_info = info.len() + 2 + 1; // ID (2) + size (1)
-        el_float(&mut info, DURATION, 0.0);
-        write_id(&mut out, INFO);
-        write_size(&mut out, info.len() as u64, 1);
-        let duration_pos = base + out.len() as u64 + dur_off_in_info as u64;
-        out.extend_from_slice(&info);
-        // Tracks
-        let tracks_pos = base + out.len() as u64;
-        let mut tr = Vec::new();
-        for (i, t) in tracks.iter().enumerate() {
-            let mut e = Vec::new();
-            el_uint(&mut e, TRACK_NUMBER, i as u64 + 1);
-            el_uint(&mut e, TRACK_UID, 0x1000 + i as u64 + 1);
-            let ty = match t.kind {
-                TrackKind::Video => 1,
-                TrackKind::Audio => 2,
-                TrackKind::Subtitle => 0x11,
-                TrackKind::Complex => 3,
-                TrackKind::Logo => 0x10,
-                TrackKind::Buttons => 0x12,
-                TrackKind::Control => 0x20,
-                TrackKind::Metadata => 0x21,
-                TrackKind::Other(n) => n as u64,
-            };
-            el_uint(&mut e, TRACK_TYPE, ty);
-            el_uint(&mut e, FLAG_LACING, (t.kind == TrackKind::Audio && opts.lacing != LacingMode::None) as u64);
-            if let Some(l) = &t.language {
-                el_str(&mut e, LANGUAGE, l);
-            }
-            if let Some(n) = &t.name {
-                el_str(&mut e, NAME, n);
-            }
-            el_str(&mut e, CODEC_ID, &t.codec_id);
-            if !t.codec_private.is_empty() {
-                el(&mut e, CODEC_PRIVATE, &t.codec_private);
-            }
-            if let Some(d) = t.default_duration_ns {
-                el_uint(&mut e, DEFAULT_DURATION, d);
-            }
-            if t.codec_delay_ns > 0 {
-                el_uint(&mut e, CODEC_DELAY, t.codec_delay_ns);
-            }
-            if t.seek_pre_roll_ns > 0 {
-                el_uint(&mut e, SEEK_PRE_ROLL, t.seek_pre_roll_ns);
-            }
-            if let Some((pw, ph)) = t.video_size {
-                let mut v = Vec::new();
-                el_uint(&mut v, PIXEL_WIDTH, pw as u64);
-                el_uint(&mut v, PIXEL_HEIGHT, ph as u64);
-                el(&mut e, VIDEO, &v);
-            }
-            if let Some((rate, ch, bits)) = t.audio {
-                let mut a = Vec::new();
-                el_float(&mut a, SAMPLING_FREQUENCY, rate);
-                el_uint(&mut a, CHANNELS, ch);
-                if let Some(b) = bits {
-                    el_uint(&mut a, BIT_DEPTH, b);
-                }
-                el(&mut e, AUDIO, &a);
-            }
-            el(&mut tr, TRACK_ENTRY, &e);
-        }
-        el(&mut out, TRACKS, &tr);
-        w.write_all(&out)?;
-        let has_video = tracks.iter().any(|t| t.kind == TrackKind::Video);
-        let n = tracks.len();
-        Ok(Self {
-            w,
-            opts,
-            tracks,
-            segment_size_pos,
-            segment_data_start,
-            seek_head_pos,
-            duration_pos,
-            info_pos,
-            tracks_pos,
-            cluster: Vec::new(),
-            cluster_ts: None,
-            cluster_start_ns: 0,
-            pending: None,
-            cues: Vec::new(),
-            cued_tracks_in_cluster: vec![false; n],
-            end_ns: 0,
-            has_video,
-        })
-    }
-
-    /// Add one frame. `pts_ns` is the presentation time (codec delay is added back for storage);
-    /// frames must be supplied in the desired file order. `duration_ns` forces a BlockGroup with a
-    /// BlockDuration when it differs from the track's DefaultDuration.
-    pub fn write_frame(&mut self, track: usize, pts_ns: i64, keyframe: bool, data: &[u8], duration_ns: Option<u64>) -> Result<()> {
-        let spec = self.tracks.get(track).ok_or(Error::NoSuchTrack(track))?;
-        // the Matroska ProRes mapping stores frames without the 8-byte `size`+`icpf` header
-        let data = if spec.codec_id == "V_PRORES" && data.get(4..8) == Some(b"icpf") { &data[8..] } else { data };
-        let scale = self.opts.timestamp_scale as i64;
-        let stored_ns = pts_ns + spec.codec_delay_ns as i64;
-        if stored_ns < 0 {
-            return Err(Error::Invalid("negative timestamp".into()));
-        }
-        let ts = (stored_ns + scale / 2) / scale;
-        let dur_end = pts_ns + duration_ns.or(spec.default_duration_ns).unwrap_or(0) as i64;
-        self.end_ns = self.end_ns.max(dur_end).max(pts_ns);
-        let is_video = spec.kind == TrackKind::Video;
-        let lacing = spec.kind == TrackKind::Audio && self.opts.lacing != LacingMode::None;
-        let explicit_dur = duration_ns.filter(|&d| Some(d) != spec.default_duration_ns);
-        // new cluster?
-        let start_new = match self.cluster_ts {
-            None => true,
-            Some(cts) => {
-                let long = stored_ns - self.cluster_start_ns >= self.opts.cluster_duration_ns as i64;
-                (long && (!self.has_video || (is_video && keyframe))) || ts - cts > 30_000 || ts < cts
-            }
-        };
-        if start_new {
-            self.flush_cluster()?;
-            self.cluster_ts = Some(ts);
-            self.cluster_start_ns = stored_ns;
-            el_uint(&mut self.cluster, TIMESTAMP, ts as u64);
-        }
-        let cts = self.cluster_ts.unwrap_or(0);
-        // cue: video keyframes, or the first frame of each track per cluster when there is no video
-        if (is_video && keyframe) || (!self.has_video && !self.cued_tracks_in_cluster[track]) {
-            self.cued_tracks_in_cluster[track] = true;
-            let pos = self.w.stream_position()? - self.segment_data_start;
-            if self.cues.last().is_none_or(|c| c.2 != pos || c.1 != track as u64 + 1) {
-                self.cues.push((ts as u64, track as u64 + 1, pos));
-            }
-        }
-        if lacing && explicit_dur.is_none() {
-            let same = self.pending.as_ref().is_some_and(|p| p.track == track && p.frames.len() < self.opts.max_lace_frames);
-            if !same {
-                self.flush_pending();
-            }
-            match &mut self.pending {
-                Some(p) => p.frames.push(data.to_vec()),
-                None => self.pending = Some(Pending { track, ts: ts - cts, frames: vec![data.to_vec()] }),
-            }
-            return Ok(());
-        }
-        self.flush_pending();
-        let mut block = Vec::new();
-        write_size(&mut block, track as u64 + 1, 1);
-        block.extend_from_slice(&((ts - cts) as i16).to_be_bytes());
-        if let Some(d) = explicit_dur {
-            block.push(0);
-            block.extend_from_slice(data);
-            let mut g = Vec::new();
-            el(&mut g, BLOCK, &block);
-            el_uint(&mut g, BLOCK_DURATION, (d as i64 / scale) as u64);
-            if !keyframe {
-                el(&mut g, REFERENCE_BLOCK, &[0xFF]);
-            }
-            el(&mut self.cluster, BLOCK_GROUP, &g);
-        } else {
-            block.push(if keyframe { 0x80 } else { 0 });
-            block.extend_from_slice(data);
-            el(&mut self.cluster, SIMPLE_BLOCK, &block);
-        }
-        Ok(())
-    }
-
-    fn flush_pending(&mut self) {
-        let Some(p) = self.pending.take() else { return };
-        let mut block = Vec::new();
-        write_size(&mut block, p.track as u64 + 1, 1);
-        block.extend_from_slice(&(p.ts as i16).to_be_bytes());
-        let n = p.frames.len();
-        let mode = if n == 1 { LacingMode::None } else { self.opts.lacing };
-        let fixed = p.frames.iter().all(|f| f.len() == p.frames[0].len());
-        match mode {
-            LacingMode::None => block.push(0x80),
-            LacingMode::Xiph => {
-                block.push(0x80 | 0x02);
-                block.push((n - 1) as u8);
-                for f in &p.frames[..n - 1] {
-                    let mut s = f.len();
-                    while s >= 255 {
-                        block.push(255);
-                        s -= 255;
-                    }
-                    block.push(s as u8);
-                }
-            }
-            LacingMode::FixedOrEbml if fixed => {
-                block.push(0x80 | 0x04);
-                block.push((n - 1) as u8);
-            }
-            LacingMode::Ebml | LacingMode::FixedOrEbml => {
-                block.push(0x80 | 0x06);
-                block.push((n - 1) as u8);
-                write_size(&mut block, p.frames[0].len() as u64, 1);
-                for i in 1..n - 1 {
-                    let d = p.frames[i].len() as i64 - p.frames[i - 1].len() as i64;
-                    // signed VINT: smallest length whose range holds d
-                    let mut len = 1;
-                    while len < 8 && d.unsigned_abs() >= (1u64 << (7 * len - 1)) - 1 {
-                        len += 1;
-                    }
-                    let v = (d + (1i64 << (7 * len - 1)) - 1) as u64 | (1u64 << (7 * len));
-                    block.extend_from_slice(&v.to_be_bytes()[8 - len..]);
-                }
-            }
-        }
-        for f in &p.frames {
-            block.extend_from_slice(f);
-        }
-        el(&mut self.cluster, SIMPLE_BLOCK, &block);
-    }
-
-    fn flush_cluster(&mut self) -> Result<()> {
-        self.flush_pending();
-        if self.cluster_ts.is_some() {
-            let mut out = Vec::new();
-            el(&mut out, CLUSTER, &self.cluster);
-            self.w.write_all(&out)?;
-        }
-        self.cluster.clear();
-        self.cluster_ts = None;
-        self.cued_tracks_in_cluster.iter_mut().for_each(|c| *c = false);
-        Ok(())
-    }
-
-    /// Write Cues, back-patch SeekHead / Segment size / Duration, and return the writer.
-    pub fn finish(mut self) -> Result<W> {
-        self.flush_cluster()?;
-        let cues_pos = self.w.stream_position()?;
-        let mut cues = Vec::new();
-        for &(time, track, pos) in &self.cues {
-            let mut ctp = Vec::new();
-            el_uint(&mut ctp, CUE_TRACK, track);
-            el_uint(&mut ctp, CUE_CLUSTER_POSITION, pos);
-            let mut cp = Vec::new();
-            el_uint(&mut cp, CUE_TIME, time);
-            el(&mut cp, CUE_TRACK_POSITIONS, &ctp);
-            el(&mut cues, CUE_POINT, &cp);
-        }
-        let has_cues = !cues.is_empty();
-        if has_cues {
-            let mut out = Vec::new();
-            el(&mut out, CUES, &cues);
-            self.w.write_all(&out)?;
-        }
-        let end = self.w.stream_position()?;
-        // SeekHead
-        let mut sh = Vec::new();
-        let mut entries = vec![(INFO, self.info_pos), (TRACKS, self.tracks_pos)];
-        if has_cues {
-            entries.push((CUES, cues_pos));
-        }
-        for (id, pos) in entries {
-            let mut s = Vec::new();
-            let mut idb = Vec::new();
-            write_id(&mut idb, id);
-            el(&mut s, SEEK_ID, &idb);
-            el_uint(&mut s, SEEK_POSITION, pos - self.segment_data_start);
-            el(&mut sh, SEEK, &s);
-        }
-        let mut out = Vec::new();
-        el(&mut out, SEEK_HEAD, &sh);
-        if out.len() + 2 > SEEK_HEAD_SPACE {
-            return Err(Error::Invalid("SeekHead does not fit its reserved space".into()));
-        }
-        let rest = SEEK_HEAD_SPACE - out.len();
-        void(&mut out, rest);
-        self.w.seek(SeekFrom::Start(self.seek_head_pos))?;
-        self.w.write_all(&out)?;
-        // Duration
-        let dur = self.end_ns as f64 / self.opts.timestamp_scale as f64;
-        self.w.seek(SeekFrom::Start(self.duration_pos))?;
-        self.w.write_all(&dur.to_be_bytes())?;
-        // Segment size
-        let mut sz = Vec::new();
-        write_size(&mut sz, end - self.segment_data_start, 8);
-        self.w.seek(SeekFrom::Start(self.segment_size_pos))?;
-        self.w.write_all(&sz)?;
-        self.w.seek(SeekFrom::Start(end))?;
-        self.w.flush()?;
-        Ok(self.w)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{Demuxer, TrackKind};
-    use std::io::Cursor;
-
-    fn roundtrip(lacing: LacingMode) {
-        let mut v = TrackSpec::new(TrackKind::Video, "V_MJPEG");
-        v.video_size = Some((16, 16));
-        v.default_duration_ns = Some(40_000_000);
-        let mut a = TrackSpec::new(TrackKind::Audio, "A_PCM/INT/LIT");
-        a.audio = Some((48000.0, 1, Some(16)));
-        a.default_duration_ns = Some(10_000_000);
-        let mut s = TrackSpec::new(TrackKind::Subtitle, "S_TEXT/UTF8");
-        s.language = Some("fre".into());
-        let opts = MuxOptions { lacing, ..Default::default() };
-        let mut m = MkvWriter::new(Cursor::new(Vec::new()), vec![v, a, s], opts).unwrap();
-        let mut expect = Vec::new();
-        for i in 0..50i64 {
-            let vf = vec![i as u8; 100 + i as usize];
-            m.write_frame(0, i * 40_000_000, i % 10 == 0, &vf, None).unwrap();
-            expect.push((0usize, i * 40, vf, i % 10 == 0));
-            for k in 0..4 {
-                let n = if lacing == LacingMode::FixedOrEbml { 960 } else { 900 + (i as usize * 7 + k * 13) % 300 };
-                let af = vec![(i * 4 + k as i64) as u8; n];
-                let t = i * 40 + k as i64 * 10;
-                m.write_frame(1, t * 1_000_000, true, &af, None).unwrap();
-                expect.push((1, t, af, true));
-            }
-            if i % 20 == 5 {
-                m.write_frame(2, i * 40_000_000, true, b"hello", Some(500_000_000)).unwrap();
-                expect.push((2, i * 40, b"hello".to_vec(), true));
-            }
-        }
-        let bytes = m.finish().unwrap().into_inner();
-        let mut d = Demuxer::from_slice(&bytes).unwrap();
-        assert!(d.file().warnings.is_empty(), "{:?}", d.file().warnings);
-        assert_eq!(d.tracks()[2].language, "fre");
-        assert!(!d.file().cues.is_empty());
-        assert_eq!(d.duration_ns(), Some(2_300_000_000));
-        let got: Vec<_> = d.by_ref().map(|p| p.unwrap()).collect();
-        assert_eq!(got.len(), expect.len());
-        for (g, e) in got.iter().zip(&expect) {
-            assert_eq!((g.track, g.pts, &g.data, g.keyframe), (e.0, e.1, &e.2, e.3));
-        }
-        let sub = got.iter().find(|p| p.track == 2).unwrap();
-        assert_eq!(sub.duration, 500);
-        // the index agrees with the packet stream
-        let f = d.file();
-        for (ti, t) in f.tracks.iter().enumerate() {
-            let pk: Vec<_> = got.iter().filter(|p| p.track == ti).collect();
-            assert_eq!(t.samples.len(), pk.len());
-            for (i, p) in pk.iter().enumerate() {
-                assert_eq!(f.read_sample(&bytes[..], ti, i).unwrap(), p.data);
-                assert_eq!(t.samples[i].pts, p.pts);
-            }
-        }
-        // seeking
-        let sp = d.seek(0, 1_230_000_000).unwrap();
-        assert_eq!(sp.pts, 1200);
-        let p = d.next_packet().unwrap().unwrap();
-        assert_eq!((p.track, p.pts, p.keyframe), (0, 1200, true));
-        let sp = d.seek(1, 1_235_000_000).unwrap();
-        assert_eq!(sp.pts, 1230);
-        let p = d.next_packet().unwrap().unwrap();
-        assert_eq!((p.track, p.pts), (1, 1230));
-    }
-
-    #[test]
-    fn roundtrip_unlaced() {
-        roundtrip(LacingMode::None);
-    }
-    #[test]
-    fn roundtrip_xiph() {
-        roundtrip(LacingMode::Xiph);
-    }
-    #[test]
-    fn roundtrip_ebml() {
-        roundtrip(LacingMode::Ebml);
-    }
-    #[test]
-    fn roundtrip_fixed() {
-        roundtrip(LacingMode::FixedOrEbml);
-    }
-}
diff --git a/crates/matroska/src/source.rs b/crates/matroska/src/source.rs
deleted file mode 100644
index da10d89ff..000000000
--- a/crates/matroska/src/source.rs
+++ /dev/null
@@ -1,173 +0,0 @@
-//! Random-access byte sources for the demuxer.
-
-use std::cell::RefCell;
-use std::io::{self, Read, Seek, SeekFrom};
-use std::sync::Arc;
-
-/// Random-access, read-only byte source (file, in-memory buffer, web Blob…).
-///
-/// Same shape as `filmcraft_isobmff::ByteSource`, so one adapter can serve both demuxers.
-pub trait ByteSource {
-    /// Total length in bytes.
-    fn len(&self) -> u64;
-    /// Fill `buf` entirely with bytes starting at `offset`; fail with `UnexpectedEof` if past the end.
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()>;
-    /// True if the source holds no bytes.
-    fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-fn eof() -> io::Error {
-    io::Error::new(io::ErrorKind::UnexpectedEof, "read past end of byte source")
-}
-
-impl ByteSource for [u8] {
-    fn len(&self) -> u64 {
-        <[u8]>::len(self) as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        let start = usize::try_from(offset).map_err(|_| eof())?;
-        let end = start.checked_add(buf.len()).ok_or_else(eof)?;
-        let src = self.get(start..end).ok_or_else(eof)?;
-        buf.copy_from_slice(src);
-        Ok(())
-    }
-}
-
-impl ByteSource for Vec<u8> {
-    fn len(&self) -> u64 {
-        self.as_slice().len() as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        self.as_slice().read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for &T {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for Arc<T> {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for Box<T> {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl ByteSource for std::fs::File {
-    fn len(&self) -> u64 {
-        self.metadata().map(|m| m.len()).unwrap_or(0)
-    }
-    #[cfg(unix)]
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        std::os::unix::fs::FileExt::read_exact_at(self, buf, offset)
-    }
-    #[cfg(windows)]
-    fn read_at(&self, mut offset: u64, mut buf: &mut [u8]) -> io::Result<()> {
-        use std::os::windows::fs::FileExt;
-        while !buf.is_empty() {
-            let n = self.seek_read(buf, offset)?;
-            if n == 0 {
-                return Err(eof());
-            }
-            offset += n as u64;
-            buf = &mut buf[n..];
-        }
-        Ok(())
-    }
-    #[cfg(not(any(unix, windows)))]
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        let mut f = self;
-        f.seek(SeekFrom::Start(offset))?;
-        f.read_exact(buf)
-    }
-}
-
-/// Adapts any `Read + Seek` (e.g. `BufReader<File>`, `Cursor<Vec<u8>>`) into a [`ByteSource`].
-///
-/// The length is taken once at construction; the stream position is tracked so sequential reads
-/// do not issue redundant seeks.
-pub struct ReadSeekSource<R> {
-    inner: RefCell<(R, u64)>,
-    len: u64,
-}
-
-impl<R: Read + Seek> ReadSeekSource<R> {
-    /// Wrap a reader; seeks to the end once to learn the length.
-    pub fn new(mut r: R) -> io::Result<Self> {
-        let len = r.seek(SeekFrom::End(0))?;
-        Ok(Self { inner: RefCell::new((r, len)), len })
-    }
-    /// Unwrap the reader.
-    pub fn into_inner(self) -> R {
-        self.inner.into_inner().0
-    }
-}
-
-impl<R: Read + Seek> ByteSource for ReadSeekSource<R> {
-    fn len(&self) -> u64 {
-        self.len
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        if offset.checked_add(buf.len() as u64).is_none_or(|e| e > self.len) {
-            return Err(eof());
-        }
-        let mut g = self.inner.borrow_mut();
-        let (r, pos) = &mut *g;
-        if *pos != offset {
-            r.seek(SeekFrom::Start(offset))?;
-            *pos = offset;
-        }
-        let res = r.read_exact(buf);
-        match res {
-            Ok(()) => {
-                *pos = offset + buf.len() as u64;
-                Ok(())
-            }
-            Err(e) => {
-                *pos = u64::MAX; // unknown; force a seek next time
-                Err(e)
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn slice_and_reader_sources() {
-        let v = vec![1u8, 2, 3, 4];
-        let mut b = [0u8; 2];
-        v.read_at(1, &mut b).unwrap();
-        assert_eq!(b, [2, 3]);
-        assert!(v.read_at(3, &mut b).is_err());
-        assert!(v.read_at(u64::MAX, &mut b).is_err());
-        let r = ReadSeekSource::new(io::Cursor::new(v.clone())).unwrap();
-        assert_eq!(r.len(), 4);
-        r.read_at(2, &mut b).unwrap();
-        assert_eq!(b, [3, 4]);
-        r.read_at(0, &mut b).unwrap();
-        assert_eq!(b, [1, 2]);
-        assert!(r.read_at(3, &mut b).is_err());
-    }
-}
diff --git a/crates/matroska/src/synthetic_tests.rs b/crates/matroska/src/synthetic_tests.rs
deleted file mode 100644
index f10df3ba8..000000000
--- a/crates/matroska/src/synthetic_tests.rs
+++ /dev/null
@@ -1,210 +0,0 @@
-//! Hand-built files exercising features FFmpeg does not write: unknown-size Segment/Clusters,
-//! header stripping, BlockGroups, Colour + mastering metadata, Chapters, Tags, Attachments, CRC-32.
-
-use crate::codec::Codec;
-use crate::ebml::{self, write_id, write_unknown_size};
-use crate::ids::*;
-use crate::mux::{el, el_float, el_str, el_uint};
-use crate::track::ContentEncoding;
-use crate::{Demuxer, OpenOptions, Packet, open_with};
-
-fn block(track: u8, rel: i16, flags: u8, data: &[u8]) -> Vec<u8> {
-    let mut b = vec![0x80 | track];
-    b.extend_from_slice(&rel.to_be_bytes());
-    b.push(flags);
-    b.extend_from_slice(data);
-    b
-}
-
-fn synthetic() -> Vec<u8> {
-    let mut f = Vec::new();
-    let mut h = Vec::new();
-    el_str(&mut h, DOC_TYPE, "matroska");
-    el_uint(&mut h, DOC_TYPE_VERSION, 4);
-    el(&mut f, EBML, &h);
-    write_id(&mut f, SEGMENT);
-    write_unknown_size(&mut f, 8);
-    // Info with a correct CRC-32 and a Void
-    let mut info = Vec::new();
-    el_uint(&mut info, TIMESTAMP_SCALE, 1_000_000);
-    el_str(&mut info, TITLE, "Synthetic");
-    el(&mut info, VOID, &[0; 3]);
-    let mut crc_info = Vec::new();
-    el(&mut crc_info, CRC32, &ebml::crc32(&info).to_le_bytes());
-    crc_info.extend_from_slice(&info);
-    el(&mut f, INFO, &crc_info);
-    // Tracks
-    let mut v = Vec::new();
-    el_uint(&mut v, TRACK_NUMBER, 1);
-    el_uint(&mut v, TRACK_UID, 11);
-    el_uint(&mut v, TRACK_TYPE, 1);
-    el_str(&mut v, CODEC_ID, "V_MPEG4/ISO/AVC");
-    el(&mut v, CODEC_PRIVATE, &[1, 0x64, 0, 0x1F]);
-    el_uint(&mut v, DEFAULT_DURATION, 40_000_000);
-    let mut mm = Vec::new();
-    for (id, val) in [(PRIMARY_R_X, 0.708), (PRIMARY_R_Y, 0.292), (PRIMARY_G_X, 0.17), (PRIMARY_G_Y, 0.797), (PRIMARY_B_X, 0.131), (PRIMARY_B_Y, 0.046)] {
-        el_float(&mut mm, id, val);
-    }
-    el_float(&mut mm, WHITE_POINT_X, 0.3127);
-    el_float(&mut mm, WHITE_POINT_Y, 0.329);
-    el_float(&mut mm, LUMINANCE_MAX, 1000.0);
-    el_float(&mut mm, LUMINANCE_MIN, 0.0001);
-    let mut col = Vec::new();
-    el_uint(&mut col, MATRIX_COEFFICIENTS, 9);
-    el_uint(&mut col, RANGE, 2);
-    el_uint(&mut col, TRANSFER_CHARACTERISTICS, 16);
-    el_uint(&mut col, PRIMARIES, 9);
-    el_uint(&mut col, MAX_CLL, 1000);
-    el_uint(&mut col, MAX_FALL, 400);
-    el(&mut col, MASTERING_METADATA, &mm);
-    let mut vid = Vec::new();
-    el_uint(&mut vid, PIXEL_WIDTH, 1440);
-    el_uint(&mut vid, PIXEL_HEIGHT, 1080);
-    el_uint(&mut vid, DISPLAY_WIDTH, 1920);
-    el_uint(&mut vid, DISPLAY_HEIGHT, 1080);
-    el(&mut vid, COLOUR, &col);
-    // rectangular, a quarter turn clockwise (portrait phone video)
-    let mut proj = Vec::new();
-    el_uint(&mut proj, PROJECTION_TYPE, 0);
-    el_float(&mut proj, PROJECTION_POSE_ROLL, -90.0);
-    el(&mut vid, PROJECTION, &proj);
-    el(&mut v, VIDEO, &vid);
-    // header stripping: every frame starts with 00 00 00 01
-    let mut comp = Vec::new();
-    el_uint(&mut comp, CONTENT_COMP_ALGO, 3);
-    el(&mut comp, CONTENT_COMP_SETTINGS, &[0, 0, 0, 1]);
-    let mut enc = Vec::new();
-    el(&mut enc, CONTENT_COMPRESSION, &comp);
-    let mut encs = Vec::new();
-    el(&mut encs, CONTENT_ENCODING, &enc);
-    el(&mut v, CONTENT_ENCODINGS, &encs);
-    let mut a = Vec::new();
-    el_uint(&mut a, TRACK_NUMBER, 2);
-    el_uint(&mut a, TRACK_TYPE, 2);
-    el_str(&mut a, CODEC_ID, "A_AAC/MPEG4/LC/SBR");
-    el_str(&mut a, LANGUAGE, "ger");
-    let mut au = Vec::new();
-    el_float(&mut au, SAMPLING_FREQUENCY, 24000.0);
-    el_float(&mut au, OUTPUT_SAMPLING_FREQUENCY, 48000.0);
-    el_uint(&mut au, CHANNELS, 2);
-    el(&mut a, AUDIO, &au);
-    let mut tr = Vec::new();
-    el(&mut tr, TRACK_ENTRY, &v);
-    el(&mut tr, TRACK_ENTRY, &a);
-    el(&mut f, TRACKS, &tr);
-    // Chapters
-    let mut disp = Vec::new();
-    el_str(&mut disp, CHAP_STRING, "Intro");
-    let mut atom = Vec::new();
-    el_uint(&mut atom, CHAPTER_UID, 5);
-    el_uint(&mut atom, CHAPTER_TIME_START, 0);
-    el_uint(&mut atom, CHAPTER_TIME_END, 40_000_000);
-    el(&mut atom, CHAPTER_DISPLAY, &disp);
-    let mut ed = Vec::new();
-    el(&mut ed, CHAPTER_ATOM, &atom);
-    let mut ch = Vec::new();
-    el(&mut ch, EDITION_ENTRY, &ed);
-    el(&mut f, CHAPTERS, &ch);
-    // Attachments
-    let mut af = Vec::new();
-    el_str(&mut af, FILE_NAME, "font.ttf");
-    el_str(&mut af, FILE_MEDIA_TYPE, "font/ttf");
-    el_uint(&mut af, FILE_UID, 77);
-    el(&mut af, FILE_DATA, &[9; 100]);
-    let mut att = Vec::new();
-    el(&mut att, ATTACHED_FILE, &af);
-    el(&mut f, ATTACHMENTS, &att);
-    // Cluster 1 (unknown size): keyframe SimpleBlock, BlockGroup with ReferenceBlock + duration
-    write_id(&mut f, CLUSTER);
-    write_unknown_size(&mut f, 1);
-    el_uint(&mut f, TIMESTAMP, 1000);
-    el(&mut f, SIMPLE_BLOCK, &block(1, 0, 0x80, &[0x65, 1, 2]));
-    el(&mut f, SIMPLE_BLOCK, &block(2, 5, 0x80, &[0xAA; 10]));
-    let mut g = Vec::new();
-    el(&mut g, BLOCK, &block(1, 40, 0, &[0x41, 3]));
-    el(&mut g, REFERENCE_BLOCK, &[0xD8]);
-    el_uint(&mut g, BLOCK_DURATION, 80);
-    el(&mut f, BLOCK_GROUP, &g);
-    el(&mut f, SIMPLE_BLOCK, &block(9, 0, 0x80, &[1])); // unknown track: ignored
-    // Cluster 2 (unknown size), ended by Tags
-    write_id(&mut f, CLUSTER);
-    write_unknown_size(&mut f, 8);
-    el_uint(&mut f, TIMESTAMP, 1120);
-    el(&mut f, SIMPLE_BLOCK, &block(1, 0, 0x80, &[0x65, 4]));
-    let mut st = Vec::new();
-    el_str(&mut st, TAG_NAME, "ARTIST");
-    el_str(&mut st, TAG_STRING, "Nobody");
-    let mut tg = Vec::new();
-    let mut tgt = Vec::new();
-    el_uint(&mut tgt, TAG_TRACK_UID, 11);
-    el(&mut tg, TARGETS, &tgt);
-    el(&mut tg, SIMPLE_TAG, &st);
-    let mut tags = Vec::new();
-    el(&mut tags, TAG, &tg);
-    el(&mut f, TAGS, &tags);
-    f
-}
-
-#[test]
-fn synthetic_file() {
-    let bytes = synthetic();
-    let f = open_with(&bytes[..], &OpenOptions { index: true, verify_crc: true }).unwrap();
-    assert!(f.live);
-    assert!(f.warnings.is_empty(), "{:?}", f.warnings);
-    assert_eq!((f.crc_checked, f.crc_errors.len()), (1, 0));
-    assert_eq!(f.info.title.as_deref(), Some("Synthetic"));
-    let v = &f.tracks[0];
-    assert!(matches!(&v.codec, Codec::Avc { avcc } if avcc[1] == 0x64));
-    let vi = v.video.as_ref().unwrap();
-    assert_eq!(vi.pixel_aspect(), (4, 3));
-    assert_eq!(vi.projection.as_ref().map(|p| p.roll), Some(-90.0));
-    assert_eq!(vi.display_rotation(), Some(1));
-    let c = vi.colour.as_ref().unwrap();
-    assert!(c.full_range());
-    assert_eq!((c.matrix_coefficients, c.transfer_characteristics, c.primaries, c.max_cll, c.max_fall), (Some(9), Some(16), Some(9), Some(1000), Some(400)));
-    let m = c.mastering.as_ref().unwrap();
-    assert_eq!(m.primaries[1], (0.17, 0.797));
-    assert_eq!(m.white_point, (0.3127, 0.329));
-    assert_eq!((m.luminance_max, m.luminance_min), (1000.0, 0.0001));
-    assert_eq!(v.encodings, vec![ContentEncoding::HeaderStripping { bytes: vec![0, 0, 0, 1], scope: 1 }]);
-    // legacy AAC ID: ASC synthesised with explicit SBR signalling (LC, 24 kHz, stereo → 48 kHz)
-    assert_eq!(f.tracks[1].codec, Codec::Aac { asc: vec![0x13, 0x10, 0x56, 0xE5, 0x98] });
-    assert_eq!(f.tracks[1].language, "ger");
-    assert_eq!(f.chapters[0].chapters[0].title(), Some("Intro"));
-    assert_eq!(f.chapters[0].chapters[0].end_ns, Some(40_000_000));
-    assert_eq!(f.attachments.len(), 1);
-    let at = &f.attachments[0];
-    assert_eq!((at.name.as_str(), at.media_type.as_str(), at.uid), ("font.ttf", "font/ttf", 77));
-    assert_eq!(&bytes[at.data_offset as usize..][..100], &[9; 100]);
-    assert_eq!(f.tags[0].targets.track_uids, vec![11]);
-    assert_eq!(f.tags[0].simple[0].string.as_deref(), Some("Nobody"));
-    assert_eq!(f.clusters.len(), 2);
-    assert_eq!(v.samples.len(), 3);
-    assert_eq!(v.keyframes(), &[0, 2]);
-
-    let d = Demuxer::from_slice(&bytes).unwrap();
-    let p: Vec<Packet> = d.map(|p| p.unwrap()).collect();
-    assert_eq!(p.len(), 4);
-    assert_eq!((p[0].track, p[0].pts, p[0].keyframe, p[0].duration), (0, 1000, true, 40));
-    assert_eq!(p[0].data, [0, 0, 0, 1, 0x65, 1, 2]);
-    assert_eq!((p[1].track, p[1].pts, p[1].data.len()), (1, 1005, 10));
-    assert_eq!((p[2].pts, p[2].keyframe, p[2].duration), (1040, false, 80));
-    assert_eq!(p[2].data, [0, 0, 0, 1, 0x41, 3]);
-    assert_eq!((p[3].pts, p[3].pts_ns), (1120, 1_120_000_000));
-    assert_eq!(f.read_sample(&bytes[..], 0, 1).unwrap(), p[2].data);
-
-    // CRC mismatch is reported, not fatal
-    let mut bad = bytes.clone();
-    let title = bad.windows(9).position(|w| w == b"Synthetic").unwrap();
-    bad[title] = b's';
-    let f = open_with(&bad[..], &OpenOptions { index: true, verify_crc: true }).unwrap();
-    assert_eq!(f.crc_errors.len(), 1);
-
-    // seeking without index or cues builds the index
-    let mut d = Demuxer::with_options(&bytes[..], OpenOptions { index: false, verify_crc: false }).unwrap();
-    assert_eq!(d.file().tracks.len(), 2);
-    assert_eq!(d.seek(0, 1_100_000_000).unwrap().pts, 1000);
-    assert_eq!(d.seek(0, 1_130_000_000).unwrap().pts, 1120);
-    assert_eq!(d.next_packet().unwrap().unwrap().pts, 1120);
-    assert!(d.file().indexed);
-}
diff --git a/crates/matroska/src/track.rs b/crates/matroska/src/track.rs
deleted file mode 100644
index ecdecabe8..000000000
--- a/crates/matroska/src/track.rs
+++ /dev/null
@@ -1,376 +0,0 @@
-//! Track descriptions (RFC 9559 §5.1.4).
-
-use crate::codec::Codec;
-
-/// Track type (`TrackType`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum TrackKind {
-    Video,
-    Audio,
-    Complex,
-    Logo,
-    Subtitle,
-    Buttons,
-    Control,
-    Metadata,
-    Other(u8),
-}
-
-impl TrackKind {
-    pub(crate) fn from_type(t: u64) -> TrackKind {
-        match t {
-            1 => TrackKind::Video,
-            2 => TrackKind::Audio,
-            3 => TrackKind::Complex,
-            0x10 => TrackKind::Logo,
-            0x11 => TrackKind::Subtitle,
-            0x12 => TrackKind::Buttons,
-            0x20 => TrackKind::Control,
-            0x21 => TrackKind::Metadata,
-            n => TrackKind::Other(n as u8),
-        }
-    }
-}
-
-/// SMPTE ST 2086 mastering display metadata (`MasteringMetadata`). Chromaticities are CIE 1931 xy,
-/// luminance in cd/m².
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct MasteringMetadata {
-    /// Red, green, blue primaries as (x, y).
-    pub primaries: [(f64, f64); 3],
-    pub white_point: (f64, f64),
-    pub luminance_max: f64,
-    pub luminance_min: f64,
-}
-
-/// `Colour` element. Code points use ITU-T H.273 values (as Matroska does).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Colour {
-    /// `MatrixCoefficients` (H.273; 2 = unspecified).
-    pub matrix_coefficients: Option<u64>,
-    pub bits_per_channel: Option<u64>,
-    pub chroma_subsampling_horz: Option<u64>,
-    pub chroma_subsampling_vert: Option<u64>,
-    pub cb_subsampling_horz: Option<u64>,
-    pub cb_subsampling_vert: Option<u64>,
-    pub chroma_siting_horz: Option<u64>,
-    pub chroma_siting_vert: Option<u64>,
-    /// `Range`: 0 unspecified, 1 broadcast (limited), 2 full, 3 defined by matrix/transfer.
-    pub range: Option<u64>,
-    /// `TransferCharacteristics` (H.273).
-    pub transfer_characteristics: Option<u64>,
-    /// `Primaries` (H.273).
-    pub primaries: Option<u64>,
-    /// Maximum content light level (cd/m²).
-    pub max_cll: Option<u64>,
-    /// Maximum frame-average light level (cd/m²).
-    pub max_fall: Option<u64>,
-    pub mastering: Option<MasteringMetadata>,
-}
-
-impl Colour {
-    /// True if `Range` says full range.
-    pub fn full_range(&self) -> bool {
-        self.range == Some(2)
-    }
-}
-
-/// `Video` element.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct VideoInfo {
-    pub pixel_width: u32,
-    pub pixel_height: u32,
-    /// `DisplayWidth`/`DisplayHeight`, in `display_unit` (0 = pixels, 3 = display aspect ratio).
-    pub display_width: Option<u32>,
-    pub display_height: Option<u32>,
-    pub display_unit: u64,
-    /// Crop (top, bottom, left, right) in pixels.
-    pub crop: (u32, u32, u32, u32),
-    /// `FlagInterlaced`: 0 undetermined, 1 interlaced, 2 progressive.
-    pub flag_interlaced: u64,
-    /// `FieldOrder` (0 progressive, 1 tff, 2 undetermined, 6 bff, 9/14 interleaved).
-    pub field_order: Option<u64>,
-    pub stereo_mode: Option<u64>,
-    /// `AlphaMode`: 1 if BlockAdditions carry alpha.
-    pub alpha_mode: u64,
-    /// `ColourSpace` FourCC (uncompressed video).
-    pub colour_space: Option<[u8; 4]>,
-    pub colour: Option<Colour>,
-    pub projection: Option<Projection>,
-}
-
-/// `Projection` element (RFC 9559 §5.1.4.1.28.41): pose angles in degrees.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Projection {
-    /// 0 rectangular, 1 equirectangular, 2 cubemap, 3 mesh.
-    pub projection_type: u64,
-    /// Clockwise around the up vector.
-    pub yaw: f64,
-    /// Counter-clockwise around the right vector.
-    pub pitch: f64,
-    /// Counter-clockwise around the forward vector.
-    pub roll: f64,
-}
-
-impl VideoInfo {
-    /// Clockwise quarter turns (0–3) to display a rectangular video, from `ProjectionPoseRoll`
-    /// (a counter-clockwise angle, so −90 is a quarter turn clockwise). None for other
-    /// projections, flips (non-zero yaw / pitch) or angles that are not a multiple of 90°.
-    pub fn display_rotation(&self) -> Option<u8> {
-        let Some(p) = &self.projection else { return Some(0) };
-        if p.projection_type != 0 || p.yaw != 0.0 || p.pitch != 0.0 || p.roll % 90.0 != 0.0 {
-            return None;
-        }
-        Some((-(p.roll / 90.0) as i64).rem_euclid(4) as u8)
-    }
-
-    /// Pixel aspect ratio derived from the display size (pixels or aspect-ratio units), reduced.
-    pub fn pixel_aspect(&self) -> (u32, u32) {
-        let pw = self.pixel_width.saturating_sub(self.crop.2.saturating_add(self.crop.3)) as u64;
-        let ph = self.pixel_height.saturating_sub(self.crop.0.saturating_add(self.crop.1)) as u64;
-        let (Some(dw), Some(dh)) = (self.display_width, self.display_height) else { return (1, 1) };
-        if pw == 0 || ph == 0 || dw == 0 || dh == 0 || !matches!(self.display_unit, 0 | 3) {
-            return (1, 1);
-        }
-        // PAR = (dw/dh) / (pw/ph)
-        let (n, d) = (dw as u64 * ph, dh as u64 * pw);
-        let g = gcd(n, d);
-        ((n / g) as u32, (d / g) as u32)
-    }
-}
-
-pub(crate) fn gcd(mut a: u64, mut b: u64) -> u64 {
-    while b != 0 {
-        (a, b) = (b, a % b);
-    }
-    a.max(1)
-}
-
-/// `Audio` element.
-#[derive(Clone, Debug, PartialEq)]
-pub struct AudioInfo {
-    /// `SamplingFrequency` (Hz).
-    pub sampling_frequency: f64,
-    /// `OutputSamplingFrequency` (e.g. SBR output rate).
-    pub output_sampling_frequency: Option<f64>,
-    pub channels: u64,
-    pub bit_depth: Option<u64>,
-}
-
-impl Default for AudioInfo {
-    fn default() -> Self {
-        Self { sampling_frequency: 8000.0, output_sampling_frequency: None, channels: 1, bit_depth: None }
-    }
-}
-
-/// One `ContentEncoding`.
-#[derive(Clone, Debug, PartialEq)]
-pub enum ContentEncoding {
-    /// `ContentCompAlgo` 3: the given bytes were stripped from the start of every frame.
-    HeaderStripping { bytes: Vec<u8>, scope: u64 },
-    /// Other compression (0 zlib, 1 bzlib, 2 lzo1x): not supported for reading frame data.
-    Compression { algo: u64, settings: Vec<u8>, scope: u64 },
-    /// Encryption (not supported for reading frame data).
-    Encryption { scope: u64 },
-}
-
-/// One entry of a track's sample (frame) table.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Sample {
-    /// Byte offset of the (stored) frame data in the file.
-    pub offset: u64,
-    /// Stored size (excluding header-stripped bytes; see [`Track::sample_size`]).
-    pub size: u32,
-    /// Presentation timestamp in the track timebase (`TimestampScale` ticks).
-    pub pts: i64,
-    /// Duration in timebase ticks (from `BlockDuration` or `DefaultDuration`), 0 if unknown.
-    pub duration: u64,
-    pub keyframe: bool,
-    /// Index of the owning cluster in [`crate::MkvFile::clusters`].
-    pub cluster: u32,
-    /// Offset of the block element (SimpleBlock / BlockGroup) header.
-    pub block_offset: u64,
-    /// Index of this frame within a laced block.
-    pub lace: u16,
-    /// (offset, size) of the block's `BlockAdditional` with `BlockAddID` 1, when it has one and
-    /// is not laced. In WebM this is the alpha layer of a VP8/VP9 track with `AlphaMode` 1: a
-    /// second, independently coded stream whose luma plane is the frame's alpha.
-    pub addition: Option<(u64, u32)>,
-}
-
-/// A Matroska track (`TrackEntry`) plus, once indexed, its sample table.
-#[derive(Clone, Debug)]
-pub struct Track {
-    pub number: u64,
-    pub uid: u64,
-    pub kind: TrackKind,
-    pub enabled: bool,
-    pub default: bool,
-    pub forced: bool,
-    pub hearing_impaired: bool,
-    pub lacing: bool,
-    /// `DefaultDuration` in nanoseconds.
-    pub default_duration_ns: Option<u64>,
-    pub name: String,
-    /// `Language` (ISO 639-2, default `eng`).
-    pub language: String,
-    pub language_bcp47: Option<String>,
-    pub codec_id: String,
-    pub codec_private: Vec<u8>,
-    pub codec_name: String,
-    pub codec: Codec,
-    /// `CodecDelay` in nanoseconds.
-    pub codec_delay_ns: u64,
-    /// `SeekPreRoll` in nanoseconds.
-    pub seek_pre_roll_ns: u64,
-    pub video: Option<VideoInfo>,
-    pub audio: Option<AudioInfo>,
-    pub encodings: Vec<ContentEncoding>,
-    /// Timebase numerator/denominator in seconds: `TimestampScale / 1e9`, reduced.
-    pub timebase: (u64, u64),
-    /// Frame table (empty unless the file was opened with indexing).
-    pub samples: Vec<Sample>,
-    pub(crate) sync: Vec<u32>,
-}
-
-impl Track {
-    /// Bytes prepended to every frame by header-stripping compression, if any.
-    pub fn stripped_header(&self) -> Option<&[u8]> {
-        self.encodings.iter().find_map(|e| match e {
-            ContentEncoding::HeaderStripping { bytes, scope } if scope & 1 != 0 => Some(bytes.as_slice()),
-            _ => None,
-        })
-    }
-
-    /// True if frames can be returned verbatim or with header stripping undone.
-    pub fn frames_readable(&self) -> bool {
-        self.encodings.iter().all(|e| match e {
-            ContentEncoding::HeaderStripping { .. } => true,
-            ContentEncoding::Compression { scope, .. } | ContentEncoding::Encryption { scope } => scope & 1 == 0,
-        })
-    }
-
-    /// Bytes to put in front of a stored frame of `stored_size` bytes to get the codec frame:
-    /// header-stripped bytes, or for `V_PRORES` the 8-byte frame header (`size` + `icpf`) that the
-    /// Matroska ProRes mapping omits.
-    pub fn frame_prefix(&self, stored_size: u64) -> Vec<u8> {
-        let mut p = self.stripped_header().map(<[u8]>::to_vec).unwrap_or_default();
-        if matches!(self.codec, Codec::ProRes { .. }) {
-            let total = stored_size + p.len() as u64 + 8;
-            let mut h = (total as u32).to_be_bytes().to_vec();
-            h.extend_from_slice(b"icpf");
-            h.extend_from_slice(&p);
-            p = h;
-        }
-        p
-    }
-
-    /// Frame size of sample `i` as returned by `read_sample` / packets (stored size plus prefix).
-    pub fn sample_size(&self, i: usize) -> Option<u64> {
-        let s = self.samples.get(i)?;
-        Some(s.size as u64 + self.frame_prefix(s.size as u64).len() as u64)
-    }
-
-    /// Indices of keyframe samples, ascending by file order.
-    pub fn keyframes(&self) -> &[u32] {
-        &self.sync
-    }
-
-    /// Timebase ticks → nanoseconds.
-    pub fn ticks_to_ns(&self, t: i64) -> i64 {
-        (t as i128 * self.timebase.0 as i128 * 1_000_000_000 / self.timebase.1 as i128) as i64
-    }
-
-    /// Nanoseconds → timebase ticks (floor).
-    pub fn ns_to_ticks(&self, ns: i64) -> i64 {
-        let n = ns as i128 * self.timebase.1 as i128;
-        let d = self.timebase.0 as i128 * 1_000_000_000;
-        n.div_euclid(d) as i64
-    }
-
-    /// Index of the last sample with `pts <= t` (in file order), or the first sample.
-    pub fn sample_at_pts(&self, t: i64) -> Option<usize> {
-        if self.samples.is_empty() {
-            return None;
-        }
-        let mut best: Option<usize> = None;
-        for (i, s) in self.samples.iter().enumerate() {
-            if s.pts <= t && best.is_none_or(|b| s.pts >= self.samples[b].pts) {
-                best = Some(i);
-            }
-        }
-        Some(best.unwrap_or(0))
-    }
-
-    /// Index of the keyframe with the greatest `pts <= t` (the first keyframe if none precedes `t`).
-    pub fn keyframe_before_pts(&self, t: i64) -> Option<usize> {
-        let mut best: Option<usize> = None;
-        for &k in &self.sync {
-            let s = &self.samples[k as usize];
-            if s.pts <= t && best.is_none_or(|b| s.pts >= self.samples[b].pts) {
-                best = Some(k as usize);
-            }
-        }
-        best.or_else(|| self.sync.first().map(|&k| k as usize))
-    }
-
-    /// Index of the nearest keyframe at or before sample `index` in file order.
-    pub fn sync_sample_before(&self, index: usize) -> usize {
-        match self.sync.binary_search(&(index as u32)) {
-            Ok(i) => self.sync[i] as usize,
-            Err(0) => 0,
-            Err(i) => self.sync[i - 1] as usize,
-        }
-    }
-}
-
-#[cfg(test)]
-mod rotation_tests {
-    use super::{Projection, VideoInfo};
-
-    fn with_roll(projection_type: u64, yaw: f64, pitch: f64, roll: f64) -> VideoInfo {
-        VideoInfo { projection: Some(Projection { projection_type, yaw, pitch, roll }), ..Default::default() }
-    }
-
-    #[test]
-    fn display_rotation_maps_rectangular_roll_to_clockwise_quarter_turns() {
-        assert_eq!(VideoInfo::default().display_rotation(), Some(0), "no Projection: as stored");
-        // ProjectionPoseRoll is counter-clockwise: -90 is a quarter turn clockwise
-        for (roll, turns) in [(0.0, 0), (-90.0, 1), (180.0, 2), (-180.0, 2), (90.0, 3), (-270.0, 3), (270.0, 1), (360.0, 0)] {
-            assert_eq!(with_roll(0, 0.0, 0.0, roll).display_rotation(), Some(turns), "roll {roll}");
-        }
-    }
-
-    #[test]
-    fn display_rotation_leaves_non_rectangular_flipped_and_odd_angles_alone() {
-        assert_eq!(with_roll(1, 0.0, 0.0, -90.0).display_rotation(), None, "equirectangular");
-        assert_eq!(with_roll(0, 180.0, 0.0, 0.0).display_rotation(), None, "yaw flip");
-        assert_eq!(with_roll(0, 0.0, 180.0, 0.0).display_rotation(), None, "pitch flip");
-        assert_eq!(with_roll(0, 0.0, 0.0, 45.0).display_rotation(), None, "not a quarter turn");
-        assert_eq!(with_roll(0, 0.0, 0.0, f64::NAN).display_rotation(), None, "malformed angle");
-    }
-}
-
-#[cfg(test)]
-mod aspect_overflow_tests {
-    use super::VideoInfo;
-
-    #[test]
-    fn hostile_crop_sums_do_not_overflow() {
-        let video = VideoInfo {
-            pixel_width: 640,
-            pixel_height: 480,
-            display_width: Some(640),
-            display_height: Some(480),
-            crop: (u32::MAX, 1, u32::MAX, 1),
-            ..Default::default()
-        };
-        assert_eq!(video.pixel_aspect(), (1, 1));
-    }
-
-    #[test]
-    fn ordinary_pixel_aspect_is_unchanged() {
-        let video = VideoInfo { pixel_width: 1920, pixel_height: 1080, display_width: Some(1440), display_height: Some(1080), ..Default::default() };
-        assert_eq!(video.pixel_aspect(), (3, 4));
-    }
-}
diff --git a/crates/matroska/tests/oracle.rs b/crates/matroska/tests/oracle.rs
index 5eaae0a03..f53b09978 100644
--- a/crates/matroska/tests/oracle.rs
+++ b/crates/matroska/tests/oracle.rs
@@ -58,8 +58,14 @@ fn compare(ffprobe: &Path, path: &Path) -> (MkvFile, Vec<Packet>) {
             assert!((pts - p.pts).abs() <= p.lace as i64, "{ctx}: pts ffprobe {pts} vs {}", p.pts);
             pts_checked += 1;
         }
+        // The last audio or video frame of a track cut by `-t` is shorter than a codec frame.
+        // ffmpeg 8 writes a shortened BlockDuration there and reports the codec frame duration; a
+        // remux by our writer stores DefaultDuration and ffprobe reports the shortened one. So
+        // that frame's duration is not compared. A subtitle's duration is its cue's, and is.
+        let last_of_track = packets[i + 1..].iter().all(|q| q.track != p.track);
         if let Some(dur) = int(&f["duration"])
             && p.duration != 0
+            && (!last_of_track || file.tracks[p.track].kind == TrackKind::Subtitle)
         {
             assert!((dur - p.duration as i64).abs() <= 1, "{ctx}: duration ffprobe {dur} vs {}", p.duration);
             dur_checked += 1;
@@ -226,11 +232,11 @@ fn live_stream_without_cues() {
 }
 
 #[test]
-fn hevc_hdr_colour() {
+fn hevc_hdr_color() {
     let Some((_, f, _)) = run("hevc_hdr.mkv") else { return };
     let t = &f.tracks[0];
     assert!(matches!(&t.codec, Codec::Hevc { hvcc } if hvcc.first() == Some(&1)));
-    let c = t.video.as_ref().unwrap().colour.as_ref().expect("Colour element");
+    let c = t.video.as_ref().unwrap().color.as_ref().expect("Colour element");
     assert_eq!(c.primaries, Some(9));
     assert_eq!(c.transfer_characteristics, Some(16));
     assert_eq!(c.matrix_coefficients, Some(9));
@@ -286,12 +292,14 @@ fn laced_remux() {
             let specs: Vec<TrackSpec> = file
                 .tracks
                 .iter()
-                .map(|t| {
+                .enumerate()
+                .map(|(ti, t)| {
                     let mut s = TrackSpec::new(t.kind, t.codec_id.clone());
                     s.codec_private = t.codec_private.clone();
+                    // audio without a DefaultDuration gets its mean packet spacing, so it can lace
                     s.default_duration_ns = t.default_duration_ns.or_else(|| {
-                        // give AAC a DefaultDuration so every lace gets a timestamp
-                        matches!(t.codec, Codec::Aac { .. }).then(|| (1024.0 * 1e9 / t.audio.as_ref().unwrap().sampling_frequency) as u64)
+                        let pts: Vec<i64> = packets.iter().filter(|p| p.track == ti).map(|p| p.pts_ns).collect();
+                        (t.kind == TrackKind::Audio && pts.len() > 1).then(|| ((pts[pts.len() - 1] - pts[0]) / (pts.len() as i64 - 1)) as u64)
                     });
                     s.video_size = t.video.as_ref().map(|v| (v.pixel_width, v.pixel_height));
                     s.audio = t.audio.as_ref().map(|a| (a.sampling_frequency, a.channels, a.bit_depth));
@@ -316,7 +324,7 @@ fn laced_remux() {
             assert_eq!(got.len(), packets.len());
             for (a, b) in got.iter().zip(&packets) {
                 assert_eq!(a.data, b.data, "{src} {mode:?}: payload");
-                assert_eq!(a.track, b.track);
+                assert_eq!((a.track, a.pts), (b.track, b.pts), "{src} {mode:?}: timestamp");
             }
             std::fs::remove_file(&outp).unwrap();
         }
diff --git a/crates/media/examples/demo_frames.rs b/crates/media/examples/demo_frames.rs
index 1d1b4a24e..697f8b234 100644
--- a/crates/media/examples/demo_frames.rs
+++ b/crates/media/examples/demo_frames.rs
@@ -12,7 +12,7 @@ fn main() {
     let rows = gens.len().div_ceil(cols);
     let mut sheet = image::RgbaImage::new(w * cols as u32, h * rows as u32);
     for (i, g) in gens.iter().enumerate() {
-        let px = render(g, w, h, 3.3, 79, FrameRate::FPS_23_976);
+        let px = render(g, w, h, 3.3, 79, FrameRate::FPS_23_976).unwrap();
         let img = image::RgbaImage::from_raw(w, h, px).unwrap();
         image::imageops::overlay(&mut sheet, &img, ((i % cols) as u32 * w) as i64, ((i / cols) as u32 * h) as i64);
     }
diff --git a/crates/media/src/animated.rs b/crates/media/src/animated.rs
index e20188a14..b327b89ed 100644
--- a/crates/media/src/animated.rs
+++ b/crates/media/src/animated.rs
@@ -1,11 +1,11 @@
-//! Animated images (APNG and animated GIF) as movie clips (#402).
+//! Animated images (APNG, animated GIF, and animated WebP) as movie clips (#402).
 //!
 //! The still decoders read only the first picture of these files. [`open`] decodes every frame
 //! instead, composited onto the full canvas by the `image` crate (APNG blend and dispose operations,
-//! GIF disposal methods), and keeps them with their timing:
+//! GIF and WebP disposal methods), and keeps them with their timing:
 //!
-//! - each frame lasts its own delay; GIF delays of 10 ms or less play as 100 ms and APNG delays
-//!   under 10 ms as 10 ms, as browsers do, so a zero delay never makes a zero-length frame;
+//! - each frame lasts its own delay; GIF delays of 10 ms or less play as 100 ms and APNG and WebP
+//!   delays under 10 ms as 10 ms, as browsers do, so a zero delay never makes a zero-length frame;
 //! - consecutive identical frames are merged (one picture, the sum of their delays);
 //! - the clip is one pass through the animation (the file's loop count is not applied);
 //! - transparency is kept: the source reports alpha when any frame has a pixel that is not fully
@@ -31,29 +31,37 @@ use crate::{FrameRequest, MediaError, MediaInfo, MediaKind, MediaSource, Result,
 pub const MAX_FRAMES: usize = 10_000;
 /// Most bytes of decoded RGBA pictures kept from one file (after merging identical frames).
 pub const MAX_DECODED_BYTES: usize = 1 << 30;
+/// Most RGBA bytes in one animation canvas while its decoder produces a frame.
+const MAX_DECODED_FRAME_BYTES: usize = 512 << 20;
 
 /// Animated image formats.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Format {
     Apng,
     Gif,
+    WebP,
 }
 
 impl Format {
+    /// Identify an animated image format from its container signature.
     fn sniff(b: &[u8]) -> Option<Format> {
         if b.starts_with(b"\x89PNG\r\n\x1a\n") {
             Some(Format::Apng)
         } else if b.starts_with(b"GIF87a") || b.starts_with(b"GIF89a") {
             Some(Format::Gif)
+        } else if b.get(0..4) == Some(&b"RIFF"[..]) && b.get(8..12) == Some(&b"WEBP"[..]) {
+            Some(Format::WebP)
         } else {
             None
         }
     }
 
+    /// Return the codec label shown in media metadata.
     fn codec(self) -> &'static str {
         match self {
             Format::Apng => "APNG",
             Format::Gif => "GIF",
+            Format::WebP => "WebP",
         }
     }
 
@@ -66,6 +74,7 @@ impl Format {
         let (numer, denom) = match self {
             Format::Gif if ms <= 10 => (100, 1),
             Format::Apng if ms < 10 => (10, 1),
+            Format::WebP if ms < 10 => (10, 1),
             _ => (numer, denom),
         };
         let ticks = numer.saturating_mul(TICKS_PER_SECOND as u128) / denom.saturating_mul(1000);
@@ -81,8 +90,8 @@ pub struct AnimatedSource {
     starts: Vec<Tick>,
 }
 
-/// Decode `bytes` as an animated image. `None` when it is not an APNG or GIF with at least two
-/// frames that decode (the caller then opens it as a still).
+/// Decode `bytes` as an animated image. `None` when it is not an APNG, GIF, or animated WebP with
+/// at least two frames that decode (the caller then opens it as a still).
 pub fn open(name: &str, bytes: &[u8]) -> Option<Result<AnimatedSource>> {
     let format = Format::sniff(bytes)?;
     let frames = match format {
@@ -99,19 +108,34 @@ pub fn open(name: &str, bytes: &[u8]) -> Option<Result<AnimatedSource>> {
             d.set_limits(Limits::default()).ok()?;
             d.into_frames()
         }
+        Format::WebP => {
+            let mut d = image::codecs::webp::WebPDecoder::new(Cursor::new(bytes)).ok()?;
+            if !d.has_animation() {
+                return None;
+            }
+            let (width, height) = d.dimensions();
+            if rgba_bytes(width, height).is_none_or(|bytes| bytes > MAX_DECODED_FRAME_BYTES) {
+                return Some(Err(MediaError::Unsupported(format!("{name}: animated WebP canvas exceeds the {MAX_DECODED_FRAME_BYTES}-byte frame limit"))));
+            }
+            d.set_limits(Limits::default()).ok()?;
+            d.into_frames()
+        }
     };
     AnimatedSource::from_frames(name, format, frames, bytes.len() as u64).map(Ok)
 }
 
 impl AnimatedSource {
+    /// Build a clip from decoded full-canvas frames, merging consecutive identical pictures.
     fn from_frames(name: &str, format: Format, frames: Frames<'_>, file_size: u64) -> Option<Self> {
         let mut pictures: Vec<(u32, u32, Vec<u8>)> = Vec::new();
         let mut durations: Vec<Tick> = Vec::new();
+        let mut decoded_frames = 0usize;
         let mut decoded = 0usize;
         let mut has_alpha = false;
         for frame in frames.take(MAX_FRAMES) {
             // a damaged frame ends the animation at the frames before it
             let Ok(frame) = frame else { break };
+            decoded_frames = decoded_frames.saturating_add(1);
             let ticks = format.frame_ticks(frame.delay());
             let buffer = frame.into_buffer();
             let (w, h) = buffer.dimensions();
@@ -131,7 +155,7 @@ impl AnimatedSource {
             pictures.push((w, h, rgba));
             durations.push(ticks);
         }
-        if pictures.len() < 2 {
+        if pictures.len() < 2 && !(format == Format::WebP && decoded_frames >= 2) {
             return None;
         }
         let (width, height) = pictures.first().map(|p| (p.0, p.1))?;
@@ -182,6 +206,11 @@ impl AnimatedSource {
     }
 }
 
+/// Checked byte size of an RGBA8 image.
+fn rgba_bytes(width: u32, height: u32) -> Option<usize> {
+    usize::try_from(width).ok()?.checked_mul(usize::try_from(height).ok()?)?.checked_mul(4)
+}
+
 /// The clip's frame rate: the rate of its most common frame duration, when that is a sensible video
 /// rate (1 to 120 frames per second), else 30 fps. Frames are shown for their own durations
 /// whatever this says; it sets the clip's timebase (e.g. a sequence made from the clip).
@@ -207,14 +236,17 @@ fn rate_of(durations: &[Tick]) -> FrameRate {
 }
 
 impl MediaSource for AnimatedSource {
+    /// Return the clip's media metadata.
     fn info(&self) -> &MediaInfo {
         &self.info
     }
 
+    /// Return the picture displayed at the requested media time.
     fn video_frame(&self, req: FrameRequest) -> Result<Arc<VideoFrame>> {
         self.frames.get(self.index_at(req.time)).cloned().ok_or(MediaError::NoStream("video"))
     }
 
+    /// Animated image files do not provide audio.
     fn audio(&self, _start: i64, _frames: usize, _sample_rate: u32) -> Result<AudioBuffer> {
         Err(MediaError::NoStream("audio"))
     }
diff --git a/crates/media/src/animated_tests.rs b/crates/media/src/animated_tests.rs
index be77ca879..d3db3b7de 100644
--- a/crates/media/src/animated_tests.rs
+++ b/crates/media/src/animated_tests.rs
@@ -1,5 +1,5 @@
 use super::*;
-use crate::{FrameRequest, MediaKind, open_bytes};
+use crate::{FrameRequest, MediaError, MediaKind, open_bytes};
 
 const W: u32 = 4;
 const H: u32 = 2;
@@ -51,10 +51,71 @@ fn gif(frames: &[(Vec<u8>, u32)]) -> Vec<u8> {
     out
 }
 
+/// A small animated WebP built from lossless WebP frame bitstreams.
+fn webp(frames: &[(Vec<u8>, u32)]) -> Vec<u8> {
+    fn chunk(out: &mut Vec<u8>, kind: &[u8; 4], data: &[u8]) {
+        out.extend_from_slice(kind);
+        out.extend_from_slice(&u32::try_from(data.len()).unwrap().to_le_bytes());
+        out.extend_from_slice(data);
+        if !data.len().is_multiple_of(2) {
+            out.push(0);
+        }
+    }
+
+    fn u24(out: &mut [u8], value: u32) {
+        out[0] = value as u8;
+        out[1] = (value >> 8) as u8;
+        out[2] = (value >> 16) as u8;
+    }
+
+    fn frame_chunk(pixels: &[u8], duration_ms: u32) -> Vec<u8> {
+        let mut encoded = Vec::new();
+        image::codecs::webp::WebPEncoder::new_lossless(&mut encoded).encode(pixels, W, H, image::ExtendedColorType::Rgba8).unwrap();
+
+        let mut pos = 12;
+        let bitstream = loop {
+            let header = encoded.get(pos..pos + 8).unwrap();
+            let size = u32::from_le_bytes(header[4..8].try_into().unwrap()) as usize;
+            let end = pos + 8 + size + size % 2;
+            if &header[..4] == b"VP8L" {
+                break encoded.get(pos..end).unwrap().to_vec();
+            }
+            pos = end;
+        };
+
+        let mut data = vec![0; 16];
+        u24(&mut data[6..9], W - 1);
+        u24(&mut data[9..12], H - 1);
+        u24(&mut data[12..15], duration_ms);
+        data[15] = 0x02; // replace the previous canvas instead of blending
+        data.extend_from_slice(&bitstream);
+        data
+    }
+
+    let mut chunks = Vec::new();
+    let mut extended = [0; 10];
+    extended[0] = 0x12; // alpha and animation flags
+    u24(&mut extended[4..7], W - 1);
+    u24(&mut extended[7..10], H - 1);
+    chunk(&mut chunks, b"VP8X", &extended);
+    chunk(&mut chunks, b"ANIM", &[0, 0, 0, 0, 0, 0]);
+    for (pixels, duration_ms) in frames {
+        chunk(&mut chunks, b"ANMF", &frame_chunk(pixels, *duration_ms));
+    }
+
+    let mut out = b"RIFF".to_vec();
+    out.extend_from_slice(&u32::try_from(chunks.len() + 4).unwrap().to_le_bytes());
+    out.extend_from_slice(b"WEBP");
+    out.extend_from_slice(&chunks);
+    out
+}
+
+/// Convert a whole number of milliseconds to media ticks.
 fn ms(n: i64) -> Tick {
     Tick(n * TICKS_PER_SECOND / 1000)
 }
 
+/// Read the decoded RGBA pixels shown at a media time.
 fn pixels(s: &dyn MediaSource, t: Tick) -> Vec<u8> {
     match &s.video_frame(FrameRequest::full(t)).unwrap().data {
         filmcraft_frame::PixelData::Rgba8(p) => p.to_vec(),
@@ -111,13 +172,62 @@ fn animated_gif_plays_every_frame_with_transparency() {
     assert_eq!(&pixels(&*s, ms(40))[0..4], &[0, 255, 0, 255]);
 }
 
+#[test]
+fn animated_webp_plays_every_frame_with_timing_and_transparency() {
+    let (red, green) = (picture([255, 0, 0], 128), picture([0, 255, 0], 0));
+    let bytes = webp(&[(red.clone(), 40), (green.clone(), 60)]);
+    let s = open_bytes("wave.webp", bytes.into(), &[]).unwrap();
+    let info = s.info();
+    assert_eq!(info.kind, MediaKind::Movie);
+    assert_eq!(info.video.as_ref().unwrap().codec, "WebP");
+    assert_eq!(info.duration, ms(100));
+    assert!(info.video.as_ref().unwrap().has_alpha);
+    assert_eq!(pixels(&*s, Tick::ZERO), red);
+    assert_eq!(pixels(&*s, ms(39)), red);
+    assert_eq!(pixels(&*s, ms(40)), green);
+}
+
+#[test]
+fn identical_webp_frames_remain_a_clip_when_merged() {
+    let frame = picture([20, 40, 60], 255);
+    let bytes = webp(&[(frame.clone(), 40), (frame, 60)]);
+    let decoded = open("hold.webp", &bytes).expect("animated WebP").expect("decodes");
+    assert_eq!(decoded.frame_count(), 1, "equal pictures still merge");
+    assert_eq!(decoded.info().kind, MediaKind::Movie);
+    assert_eq!(decoded.info().duration, ms(100), "merged frames keep their encoded duration");
+
+    let imported = open_bytes("hold.webp", bytes.into(), &[]).unwrap();
+    assert_eq!(imported.info().kind, MediaKind::Movie, "the still-image fallback must not discard the duration");
+    assert_eq!(imported.info().duration, ms(100));
+}
+
+#[test]
+fn animated_webp_rejects_an_oversized_canvas_before_decoding_frames() {
+    let frame = picture([1, 2, 3], 255);
+    let mut bytes = webp(&[(frame.clone(), 40), (frame, 60)]);
+    // VP8X canvas width and height are stored as 24-bit values minus one.
+    for (offset, dimension) in [(24, 25_000u32), (27, 25_000u32)] {
+        let value = (dimension - 1).to_le_bytes();
+        bytes[offset..offset + 3].copy_from_slice(&value[..3]);
+    }
+    assert!(matches!(
+        open("large.webp", &bytes),
+        Some(Err(MediaError::Unsupported(message))) if message.contains("frame limit")
+    ));
+}
+
 #[test]
 fn single_frame_files_stay_stills() {
     let one_frame_apng = apng(&[(picture([1, 2, 3], 255), (1, 10))]);
     let one_frame_gif = gif(&[(picture([1, 2, 3], 255), 100)]);
+    let one_frame_webp = webp(&[(picture([1, 2, 3], 255), 100)]);
     let mut plain = std::io::Cursor::new(Vec::new());
     image::RgbaImage::from_raw(W, H, picture([1, 2, 3], 0)).unwrap().write_to(&mut plain, image::ImageFormat::Png).unwrap();
-    for (name, bytes) in [("one.png", one_frame_apng), ("one.gif", one_frame_gif), ("plain.png", plain.into_inner())] {
+    let mut plain_webp = Vec::new();
+    image::codecs::webp::WebPEncoder::new_lossless(&mut plain_webp).encode(&picture([1, 2, 3], 0), W, H, image::ExtendedColorType::Rgba8).unwrap();
+    for (name, bytes) in
+        [("one.png", one_frame_apng), ("one.gif", one_frame_gif), ("one.webp", one_frame_webp), ("plain.png", plain.into_inner()), ("plain.webp", plain_webp)]
+    {
         assert!(open(name, &bytes).is_none(), "{name}");
         let s = open_bytes(name, bytes.into(), &[]).unwrap();
         assert_eq!(s.info().kind, MediaKind::Still, "{name}");
@@ -129,7 +239,8 @@ fn damaged_files_never_panic() {
     let frames: Vec<_> = (0..6u8).map(|i| (picture([i * 40, 0, 255 - i * 40], i * 40), (1, 10))).collect();
     let png_bytes = apng(&frames);
     let gif_bytes = gif(&frames.iter().map(|(p, _)| (p.clone(), 100)).collect::<Vec<_>>());
-    for whole in [png_bytes, gif_bytes] {
+    let webp_bytes = webp(&frames.iter().map(|(p, _)| (p.clone(), 100)).collect::<Vec<_>>());
+    for whole in [png_bytes, gif_bytes, webp_bytes] {
         for cut in (0..whole.len()).step_by(7) {
             // truncated: opens as fewer frames, a still or an error, never a panic
             let _ = open_bytes("cut", whole[..cut].to_vec().into(), &[]);
@@ -166,6 +277,8 @@ fn frame_delays_have_browser_minimums_and_never_overflow() {
     assert_eq!(Format::Apng.frame_ticks(d(40, 1)), ms(40));
     assert_eq!(Format::Apng.frame_ticks(d(1000, 3)), Tick(TICKS_PER_SECOND / 3));
     assert!(Format::Apng.frame_ticks(d(u32::MAX, 1)).0 > 0);
+    assert_eq!(Format::WebP.frame_ticks(d(0, 1)), ms(10));
+    assert_eq!(Format::WebP.frame_ticks(d(40, 1)), ms(40));
 }
 
 #[test]
diff --git a/crates/media/src/generators.rs b/crates/media/src/generators.rs
index 97d42d1de..482652438 100644
--- a/crates/media/src/generators.rs
+++ b/crates/media/src/generators.rs
@@ -3,6 +3,9 @@
 //!
 //! Every generator is a pure function of (settings, media time, output scale): deterministic and
 //! resolution-independent, so low-resolution playback renders directly at the reduced size.
+//!
+//! Counting Leader beeps last one source frame at each second mark. Use exact audio sample
+//! positions and the rational source frame rate for the gate, without rounded timestamp boundaries.
 
 use std::f32::consts::{PI, TAU};
 use std::sync::Arc;
@@ -16,6 +19,10 @@ use serde::{Deserialize, Serialize};
 use crate::digits::{draw_text, text_width};
 use crate::{AudioStreamInfo, FrameCache, FrameRequest, MediaError, MediaInfo, MediaKind, MediaSource, Result, VideoStreamInfo};
 
+/// Generator frames are RGBA8 and cached. Keep one project-requested frame within the media
+/// working-set budget before allocating it.
+const MAX_GENERATOR_PIXELS: u64 = 1 << 25;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub enum DemoScene {
     Aurora,
@@ -150,7 +157,7 @@ impl MediaSource for GeneratorSource {
         let (w, h) = (((v.width as f32 * s).round() as u32).max(2), ((v.height as f32 * s).round() as u32).max(2));
         let t = rate.tick_of(frame).seconds() as f32;
         self.cache.get_or_insert_with((frame, bucket), || {
-            let px = render(&self.generator, w, h, t, frame, rate);
+            let px = render(&self.generator, w, h, t, frame, rate)?;
             Ok(Arc::new(VideoFrame::rgba8(w, h, px).with_pts(rate.tick_of(frame))))
         })
     }
@@ -162,13 +169,14 @@ impl MediaSource for GeneratorSource {
         let mut out = AudioBuffer::silence(sample_rate, 2, frames);
         let sr = sample_rate as f32;
         let total = self.info.duration.to_units_floor(sample_rate as i64);
+        let frame_rate = self.info.frame_rate().sane();
         for i in 0..frames {
             let n = start + i as i64;
             if n < 0 || n >= total {
                 continue;
             }
             let t = n as f32 / sr;
-            let (l, r) = audio_sample(&self.generator, t, n);
+            let (l, r) = audio_sample(&self.generator, t, n, sample_rate, frame_rate);
             out.channels[0][i] = l;
             out.channels[1][i] = r;
         }
@@ -188,7 +196,7 @@ fn hash(n: i64) -> f32 {
     (x >> 40) as f32 / (1u64 << 24) as f32 * 2.0 - 1.0
 }
 
-fn audio_sample(g: &Generator, t: f32, n: i64) -> (f32, f32) {
+fn audio_sample(g: &Generator, t: f32, n: i64, sample_rate: u32, frame_rate: FrameRate) -> (f32, f32) {
     match g {
         Generator::BarsAndTone => {
             let s = (TAU * 1000.0 * t).sin() * db(-20.0);
@@ -200,8 +208,9 @@ fn audio_sample(g: &Generator, t: f32, n: i64) -> (f32, f32) {
         }
         Generator::CountingLeader => {
             // 1 kHz beep for one frame at each second mark (the "2-pop" style beep).
-            let frac = t.fract();
-            let s = if frac < 1.0 / 24.0 { (TAU * 1000.0 * t).sin() * db(-20.0) } else { 0.0 };
+            let in_frame = sample_rate != 0
+                && i128::from(n.rem_euclid(i64::from(sample_rate))) * i128::from(frame_rate.num) < i128::from(sample_rate) * i128::from(frame_rate.den);
+            let s = if in_frame { (TAU * 1000.0 * t).sin() * db(-20.0) } else { 0.0 };
             (s, s)
         }
         Generator::Demo(scene) => demo_audio(*scene, t, n),
@@ -286,9 +295,16 @@ fn to8(c: [f32; 3]) -> [u8; 4] {
 }
 
 /// Render a generator frame as straight-alpha sRGB RGBA8.
-pub fn render(g: &Generator, w: u32, h: u32, t: f32, frame: i64, rate: FrameRate) -> Vec<u8> {
+pub fn render(g: &Generator, w: u32, h: u32, t: f32, frame: i64, rate: FrameRate) -> Result<Vec<u8>> {
+    let pixels = u64::from(w).checked_mul(u64::from(h)).ok_or_else(|| MediaError::Decode("generator frame dimensions overflow".into()))?;
+    if pixels > MAX_GENERATOR_PIXELS {
+        return Err(MediaError::Decode(format!("generator frame has {pixels} pixels; limit is {MAX_GENERATOR_PIXELS}")));
+    }
     let (wu, hu) = (w as usize, h as usize);
-    let mut px = vec![0u8; wu * hu * 4];
+    let len = wu.checked_mul(hu).and_then(|n| n.checked_mul(4)).ok_or_else(|| MediaError::Decode("generator frame byte count overflows".into()))?;
+    let mut px = Vec::new();
+    px.try_reserve_exact(len).map_err(|_| MediaError::Decode("cannot allocate generator frame".into()))?;
+    px.resize(len, 0);
     match g {
         Generator::BarsAndTone => bars(&mut px, wu, hu),
         Generator::ColorMatte { color } => {
@@ -310,7 +326,7 @@ pub fn render(g: &Generator, w: u32, h: u32, t: f32, frame: i64, rate: FrameRate
             });
         }
     }
-    px
+    Ok(px)
 }
 
 fn bars(px: &mut [u8], w: usize, h: usize) {
@@ -553,13 +569,14 @@ mod tests {
         let g = GeneratorSource::demo(DemoScene::OceanSunset);
         let a = g.video_frame(FrameRequest { time: Tick(TICKS_PER_SECOND), scale: 0.25 }).unwrap();
         assert_eq!((a.width, a.height), (480, 270));
-        let b = render(&Generator::Demo(DemoScene::OceanSunset), 480, 270, FrameRate::FPS_23_976.tick_of(23).seconds() as f32, 23, FrameRate::FPS_23_976);
+        let b =
+            render(&Generator::Demo(DemoScene::OceanSunset), 480, 270, FrameRate::FPS_23_976.tick_of(23).seconds() as f32, 23, FrameRate::FPS_23_976).unwrap();
         assert_eq!(a.to_rgba8(), b);
     }
 
     #[test]
     fn bars_values() {
-        let px = render(&Generator::BarsAndTone, 800, 600, 0.0, 0, FrameRate::FPS_25);
+        let px = render(&Generator::BarsAndTone, 800, 600, 0.0, 0, FrameRate::FPS_25).unwrap();
         // first bar after the side panel is 75% white
         let i = (10 * 800 + 150) * 4;
         assert_eq!(&px[i..i + 4], &[191, 191, 191, 255]);
@@ -569,13 +586,127 @@ mod tests {
         assert!((peak - db(-20.0)).abs() < 1e-3);
     }
 
+    #[test]
+    fn counting_leader_beeps_last_exactly_one_source_frame() {
+        let sample_rate = 48_000;
+        for rate in [FrameRate::FPS_24, FrameRate::FPS_25, FrameRate::FPS_30, FrameRate::FPS_50, FrameRate::FPS_60, FrameRate::FPS_23_976, FrameRate::FPS_29_97]
+        {
+            let source = GeneratorSource::new(Generator::CountingLeader, 64, 36, rate, Tick(3 * TICKS_PER_SECOND));
+            let carrier = GeneratorSource::new(Generator::Tone { hz: 1000.0, db: -20.0 }, 64, 36, rate, Tick(3 * TICKS_PER_SECOND));
+            let frame_samples = (sample_rate as u64 * rate.den as u64).div_ceil(rate.num as u64) as usize;
+            for start in [0, sample_rate as i64, 2 * sample_rate as i64] {
+                let audio = source.audio(start, frame_samples + 8, sample_rate).unwrap();
+                let expected = carrier.audio(start, frame_samples, sample_rate).unwrap();
+                for (channel, carrier_channel) in audio.channels.iter().zip(&expected.channels) {
+                    assert!(carrier_channel.iter().any(|s| s.abs() > 0.05), "{rate:?}, start {start}: carrier should be audible");
+                    assert_eq!(
+                        &channel[..frame_samples],
+                        carrier_channel.as_slice(),
+                        "{rate:?}, start {start}: in-frame beep differs from the ungated carrier"
+                    );
+                    assert!(channel[frame_samples..].iter().all(|s| *s == 0.0), "{rate:?}, start {start}: beep extends beyond one frame");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn counting_leader_custom_rate_stops_at_exact_sample_boundary() {
+        let sample_rate = 41_000;
+        let source = GeneratorSource::new(Generator::CountingLeader, 64, 36, FrameRate { num: 41, den: 1 }, Tick(3 * TICKS_PER_SECOND));
+        let carrier = GeneratorSource::new(Generator::Tone { hz: 1000.0, db: -20.0 }, 64, 36, FrameRate { num: 41, den: 1 }, Tick(3 * TICKS_PER_SECOND));
+        for start in [0, 41_000, 82_000] {
+            let audio = source.audio(start, 1_008, sample_rate).unwrap();
+            let expected = carrier.audio(start, 1_000, sample_rate).unwrap();
+            for (channel, carrier_channel) in audio.channels.iter().zip(&expected.channels) {
+                assert_eq!(&channel[..1_000], carrier_channel.as_slice(), "custom-rate beep stops before the frame boundary");
+                assert!(channel[1_000..].iter().all(|s| *s == 0.0), "sample exactly at frame boundary must be silent");
+            }
+        }
+    }
+
+    #[test]
+    fn counting_leader_gate_is_independent_of_request_boundaries() {
+        for sample_rate in [41_000u32, 44_100, 48_000] {
+            for rate in [FrameRate::FPS_24, FrameRate::FPS_60, FrameRate::FPS_23_976, FrameRate::FPS_29_97, FrameRate { num: 41, den: 1 }] {
+                let source = GeneratorSource::new(Generator::CountingLeader, 64, 36, rate, Tick(3 * TICKS_PER_SECOND));
+                let frame_samples = (u64::from(sample_rate) * rate.den as u64).div_ceil(rate.num as u64) as usize;
+                let start = i64::from(sample_rate) - 3;
+                let audio = source.audio(start, frame_samples + 8, sample_rate).unwrap();
+                for channel in &audio.channels {
+                    assert!(channel[..3].iter().all(|s| *s == 0.0), "{rate:?}, {sample_rate}: previous second should be silent");
+                    assert!(channel[3..3 + frame_samples].iter().any(|s| s.abs() > 0.05), "{rate:?}, {sample_rate}: missing beep");
+                    assert!(channel[3 + frame_samples..].iter().all(|s| *s == 0.0), "{rate:?}, {sample_rate}: beep exceeds frame");
+                }
+                let first = source.audio(start, 5, sample_rate).unwrap();
+                let second = source.audio(start + 5, frame_samples + 3, sample_rate).unwrap();
+                for c in 0..2 {
+                    let split: Vec<_> = first.channels[c].iter().chain(&second.channels[c]).copied().collect();
+                    assert_eq!(split, audio.channels[c], "{rate:?}, {sample_rate}: split requests change samples");
+                }
+                let end = source.audio(i64::from(sample_rate) + frame_samples as i64 - 2, 6, sample_rate).unwrap();
+                assert!(end.channels.iter().all(|channel| channel[2..].iter().all(|s| *s == 0.0)), "{rate:?}, {sample_rate}: end-crossing block leaks");
+            }
+        }
+    }
+
+    #[test]
+    fn counting_leader_malformed_rates_use_default_frame_gate() {
+        let sample_rate = 48_000u32;
+        let default_rate = FrameRate::default();
+        let frame_samples = (u64::from(sample_rate) * default_rate.den as u64).div_ceil(default_rate.num as u64);
+        let start = frame_samples as i64 - 2;
+        let carrier = GeneratorSource::new(Generator::Tone { hz: 1000.0, db: -20.0 }, 64, 36, default_rate, Tick(3 * TICKS_PER_SECOND));
+        let expected = carrier.audio(start, 2, sample_rate).unwrap();
+        assert!(expected.channels.iter().all(|channel| channel.iter().any(|sample| sample.abs() > 0.05)));
+        for rate in [FrameRate { num: 41, den: 0 }, FrameRate { num: 0, den: 0 }, FrameRate { num: i64::MIN, den: 1 }, FrameRate { num: 1, den: i64::MIN }] {
+            let source = GeneratorSource::new(Generator::CountingLeader, 64, 36, rate, Tick(3 * TICKS_PER_SECOND));
+            let audio = source.audio(start, 8, sample_rate).unwrap();
+            for (channel, carrier_channel) in audio.channels.iter().zip(&expected.channels) {
+                assert_eq!(&channel[..2], carrier_channel.as_slice(), "{rate:?}: fallback beep stops before the frame boundary");
+                assert!(channel[2..].iter().all(|sample| *sample == 0.0), "{rate:?}: fallback gate exceeds one frame");
+            }
+            let fallback = GeneratorSource::new(Generator::CountingLeader, 64, 36, default_rate, Tick(3 * TICKS_PER_SECOND));
+            assert_eq!(audio.channels, fallback.audio(start, 8, sample_rate).unwrap().channels, "{rate:?}: changed fallback");
+        }
+    }
+
+    #[test]
+    fn counting_leader_gate_handles_zero_and_hostile_rates() {
+        let invalid = [FrameRate { num: 0, den: 0 }, FrameRate { num: i64::MIN, den: 1 }, FrameRate { num: 1, den: i64::MIN }, FrameRate { num: 41, den: 0 }];
+        let rates =
+            invalid.into_iter().chain([FrameRate { num: 1, den: i64::MAX }, FrameRate { num: i64::MAX, den: 1 }, FrameRate { num: i64::MAX, den: i64::MAX }]);
+        for rate in rates {
+            let source = GeneratorSource::new(Generator::CountingLeader, 64, 36, rate, Tick(3 * TICKS_PER_SECOND));
+            for sample_rate in [0, 1, 48_000, u32::MAX] {
+                for start in [-2, 0, 1] {
+                    let audio = std::panic::catch_unwind(|| source.audio(start, 8, sample_rate)).unwrap().unwrap();
+                    assert!(audio.channels.iter().flatten().all(|s| s.is_finite()), "{rate:?}, {sample_rate}: non-finite audio");
+                    if sample_rate == 0 {
+                        assert!(audio.channels.iter().flatten().all(|s| *s == 0.0));
+                    }
+                    if invalid.contains(&rate) {
+                        let fallback = GeneratorSource::new(Generator::CountingLeader, 64, 36, FrameRate::default(), Tick(3 * TICKS_PER_SECOND));
+                        assert_eq!(audio.channels, fallback.audio(start, 8, sample_rate).unwrap().channels, "{rate:?}: changed fallback");
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn all_scenes_render() {
         for s in DemoScene::ALL {
-            let px = render(&Generator::Demo(s), 64, 36, 1.5, 36, FrameRate::FPS_24);
+            let px = render(&Generator::Demo(s), 64, 36, 1.5, 36, FrameRate::FPS_24).unwrap();
             assert!(px.as_chunks::<4>().0.iter().any(|p| p[0] > 20 || p[1] > 20 || p[2] > 20));
         }
-        let px = render(&Generator::CountingLeader, 64, 36, 1.5, 36, FrameRate::FPS_24);
+        let px = render(&Generator::CountingLeader, 64, 36, 1.5, 36, FrameRate::FPS_24).unwrap();
         assert_eq!(px.len(), 64 * 36 * 4);
     }
+
+    #[test]
+    fn oversized_generator_frames_are_rejected_before_allocation() {
+        let err = render(&Generator::BlackVideo, 32_768, 32_768, 0.0, 0, FrameRate::FPS_24).unwrap_err();
+        assert!(err.to_string().contains("limit"), "{err}");
+    }
 }
diff --git a/crates/media/src/lib.rs b/crates/media/src/lib.rs
index f875705ed..ea8c4a7d7 100644
--- a/crates/media/src/lib.rs
+++ b/crates/media/src/lib.rs
@@ -53,6 +53,59 @@ pub enum MediaError {
 
 pub type Result<T> = std::result::Result<T, MediaError>;
 
+/// Up to 384 kHz audio (surpassing professional 192 kHz formats).
+pub const MAX_AUDIO_SAMPLE_RATE: u32 = 384_000;
+/// Up to 64 discrete channels (exceeding standard 32-channel immersive layouts).
+pub const MAX_AUDIO_CHANNELS: u32 = 64;
+/// Bounded planar audio buffer: 64 channels * 192 kHz * 10 seconds of f32 is ~492 MiB.
+pub const MAX_AUDIO_BUFFER_BYTES: usize = 512 * 1024 * 1024;
+
+/// Bound container-advertised audio stream dimensions before they are trusted by the app or
+/// allocator.
+///
+/// Out-of-range values are rejected rather than clamped: publishing a lower sample rate without
+/// resampling the samples would make the stream play at the wrong speed, and a clamped channel
+/// count would misdescribe the interleaving.
+pub fn bounded_audio_dimensions(sample_rate: u32, channels: u32) -> Result<(u32, u32)> {
+    if sample_rate == 0 || sample_rate > MAX_AUDIO_SAMPLE_RATE {
+        return Err(MediaError::Decode(format!("unsupported audio sample rate {sample_rate}")));
+    }
+    if channels == 0 || channels > MAX_AUDIO_CHANNELS {
+        return Err(MediaError::Decode(format!("unsupported audio channel count {channels}")));
+    }
+    Ok((sample_rate, channels))
+}
+
+/// Check an adapter-owned planar `f32` audio allocation before constructing it.
+pub fn validate_audio_buffer_shape(channels: usize, frames: usize) -> Result<()> {
+    if channels == 0 || channels > MAX_AUDIO_CHANNELS as usize {
+        return Err(MediaError::Decode(format!("unsupported audio channel count {channels}")));
+    }
+    let bytes = channels
+        .checked_mul(frames)
+        .and_then(|samples| samples.checked_mul(std::mem::size_of::<f32>()))
+        .ok_or_else(|| MediaError::Decode("audio buffer dimensions overflow".into()))?;
+    if bytes > MAX_AUDIO_BUFFER_BYTES {
+        return Err(MediaError::Decode(format!("audio buffer of {bytes} bytes exceeds the {} byte limit", MAX_AUDIO_BUFFER_BYTES)));
+    }
+    Ok(())
+}
+
+/// Number of source frames needed to resample `frames` output frames. Arithmetic is checked so
+/// corrupted rates cannot wrap into a small allocation.
+pub fn resample_source_frames(frames: usize, source_rate: u32, output_rate: u32) -> Result<usize> {
+    if output_rate == 0 {
+        return Err(MediaError::Decode("zero requested audio sample rate".into()));
+    }
+    let source = usize::try_from(source_rate).map_err(|_| MediaError::Decode("invalid source sample rate".into()))?;
+    let output = usize::try_from(output_rate).map_err(|_| MediaError::Decode("invalid output sample rate".into()))?;
+    frames
+        .checked_mul(source)
+        .and_then(|n| n.checked_add(output.saturating_sub(1)))
+        .map(|n| n / output)
+        .ok_or_else(|| MediaError::Decode("resampled audio window overflows".into()))
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum MediaKind {
     /// Video, possibly with audio.
@@ -203,7 +256,7 @@ pub fn open_bytes(name: &str, bytes: Arc<[u8]>, extra: &[Opener]) -> Result<Shar
     if wav::sniff(&bytes) {
         return Ok(Arc::new(wav::WavSource::parse(name, bytes)?));
     }
-    // APNG and animated GIF play as movies (#402); single-frame files fall through to the stills
+    // APNG, animated GIF, and animated WebP play as movies (#402); single-frame files fall through to the stills
     if let Some(r) = animated::open(name, &bytes) {
         return Ok(Arc::new(r?));
     }
@@ -257,4 +310,15 @@ mod importable_tests {
         }
         assert!(!is_importable(Path::new("notes.txt")));
     }
+
+    #[test]
+    fn hostile_audio_dimensions_are_bounded_before_adapters_allocate() {
+        assert!(bounded_audio_dimensions(0, 0).is_err());
+        assert!(bounded_audio_dimensions(u32::MAX, u32::MAX).is_err());
+        assert!(bounded_audio_dimensions(MAX_AUDIO_SAMPLE_RATE + 1, 2).is_err());
+        assert_eq!(bounded_audio_dimensions(48_000, 2).ok(), Some((48_000, 2)));
+        assert!(validate_audio_buffer_shape(MAX_AUDIO_CHANNELS as usize, MAX_AUDIO_BUFFER_BYTES / 4 / MAX_AUDIO_CHANNELS as usize).is_ok());
+        assert!(validate_audio_buffer_shape(MAX_AUDIO_CHANNELS as usize, MAX_AUDIO_BUFFER_BYTES / 4 / MAX_AUDIO_CHANNELS as usize + 1).is_err());
+        assert!(resample_source_frames(usize::MAX, MAX_AUDIO_SAMPLE_RATE, 1).is_err());
+    }
 }
diff --git a/crates/media/src/still/exr.rs b/crates/media/src/still/exr.rs
index d478e3a04..bd0cdef74 100644
--- a/crates/media/src/still/exr.rs
+++ b/crates/media/src/still/exr.rs
@@ -27,6 +27,10 @@ const MAGIC: [u8; 4] = [0x76, 0x2f, 0x31, 0x01];
 
 /// Largest picture we decode (each pixel takes 16 bytes as RGBA floats).
 const MAX_PIXELS: u64 = 1 << 26;
+/// Maximum memory retained while decoding the data window and, when different,
+/// the display window. Both buffers coexist during placement.
+/// 2 GiB: an 8K RGBA f32 plate is 566 MB and the data and display windows may both be held.
+const MAX_DECODED_BYTES: usize = 2 << 30;
 /// Most attributes / channels we read from a header.
 const MAX_ATTRIBUTES: usize = 4096;
 const MAX_CHANNELS: usize = 1024;
@@ -418,6 +422,34 @@ pub fn decode(name: &str, b: &[u8]) -> Result<Decoded> {
     }
     let table = h.end;
     let px_len = dw.checked_mul(dh).and_then(|n| n.checked_mul(4)).ok_or_else(|| bad("size".into()))?;
+    let frame_len = fw.checked_mul(fh).and_then(|n| n.checked_mul(4)).ok_or_else(|| bad("display window size".into()))?;
+    let decoded_bytes = px_len
+        .checked_mul(std::mem::size_of::<f32>())
+        .and_then(|n| if h.data == h.display { Some(n) } else { frame_len.checked_mul(std::mem::size_of::<f32>()).and_then(|m| n.checked_add(m)) })
+        .ok_or_else(|| bad("decoded size".into()))?;
+    if decoded_bytes > MAX_DECODED_BYTES {
+        return Err(MediaError::Unsupported(format!("{name}: EXR decoded buffers exceed the {MAX_DECODED_BYTES}-byte limit")));
+    }
+    let chunks = dh.div_ceil(lpc);
+    let table_end = table.checked_add(chunks.checked_mul(8).ok_or_else(|| bad("offset table size".into()))?).ok_or_else(|| bad("offset table size".into()))?;
+    if table_end > b.len() {
+        return Err(bad("offset table is truncated".into()));
+    }
+    for i in 0..chunks {
+        let at = table + i * 8;
+        let off = le32(b, at).zip(le32(b, at + 4)).map(|(lo, hi)| u64::from(lo) | u64::from(hi) << 32);
+        let off = off.and_then(|o| usize::try_from(o).ok()).ok_or_else(|| bad(format!("offset of chunk {i}")))?;
+        let size = le32(b, off.checked_add(4).ok_or_else(|| bad(format!("chunk {i}")))?).ok_or_else(|| bad(format!("chunk {i}")))? as usize;
+        let end = off.checked_add(8).and_then(|n| n.checked_add(size)).ok_or_else(|| bad(format!("chunk {i}")))?;
+        if end > b.len() {
+            return Err(bad(format!("chunk {i} is truncated")));
+        }
+        let y = le32(b, off).map(|y| y as i32);
+        let want = i64::from(h.data.y0) + (i * lpc) as i64;
+        if y.map(i64::from) != Some(want) {
+            return Err(bad(format!("chunk {i} is not at line {want}")));
+        }
+    }
     let mut px = vec![0f32; px_len];
     if !alpha {
         px.par_chunks_mut(4).for_each(|p| {
diff --git a/crates/media/src/still/hdr.rs b/crates/media/src/still/hdr.rs
index 4e0765bc3..12ff4e72d 100644
--- a/crates/media/src/still/hdr.rs
+++ b/crates/media/src/still/hdr.rs
@@ -197,8 +197,17 @@ pub fn decode(name: &str, b: &[u8]) -> Result<VideoFrame> {
     if (b.len().saturating_sub(pos) as u64).saturating_mul(4096) < (w as u64).saturating_mul(h as u64) {
         return Err(err(name, "truncated pixel data"));
     }
-    let mut px = vec![1f32; w * h * 4];
+    // Validate every encoded scanline before allocating the complete float image. A short HDR
+    // header can otherwise request up to a GiB of zero-initialized pixels and only then fail on
+    // its first missing or malformed scanline.
+    let pixel_data = pos;
     let mut scan = vec![[0u8; 4]; n2];
+    for _ in 0..n1 {
+        scanline(name, b, &mut pos, &mut scan)?;
+    }
+
+    let mut px = vec![1f32; w * h * 4];
+    pos = pixel_data;
     for i in 0..n1 {
         scanline(name, b, &mut pos, &mut scan)?;
         for (j, &p) in scan.iter().enumerate() {
diff --git a/crates/media/src/still/hdr/tests.rs b/crates/media/src/still/hdr/tests.rs
index 3e0b5564a..612b660bc 100644
--- a/crates/media/src/still/hdr/tests.rs
+++ b/crates/media/src/still/hdr/tests.rs
@@ -112,6 +112,9 @@ fn hostile_input_is_an_error_not_a_panic() {
     }
     assert!(decode("a.hdr", &file("-Y 2 +X 2", &[0; 8])).is_err());
     assert!(decode("a.hdr", &file("-Y 99999999 +X 99999999", &[0; 16])).is_err());
+    // Pass the coarse compressed-size check but fail scanline validation. This must be rejected
+    // before a 1 GiB float image is initialized.
+    assert!(decode("a.hdr", &file("-Y 67108864 +X 1", &[0; 16_384])).is_err());
     assert!(decode("a.hdr", &file("-Y 0 +X 4", &[])).is_err());
     assert!(decode("a.hdr", &file("-Y 2 -Y 2", &[0; 16])).is_err());
     assert!(decode("a.hdr", &file("junk", &[0; 16])).is_err());
diff --git a/crates/media/src/wav.rs b/crates/media/src/wav.rs
index a15f0d6b2..94da63438 100644
--- a/crates/media/src/wav.rs
+++ b/crates/media/src/wav.rs
@@ -115,7 +115,13 @@ impl WavSource {
         let (tag, ch, rate, bits) = fmt.ok_or_else(|| MediaError::Decode(format!("{name}: missing fmt chunk")))?;
         let (off, dlen) = data.ok_or_else(|| MediaError::Decode(format!("{name}: missing data chunk")))?;
         let float = tag == 3;
-        if !(tag == 1 || float) || ch == 0 || !matches!(bits, 8 | 16 | 24 | 32 | 64) {
+        if !(tag == 1 || float)
+            || ch == 0
+            || rate == 0
+            || u32::from(ch) > crate::MAX_AUDIO_CHANNELS
+            || rate > crate::MAX_AUDIO_SAMPLE_RATE
+            || !matches!(bits, 8 | 16 | 24 | 32 | 64)
+        {
             return Err(MediaError::Unsupported(format!("{name}: WAV format tag {tag}, {bits} bits")));
         }
         let frame_bytes = u64::from(ch) * u64::from(bits / 8);
@@ -191,6 +197,7 @@ impl MediaSource for WavSource {
     }
     fn audio(&self, start: i64, frames: usize, sample_rate: u32) -> Result<AudioBuffer> {
         let total = self.frames;
+        crate::validate_audio_buffer_shape(self.channels, frames)?;
         let mut out = AudioBuffer::silence(sample_rate, self.channels, frames);
         if total == 0 || sample_rate == 0 {
             return Ok(out);
@@ -343,4 +350,15 @@ mod tests {
         let src = WavSource::parse("short.wav", with_chunk(&wav, b"bext", &[0u8; 100]).into()).unwrap();
         assert_eq!(src.time_reference(), None);
     }
+
+    #[test]
+    fn hostile_header_dimensions_are_rejected_before_publishing_or_reading() {
+        let mut wav = write_wav16(&[0.0; 2], 1, 48_000);
+        // `fmt ` starts at byte 12: channels at +22, rate at +24.
+        wav[22..24].copy_from_slice(&u16::MAX.to_le_bytes());
+        assert!(WavSource::parse("wide.wav", wav.into()).is_err());
+        let mut wav = write_wav16(&[0.0; 2], 1, 48_000);
+        wav[24..28].copy_from_slice(&(crate::MAX_AUDIO_SAMPLE_RATE + 1).to_le_bytes());
+        assert!(WavSource::parse("fast.wav", wav.into()).is_err());
+    }
 }
diff --git a/crates/media/tests/exr_oracle.rs b/crates/media/tests/it/exr_oracle.rs
similarity index 100%
rename from crates/media/tests/exr_oracle.rs
rename to crates/media/tests/it/exr_oracle.rs
diff --git a/crates/media/tests/hdr_oracle.rs b/crates/media/tests/it/hdr_oracle.rs
similarity index 100%
rename from crates/media/tests/hdr_oracle.rs
rename to crates/media/tests/it/hdr_oracle.rs
diff --git a/crates/media/tests/it/main.rs b/crates/media/tests/it/main.rs
new file mode 100644
index 000000000..43b1a5bcb
--- /dev/null
+++ b/crates/media/tests/it/main.rs
@@ -0,0 +1,3 @@
+mod exr_oracle;
+mod hdr_oracle;
+mod tiff_ycbcr;
diff --git a/crates/media/tests/tiff_ycbcr.rs b/crates/media/tests/it/tiff_ycbcr.rs
similarity index 100%
rename from crates/media/tests/tiff_ycbcr.rs
rename to crates/media/tests/it/tiff_ycbcr.rs
diff --git a/crates/mpeg2v/README.md b/crates/mpeg2v/README.md
index 0562ffed3..2ccc86feb 100644
--- a/crates/mpeg2v/README.md
+++ b/crates/mpeg2v/README.md
@@ -38,6 +38,9 @@ parameters, so a random-access point without its own sequence header still decod
 
 - Main Profile at Low/Main/High-1440/High Level, 4:2:2 Profile (IMX / D-10, XDCAM HD422),
   Simple Profile, MPEG-1 (including D pictures). 4:4:4 is refused (no profile in use for it).
+- Pictures above 2^25 luma samples (8192 x 4096; 8K UHD at 7680 x 4320 fits, and the largest MPEG-2 level,
+  High, is 1920 x 1152) are refused as `Unsupported`: the 14-bit header fields allow 16383 x 16383, which
+  would ask for gigabytes per frame from hostile input.
 - Frame pictures with frame and field motion compensation, dual prime, frame and field DCT;
   field pictures with field, 16x8 and dual-prime motion compensation, the second field of a
   P frame predicted from the first; open and closed GOPs; B pictures without a forward
@@ -77,7 +80,7 @@ are compared within a tolerance: **per frame max |Δ| ≤ 4 and PSNR ≥ 58 dB,
 samples differing**. Frame count, display order, picture types, interlacing and field order are
 exact (ffprobe).
 
-`tests/oracle.rs` (FFmpeg-encoded elementary streams):
+`tests/it/oracle.rs` (FFmpeg-encoded elementary streams):
 
 | Fixture | Content | Max Δ | Differing | PSNR |
 |---|---|---|---|---|
@@ -110,7 +113,7 @@ FFmpeg's integer IDCT saturates differently from the exact one.
 
 ## Performance
 
-`cargo test --release -p filmcraft-mpeg2v --test perf -- --ignored --nocapture` decodes the
+`cargo test --release -p filmcraft-mpeg2v --test it perf:: -- --ignored --nocapture` decodes the
 1080i fixture (1920×1080 4:2:0, 25 Mb/s, IBBP, field MC/DCT; FFmpeg-encoded) on an M4 Pro
 (14 cores) that was heavily loaded by other jobs (load average ≈ 190), best of five runs:
 **271 fps on one thread, 274 fps with slice rows on rayon** (runs under heavier momentary load
@@ -126,5 +129,5 @@ fell to 77–150 fps). These are lower bounds.
   rounding, field addressing, edge clamping.
 - `src/tests.rs`: a hand-built intra picture decodes to its DC; truncation at every byte and
   3000 random mutations never panic.
-- `src/synth_tests.rs`, `tests/oracle.rs`: see above (single-threaded decode identical to the
+- `src/synth_tests.rs`, `tests/it/oracle.rs`: see above (single-threaded decode identical to the
   threaded one).
diff --git a/crates/mpeg2v/src/lib.rs b/crates/mpeg2v/src/lib.rs
index 261742c25..6448207cd 100644
--- a/crates/mpeg2v/src/lib.rs
+++ b/crates/mpeg2v/src/lib.rs
@@ -44,6 +44,9 @@ use headers::{EXTENSION, GROUP_START, PICTURE_START, SEQUENCE_END, SEQUENCE_HEAD
 use mc::Frame;
 use slice::{PicParams, Target, decode_slice, slice_row};
 
+/// One access unit must not retain an unbounded number of cropped decoded pictures.
+const MAX_OUTPUT_PICTURES_PER_ACCESS_UNIT: usize = 8;
+
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
     #[error("invalid MPEG video: {0}")]
@@ -163,6 +166,9 @@ struct Seq {
 /// MPEG-1 pel_aspect_ratio (height/width of a sample) ×10000, Table 2-D.2.
 const MPEG1_PEL_ASPECT: [u32; 15] = [0, 10000, 6735, 7031, 7615, 8055, 8437, 8935, 9157, 9815, 10255, 10695, 10950, 11575, 12015];
 
+/// Largest accepted luma area (8192 x 4096; 8K UHD is 7680 x 4320).
+const MAX_PICTURE_AREA: u64 = 1 << 25;
+
 impl Seq {
     fn new(hdr: SequenceHeader, ext: Option<SequenceExtension>, display: Option<DisplayExtension>) -> Result<Seq> {
         let (w, h) = match &ext {
@@ -175,7 +181,9 @@ impl Seq {
             3 => ChromaFormat::Yuv444,
             _ => return Err(Error::Invalid("reserved chroma_format".into())),
         };
-        if w > 16383 || h > 16383 {
+        // The 14-bit sizes allow 16383 x 16383 (gigabytes per frame, several frames and a gray reference
+        // held); no real stream exceeds 8K, so cap the area there.
+        if w > 16383 || h > 16383 || u64::from(w) * u64::from(h) > MAX_PICTURE_AREA {
             return Err(Error::Unsupported(format!("{w}x{h}")));
         }
         let progressive_sequence = ext.is_none_or(|e| e.progressive_sequence);
@@ -333,11 +341,16 @@ pub fn access_units(es: &[u8]) -> Vec<std::ops::Range<usize>> {
             }
             PICTURE_START => {
                 // picture_structure from the picture coding extension that follows
-                let structure = codes[k + 1..]
+                let structure = codes
                     .iter()
-                    .take_while(|c| c.1 == EXTENSION || c.1 == headers::USER_DATA)
-                    .find_map(|&(p, c)| {
-                        let end = codes.iter().find(|x| x.0 > p).map_or(es.len(), |x| x.0);
+                    .enumerate()
+                    .skip(k + 1)
+                    .take_while(|(_, c)| c.1 == EXTENSION || c.1 == headers::USER_DATA)
+                    .find_map(|(next, &(p, c))| {
+                        // `next` is this unit's position in `codes`, so its successor gives the
+                        // payload end directly. Searching `codes` from the beginning here made a
+                        // stream of short picture/extension pairs quadratic to index.
+                        let end = codes.get(next + 1).map_or(es.len(), |x| x.0);
                         (c == EXTENSION).then(|| Extension::parse(&es[(p + 4).min(end)..end]).ok()).flatten()
                     })
                     .and_then(|e| match e {
@@ -413,6 +426,7 @@ pub struct Decoder {
     gray: Option<Arc<Frame>>,
     pending: Option<Pending>,
     out: Vec<Picture>,
+    output_overflow: bool,
     errors: usize,
     last_error: Option<&'static str>,
     threads: bool,
@@ -437,6 +451,7 @@ impl Decoder {
             gray: None,
             pending: None,
             out: Vec::new(),
+            output_overflow: false,
             errors: 0,
             last_error: None,
             threads: cfg!(feature = "threads"),
@@ -466,6 +481,7 @@ impl Decoder {
     /// Decode a chunk of the elementary stream holding whole pictures (an access unit) tagged
     /// with `pts`. Returns the pictures that became displayable, in display order.
     pub fn decode(&mut self, data: &[u8], pts: i64) -> Result<Vec<Picture>> {
+        self.output_overflow = false;
         let codes = start_codes(data);
         let mut err = None;
         for (k, &(pos, code)) in codes.iter().enumerate() {
@@ -544,6 +560,10 @@ impl Decoder {
         }
         self.apply_sequence();
         self.finish_picture(data, pts);
+        if self.output_overflow {
+            self.out.clear();
+            return Err(Error::Invalid("access unit produces too many decoded pictures".into()));
+        }
         let out = std::mem::take(&mut self.out);
         match err {
             Some(e) if out.is_empty() && self.seq.is_none() => Err(e),
@@ -561,7 +581,7 @@ impl Decoder {
         {
             a.shown = true;
             let p = to_picture(&a.frame, &a.meta);
-            self.out.push(p);
+            self.push_output(p);
         }
         std::mem::take(&mut self.out)
     }
@@ -574,6 +594,7 @@ impl Decoder {
         self.building = None;
         self.pending = None;
         self.out.clear();
+        self.output_overflow = false;
         self.closed_gop = false;
     }
 
@@ -597,6 +618,11 @@ impl Decoder {
 
     fn finish_picture(&mut self, data: &[u8], pts: i64) {
         let Some(pd) = self.pending.take() else { return };
+        if pd.slices.is_empty() {
+            self.errors += 1;
+            self.last_error = Some("picture has no slices");
+            return;
+        }
         let Some(seq) = self.seq.clone() else {
             self.errors += 1;
             return;
@@ -696,13 +722,21 @@ impl Decoder {
             if let Some(mut prev) = self.bwd.take() {
                 if !prev.shown {
                     prev.shown = true;
-                    self.out.push(to_picture(&prev.frame, &prev.meta));
+                    self.push_output(to_picture(&prev.frame, &prev.meta));
                 }
                 self.fwd = Some(prev);
             }
             self.bwd = Some(Anchor { frame: Arc::new(frame), meta, shown: false });
         } else {
-            self.out.push(to_picture(&frame, &meta));
+            self.push_output(to_picture(&frame, &meta));
+        }
+    }
+
+    fn push_output(&mut self, picture: Picture) {
+        if self.out.len() >= MAX_OUTPUT_PICTURES_PER_ACCESS_UNIT {
+            self.output_overflow = true;
+        } else {
+            self.out.push(picture);
         }
     }
 }
diff --git a/crates/mpeg2v/src/synth_tests.rs b/crates/mpeg2v/src/synth_tests.rs
index 0d4dd5453..33baf11a8 100644
--- a/crates/mpeg2v/src/synth_tests.rs
+++ b/crates/mpeg2v/src/synth_tests.rs
@@ -725,7 +725,7 @@ fn check(cfg: Cfg) {
     }
     let psnr = 10.0 * (255f64 * 255.0 * n as f64 / sse.max(1e-9)).log10();
     println!("{}: {} frames, max diff {worst}, {:.3}% differ, PSNR {psnr:.2} dB", cfg.name, pics.len(), 100.0 * differ as f64 / n as f64);
-    // the same criteria as the ffmpeg-encoded fixtures (tests/oracle.rs)
+    // the same criteria as the ffmpeg-encoded fixtures (tests/it/oracle.rs)
     assert!(worst <= 4 && psnr >= 58.0, "{} (seed {:#x}): max diff {worst}, PSNR {psnr:.2}, first at {first_bad:?}", cfg.name, cfg.seed);
 }
 
diff --git a/crates/mpeg2v/src/tests.rs b/crates/mpeg2v/src/tests.rs
index ca5f2e5e5..eeae62aae 100644
--- a/crates/mpeg2v/src/tests.rs
+++ b/crates/mpeg2v/src/tests.rs
@@ -1,5 +1,5 @@
 //! Unit tests over hand-built streams (headers, robustness). Decoding accuracy against ffmpeg is
-//! in `tests/oracle.rs`.
+//! in `tests/it/oracle.rs`.
 
 use super::*;
 
diff --git a/crates/mpeg2v/tests/fuzz_hostile.rs b/crates/mpeg2v/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..5d3aa21a2
--- /dev/null
+++ b/crates/mpeg2v/tests/fuzz_hostile.rs
@@ -0,0 +1,200 @@
+//! Hostile-input robustness: truncation at every length, byte/bit mutation and header-field
+//! sweeps over a small ffmpeg-generated stream must never panic or run away (errors are fine).
+//! Skips when ffmpeg is missing.
+
+#[path = "it/common/mod.rs"]
+mod common;
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use filmcraft_mpeg2v::{Decoder, access_units, probe, scan_access_unit};
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+const SPECS: [common::Spec; 3] = [
+    common::Spec {
+        name: "m2v_fuzz_seed",
+        lavfi: "testsrc2=size=64x48:rate=25",
+        frames: 8,
+        enc: &["-c:v", "mpeg2video", "-bf", "2", "-g", "6", "-b:v", "500k"],
+        pix_fmt: "yuv420p",
+    },
+    common::Spec {
+        name: "m2v_fuzz_seed_interlaced",
+        lavfi: "testsrc2=size=96x64:rate=25,tinterlace=mode=interleave_top,setfield=tff",
+        frames: 6,
+        enc: &["-c:v", "mpeg2video", "-flags", "+ilme+ildct", "-bf", "1", "-g", "6", "-b:v", "800k"],
+        pix_fmt: "yuv420p",
+    },
+    common::Spec {
+        name: "m2v_fuzz_seed_422",
+        lavfi: "testsrc2=size=64x48:rate=25",
+        frames: 4,
+        enc: &["-c:v", "mpeg2video", "-pix_fmt", "yuv422p", "-profile:v", "0", "-b:v", "1M"],
+        pix_fmt: "yuv422p",
+    },
+];
+
+static PANICS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+/// Decoder worker threads catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(std::sync::atomic::Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        let _ = probe(d);
+        let _ = scan_access_unit(d);
+        for threads in [false, true] {
+            let mut dec = Decoder::new();
+            dec.set_threads(threads);
+            for (i, r) in access_units(d).into_iter().enumerate() {
+                let _ = dec.decode(&d[r], i as i64);
+            }
+            // also the whole buffer as one unit
+            let _ = dec.decode(d, 99);
+            let _ = dec.flush();
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(std::sync::atomic::Ordering::SeqCst) == before, "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+/// CI runs a rotating share of every part of the sweep; `FILMCRAFT_FUZZ_ITERS=2500` runs all of it (see [`Depth`]).
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("mpeg2v fuzz") else { return };
+    let depth = Depth::from_env();
+    for spec in &SPECS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, "mpeg2video") {
+            filmcraft_testkit::skip("mpeg2v fuzz", &format!("this ffmpeg has no mpeg2video encoder (seed {})", spec.name));
+            continue;
+        }
+        let Some(path) = common::make(&ff, spec) else {
+            panic!("ffmpeg has mpeg2video but could not encode the {} seed", spec.name);
+        };
+        fuzz(&depth, spec.name, &std::fs::read(path).unwrap());
+    }
+}
+
+fn fuzz(depth: &Depth, name: &str, seed: &[u8]) {
+    // every truncation length (stride keeps it quick on larger seeds)
+    for n in depth.truncations(seed.len()) {
+        run_all(&seed[..n], &format!("{name} truncate {n}"));
+    }
+    // header region: every byte to 0 / 0xff / 0x80 / each single bit
+    for p in 0..seed.len().min(96) {
+        for (i, v) in VALUES.into_iter().enumerate() {
+            if !depth.value(p, i) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] = v;
+            run_all(&d, &format!("{name} byte {p}={v:#x}"));
+        }
+        for b in 0..8 {
+            if !depth.bit(p, b) {
+                continue;
+            }
+            let mut d = seed.to_vec();
+            d[p] ^= 1 << b;
+            run_all(&d, &format!("{name} flip {p}.{b}"));
+        }
+    }
+    // random multi-mutations
+    let mut rng = Rng(0x9e3779b97f4a7c15);
+    // Skipped rounds still draw their mutations, so round i matches round i of a full run.
+    for i in 0..depth.rounds {
+        let mut d = seed.to_vec();
+        for _ in 0..1 + rng.below(6) {
+            let p = rng.below(d.len());
+            if rng.below(2) == 0 {
+                d[p] ^= 1 << rng.below(8);
+            } else {
+                d[p] = rng.next() as u8;
+            }
+        }
+        if depth.round(i) {
+            run_all(&d, &format!("{name} random {i}"));
+        }
+    }
+}
+
+const VALUES: [u8; 4] = [0, 0xff, 0x80, 0x01];
+
+/// How much of the sweep runs. `FILMCRAFT_FUZZ_ITERS=N` runs all of it (about 600 truncation
+/// points spread over each seed, every header byte, overwrite value and bit flip) plus N random
+/// rounds per seed: 2500 is the full depth, more hunts longer. Unset, CI runs a third of the
+/// truncation points and of the full depth's random rounds and, for each header byte, one value
+/// and two bits. A rotation offset shifts which share runs (`FILMCRAFT_FUZZ_SEED`, else the UTC
+/// day number), so every case of the full sweep runs within a few days, and a random round's
+/// mutations match the same round of a full run.
+struct Depth {
+    full: bool,
+    truncations: usize,
+    rounds: usize,
+    rotation: usize,
+}
+
+impl Depth {
+    fn from_env() -> Self {
+        match std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()) {
+            Some(rounds) => Depth { full: true, truncations: 600, rounds, rotation: 0 },
+            None => {
+                let rotation = rotation();
+                eprintln!("fuzz subset rotation {rotation} (FILMCRAFT_FUZZ_SEED={rotation} replays it; FILMCRAFT_FUZZ_ITERS=2500 runs everything)");
+                Depth { full: false, truncations: 600, rounds: 2500, rotation }
+            }
+        }
+    }
+    /// Truncation lengths for a `len`-byte input: every point of the full sweep, or every third one.
+    fn truncations(&self, len: usize) -> std::iter::StepBy<std::ops::Range<usize>> {
+        let stride = (len / self.truncations).max(1);
+        let (start, step) = if self.full { (0, stride) } else { ((self.rotation % 3) * stride, 3 * stride) };
+        (start..len).step_by(step)
+    }
+    fn value(&self, p: usize, i: usize) -> bool {
+        self.full || i == (p + self.rotation % VALUES.len()) % VALUES.len()
+    }
+    fn bit(&self, p: usize, b: usize) -> bool {
+        self.full || (b + p + self.rotation % 4).is_multiple_of(4)
+    }
+    fn round(&self, i: usize) -> bool {
+        self.full || i % 3 == self.rotation % 3
+    }
+}
+
+/// The default subset's rotation offset: `FILMCRAFT_FUZZ_SEED`, else days since the Unix epoch (UTC).
+fn rotation() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or_else(|| {
+        let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        usize::try_from(secs / 86_400).unwrap_or(0)
+    })
+}
diff --git a/crates/mpeg2v/tests/common/mod.rs b/crates/mpeg2v/tests/it/common/mod.rs
similarity index 100%
rename from crates/mpeg2v/tests/common/mod.rs
rename to crates/mpeg2v/tests/it/common/mod.rs
diff --git a/crates/mpeg2v/tests/it/hostile_dims.rs b/crates/mpeg2v/tests/it/hostile_dims.rs
new file mode 100644
index 000000000..01dcf25f8
--- /dev/null
+++ b/crates/mpeg2v/tests/it/hostile_dims.rs
@@ -0,0 +1,73 @@
+//! A 14-byte sequence header must not make the decoder size its frame buffers at 16383 x 16383
+//! (gigabytes per picture). Hand-built, no ffmpeg.
+
+use filmcraft_mpeg2v::Decoder;
+
+#[derive(Default)]
+struct Bits {
+    bytes: Vec<u8>,
+    n: usize,
+}
+
+impl Bits {
+    fn put(&mut self, value: u32, bits: usize) {
+        for i in (0..bits).rev() {
+            if self.n.is_multiple_of(8) {
+                self.bytes.push(0);
+            }
+            if (value >> i) & 1 == 1
+                && let Some(b) = self.bytes.last_mut()
+            {
+                *b |= 0x80 >> (self.n % 8);
+            }
+            self.n += 1;
+        }
+    }
+}
+
+/// Sequence header plus sequence extension for a `w` x `h` 4:4:4 stream.
+fn sequence(w: u32, h: u32, chroma_format: u32) -> Vec<u8> {
+    let mut s = Bits::default();
+    s.put(w & 0xfff, 12);
+    s.put(h & 0xfff, 12);
+    s.put(1, 4); // aspect_ratio_information
+    s.put(4, 4); // frame_rate_code
+    s.put(1000, 18); // bit_rate_value
+    s.put(1, 1); // marker
+    s.put(100, 10); // vbv_buffer_size_value
+    s.put(0, 3); // constrained_parameters_flag, load_intra, load_non_intra
+    let mut e = Bits::default();
+    e.put(1, 4); // sequence_extension
+    e.put(0x48, 8); // profile_and_level_indication
+    e.put(1, 1); // progressive_sequence
+    e.put(chroma_format, 2);
+    e.put(w >> 12, 2);
+    e.put(h >> 12, 2);
+    e.put(0, 12); // bit_rate_extension
+    e.put(1, 1); // marker
+    e.put(0, 8 + 1 + 2 + 5); // vbv_buffer_size_extension, low_delay, frame_rate_extension_n/d
+    let mut out = vec![0, 0, 1, 0xb3];
+    out.extend(s.bytes);
+    out.extend([0, 0, 1, 0xb5]);
+    out.extend(e.bytes);
+    out
+}
+
+fn accepted(w: u32, h: u32, chroma_format: u32) -> bool {
+    let mut dec = Decoder::new();
+    let _ = dec.decode(&sequence(w, h, chroma_format), 0);
+    dec.sequence().is_some()
+}
+
+#[test]
+fn ordinary_sequences_are_accepted() {
+    assert!(accepted(1920, 1080, 1));
+    assert!(accepted(7680, 4320, 3));
+}
+
+#[test]
+fn gigantic_sequences_are_refused() {
+    assert!(!accepted(16383, 16383, 3));
+    assert!(!accepted(16383, 16383, 1));
+    assert!(!accepted(8192, 8192, 1));
+}
diff --git a/crates/mpeg2v/tests/it/main.rs b/crates/mpeg2v/tests/it/main.rs
new file mode 100644
index 000000000..bf473ddbb
--- /dev/null
+++ b/crates/mpeg2v/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod common;
+mod hostile_dims;
+mod oracle;
+mod perf;
diff --git a/crates/mpeg2v/tests/oracle.rs b/crates/mpeg2v/tests/it/oracle.rs
similarity index 99%
rename from crates/mpeg2v/tests/oracle.rs
rename to crates/mpeg2v/tests/it/oracle.rs
index eed298c7d..00473c955 100644
--- a/crates/mpeg2v/tests/oracle.rs
+++ b/crates/mpeg2v/tests/it/oracle.rs
@@ -3,7 +3,7 @@
 //! definition (any IEEE 1180-accurate IDCT conforms), so frames are compared within a tolerance;
 //! frame count and display order are exact.
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/mpeg2v/tests/perf.rs b/crates/mpeg2v/tests/it/perf.rs
similarity index 87%
rename from crates/mpeg2v/tests/perf.rs
rename to crates/mpeg2v/tests/it/perf.rs
index 44281499c..10aaa1d6d 100644
--- a/crates/mpeg2v/tests/perf.rs
+++ b/crates/mpeg2v/tests/it/perf.rs
@@ -1,7 +1,7 @@
-//! Decode speed (ignored; run with `cargo test --release -p filmcraft-mpeg2v --test perf --
-//! --ignored --nocapture`). Uses the 1080i fixture of `tests/oracle.rs` (ffmpeg-encoded, 25 Mb/s).
+//! Decode speed (ignored; run with `cargo test --release -p filmcraft-mpeg2v --test it perf:: --
+//! --ignored --nocapture`). Uses the 1080i fixture of `tests/it/oracle.rs` (ffmpeg-encoded, 25 Mb/s).
 
-mod common;
+use crate::common;
 
 use common::*;
 
diff --git a/crates/mpegts/README.md b/crates/mpegts/README.md
index 15bb9101e..a5543992c 100644
--- a/crates/mpegts/README.md
+++ b/crates/mpegts/README.md
@@ -65,7 +65,7 @@ let au: Vec<u8> = file.read_unit(&bytes, v, 0)?;      // the first access unit
   33-bit unwrap; truncation every 37 bytes and 400 random mutations never panic.
 - `src/es.rs`, `src/pes.rs`: frame sizes (MPEG audio layers I-III, MPEG-2 LSF, AC-3 at all
   rates), MPEG-2 and MPEG-1 PES headers.
-- `crates/codecs/tests/mpeg_oracle.rs`: FFmpeg-written TS / M2TS / VOB / MPEG-1 system files —
+- `crates/codecs/tests/it/mpeg_oracle.rs`: FFmpeg-written TS / M2TS / VOB / MPEG-1 system files —
   frame counts and every frame's PTS equal ffprobe's, decoded media against FFmpeg (see
   `filmcraft-codecs`).
 
diff --git a/crates/mpegts/src/es.rs b/crates/mpegts/src/es.rs
index 9735d456e..3219b4d60 100644
--- a/crates/mpegts/src/es.rs
+++ b/crates/mpegts/src/es.rs
@@ -652,11 +652,14 @@ impl Splitter {
                     match next {
                         Some(d) => {
                             self.skipped += d as u64;
-                            self.trim(self.buf.len() - (i + 1 + d));
+                            // Keep a cursor into the current window rather than draining its
+                            // prefix for every false sync candidate.
+                            self.next_frame = Some(at + 1 + d as u64);
                         }
                         None => {
                             self.skipped += (self.buf.len() - i - 1) as u64;
-                            self.trim(0);
+                            // A split header can begin in the final few bytes; compact once.
+                            self.trim(7);
                             return;
                         }
                     }
diff --git a/crates/mxf/Cargo.toml b/crates/mxf/Cargo.toml
index 34b62227f..78609cf63 100644
--- a/crates/mxf/Cargo.toml
+++ b/crates/mxf/Cargo.toml
@@ -10,6 +10,7 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
+chrono = { workspace = true }
 
 [dev-dependencies]
 filmcraft-testkit = { workspace = true }
diff --git a/crates/mxf/README.md b/crates/mxf/README.md
index 043772477..070045b98 100644
--- a/crates/mxf/README.md
+++ b/crates/mxf/README.md
@@ -129,7 +129,7 @@ w.finish()?;
 - `src/tests.rs`: a small OP1a writer builds synthetic files (temporal offsets, key flags, PCM,
   timecode); open, presentation order, sample bytes, PCM values; truncation at every 37 bytes and
   600 random mutations never panic and only list fully-present samples.
-- `crates/codecs/tests/mxf_oracle.rs` (FFmpeg-written fixtures, FFmpeg as the decode oracle):
+- `crates/codecs/tests/it/mxf_oracle.rs` (FFmpeg-written fixtures, FFmpeg as the decode oracle):
   H.264 long-GOP with B pictures (bit-exact every frame + 25 random seeks), H.264 29.97 DF
   timecode, DNxHR LB (±2), ProRes 422 (±1), MPEG-2 long GOP, XDCAM HD422 and D-10 (±4),
   OP-Atom VC-3 (clip-wrapped) and PCM, D-10 AES3 audio; PCM sample-exact in every file;
diff --git a/crates/mxf/src/file.rs b/crates/mxf/src/file.rs
index 75dd27991..07cead857 100644
--- a/crates/mxf/src/file.rs
+++ b/crates/mxf/src/file.rs
@@ -1,6 +1,7 @@
 //! Opening an MXF file: KLV walk, partitions, metadata resolution, sample tables.
 
 use std::collections::HashMap;
+use std::sync::Arc;
 
 use crate::essence::{Codec, PictureInfo, SoundFormat, SoundInfo, decode_pcm, identify_picture, sniff_picture};
 use crate::index::{IndexEntry, IndexSegment};
@@ -326,12 +327,13 @@ fn walk(src: &(impl ByteSource + ?Sized)) -> Result<WalkResult> {
     let mut win = Window { src, off: 0, buf: Vec::new() };
     let mut pos = run_in;
     let mut cur_meta: Option<usize> = None;
+    let mut resync_budget = 64 << 20;
     while pos + 17 <= len {
         let hdr = win.get(pos, 25)?.to_vec();
         let key = Ul(hdr[..16].try_into().unwrap_or([0; 16]));
         if !key.is_smpte() {
             // Lost sync (corrupt data): look for the next partition pack.
-            match resync(src, pos + 1, len)? {
+            match resync(src, pos + 1, len, &mut resync_budget)? {
                 Some(p) => {
                     w.warnings.push(format!("lost KLV sync at byte {pos}; resumed at {p}"));
                     pos = p;
@@ -417,12 +419,14 @@ fn is_essence_item(k: &Ul) -> bool {
     matches!(k.0[12], 0x05 | 0x06 | 0x07 | 0x15 | 0x16 | 0x17 | 0x18)
 }
 
-/// The next partition pack key at or after `from` (scans at most 16 MiB).
-fn resync(src: &(impl ByteSource + ?Sized), from: u64, len: u64) -> Result<Option<u64>> {
+/// The next partition pack key at or after `from` (scans at most 16 MiB and shares `budget`
+/// with every other recovery attempt in this file).
+fn resync(src: &(impl ByteSource + ?Sized), from: u64, len: u64, budget: &mut usize) -> Result<Option<u64>> {
     let mut at = from;
     let end = len.min(from + (16 << 20));
-    while at < end {
-        let chunk = read_upto(src, at, 1 << 20)?;
+    while at < end && *budget > 0 {
+        let chunk = read_upto(src, at, (1 << 20).min(*budget))?;
+        *budget = budget.saturating_sub(chunk.len());
         if chunk.len() < 16 {
             break;
         }
@@ -544,8 +548,8 @@ struct TrackRef {
     origin: i64,
     start_position: i64,
     duration: Option<i64>,
-    descriptor: Option<Set>,
-    sub_descriptors: Vec<Set>,
+    descriptor: Option<Arc<Set>>,
+    sub_descriptors: Vec<Arc<Set>>,
     body_sid: u32,
     index_sid: u32,
 }
@@ -567,9 +571,13 @@ fn resolve_tracks(md: &Metadata, warnings: &mut Vec<String>) -> (Vec<TrackRef>,
     }
     let material = md.of_kind(st::MATERIAL_PACKAGE).next();
     let mut out = Vec::new();
+    let mut descriptor_cache: HashMap<[u8; 16], Arc<Set>> = HashMap::new();
+    let intern_descriptor = |set: &Set, cache: &mut HashMap<[u8; 16], Arc<Set>>| {
+        if set.instance_uid == [0; 16] { Arc::new(set.clone()) } else { cache.entry(set.instance_uid).or_insert_with(|| Arc::new(set.clone())).clone() }
+    };
     let mut timecode = material.and_then(|m| package_timecode(md, m));
     let name = material.and_then(|m| m.string(tag::PACKAGE_NAME));
-    let file_track = |pkg: &Set, kind: Option<TrackKind>, id: Option<u32>, start: i64, duration: Option<i64>, name: Option<String>| -> Option<TrackRef> {
+    let mut file_track = |pkg: &Set, kind: Option<TrackKind>, id: Option<u32>, start: i64, duration: Option<i64>, name: Option<String>| -> Option<TrackRef> {
         let umid = umid_of(pkg, tag::PACKAGE_UID).unwrap_or([0; 32]);
         for r in pkg.references(tag::PACKAGE_TRACKS) {
             let Some(t) = md.get(&r) else { continue };
@@ -588,10 +596,16 @@ fn resolve_tracks(md: &Metadata, warnings: &mut Vec<String>) -> (Vec<TrackRef>,
                 continue;
             }
             let desc = descriptor_for(md, pkg, tid, tk);
-            let subs: Vec<Set> = desc
+            let descriptor = desc.map(|d| intern_descriptor(d, &mut descriptor_cache));
+            let subs: Vec<Arc<Set>> = desc
                 .and_then(|d| d.dynamic_item(&SUB_DESCRIPTORS_ITEM))
                 .map(|v| {
-                    crate::klv::batch_of(v).into_iter().filter_map(|b| b.get(..16)).filter_map(|b| md.get(&b.try_into().unwrap_or([0; 16]))).cloned().collect()
+                    crate::klv::batch_of(v)
+                        .into_iter()
+                        .filter_map(|b| b.get(..16))
+                        .filter_map(|b| md.get(&b.try_into().unwrap_or([0; 16])))
+                        .map(|s| intern_descriptor(s, &mut descriptor_cache))
+                        .collect()
                 })
                 .unwrap_or_default();
             let (body_sid, index_sid) = sids.get(&umid).copied().unwrap_or((0, 0));
@@ -604,7 +618,7 @@ fn resolve_tracks(md: &Metadata, warnings: &mut Vec<String>) -> (Vec<TrackRef>,
                 origin: t.i(tag::ORIGIN).unwrap_or(0),
                 start_position: start,
                 duration,
-                descriptor: desc.cloned(),
+                descriptor,
                 sub_descriptors: subs,
                 body_sid,
                 index_sid,
@@ -807,7 +821,7 @@ fn build_track(
     };
     match r.kind {
         TrackKind::Picture => {
-            let pi = desc.map(picture_info).unwrap_or_default();
+            let pi = desc.map(|d| picture_info(d)).unwrap_or_default();
             let mpeg_desc = desc.is_some_and(|d| d.kind() == Some(st::MPEG2_VIDEO_DESCRIPTOR));
             let mut codec = identify_picture(pi.picture_coding, container, mpeg_desc);
             if r.sub_descriptors.iter().any(|s| s.kind() == Some(st::AVC_SUBDESCRIPTOR)) && !matches!(codec, Codec::Avc { .. }) {
@@ -828,7 +842,7 @@ fn build_track(
             build_pictures(src, &mut t, elements, index, warnings)?;
         }
         TrackKind::Sound => {
-            let si = desc.map(sound_info).unwrap_or(SoundInfo { channels: 1, bits: 16, ..Default::default() });
+            let si = desc.map(|d| sound_info(d)).unwrap_or(SoundInfo { channels: 1, bits: 16, ..Default::default() });
             let d10 = container.is_some_and(|c| c.item_starts_with(&[0x0D, 0x01, 0x03, 0x01, 0x02, 0x01]));
             let aes_element = d10 || key4[0] == 0x06 && key4[2] == 0x10;
             let pcm_desc = desc.is_some_and(|d| matches!(d.kind(), Some(st::AES3_DESCRIPTOR) | Some(st::WAVE_DESCRIPTOR)));
diff --git a/crates/mxf/src/write/mod.rs b/crates/mxf/src/write/mod.rs
index d18fdfb27..939cbd77e 100644
--- a/crates/mxf/src/write/mod.rs
+++ b/crates/mxf/src/write/mod.rs
@@ -243,6 +243,26 @@ impl StartTimecode {
     }
 }
 
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// `i64` exact instead of collapsing out-of-range years to the epoch.
+fn utc_parts(secs: i64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = (secs.div_euclid(86_400), secs.rem_euclid(86_400));
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
 /// An MXF timestamp (UTC).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct Timestamp {
@@ -256,27 +276,19 @@ pub struct Timestamp {
 }
 
 impl Timestamp {
-    /// From seconds since the Unix epoch (proleptic Gregorian, UTC).
+    /// From seconds since the Unix epoch (proleptic Gregorian, UTC). Years far outside chrono's own
+    /// range are preserved (the old hand-rolled conversion kept them) with month, day and time
+    /// intact; only the `year` is clamped to the MXF `u16` field, exactly as the old code did.
     pub fn from_unix(secs: i64) -> Timestamp {
-        let days = secs.div_euclid(86_400);
-        let rem = secs.rem_euclid(86_400);
-        // civil-from-days (H. Hinnant)
-        let z = days + 719_468;
-        let era = z.div_euclid(146_097);
-        let doe = z - era * 146_097;
-        let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-        let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-        let mp = (5 * doy + 2) / 153;
-        let d = doy - (153 * mp + 2) / 5 + 1;
-        let m = if mp < 10 { mp + 3 } else { mp - 9 };
-        let y = yoe + era * 400 + if m <= 2 { 1 } else { 0 };
+        use chrono::{Datelike, Timelike};
+        let (y, t) = utc_parts(secs);
         Timestamp {
             year: y.clamp(0, 65535) as u16,
-            month: m as u8,
-            day: d as u8,
-            hour: (rem / 3600) as u8,
-            minute: (rem / 60 % 60) as u8,
-            second: (rem % 60) as u8,
+            month: t.month() as u8,
+            day: t.day() as u8,
+            hour: t.hour() as u8,
+            minute: t.minute() as u8,
+            second: t.second() as u8,
             millisecond: 0,
         }
     }
@@ -529,6 +541,16 @@ impl<W: Write + Seek> MxfWriter<W> {
         if !cfg.edit_rate.is_valid() {
             return Err(io::Error::new(io::ErrorKind::InvalidInput, "MXF edit rate must be positive"));
         }
+        // OP1a pads every sound track to a whole edit unit on flush. Bound that unit before a
+        // low but technically positive edit rate can turn padding into a multi-gigabyte Vec.
+        const MAX_PCM_EDIT_UNIT_BYTES: u128 = 64 << 20;
+        for sound in &cfg.sound {
+            let samples = (u128::from(sound.sample_rate) * cfg.edit_rate.den as u128).div_ceil(cfg.edit_rate.num as u128);
+            let bytes = samples.saturating_mul(u128::from(sound.block_align()));
+            if bytes > MAX_PCM_EDIT_UNIT_BYTES {
+                return Err(io::Error::new(io::ErrorKind::InvalidInput, "MXF PCM edit unit exceeds the allocation budget"));
+            }
+        }
         let n_essence = cfg.picture.is_some() as usize + cfg.sound.len();
         if n_essence == 0 {
             return Err(io::Error::new(io::ErrorKind::InvalidInput, "MXF file without essence tracks"));
diff --git a/crates/mxf/src/write/tests.rs b/crates/mxf/src/write/tests.rs
index ddf935211..5ce7560a8 100644
--- a/crates/mxf/src/write/tests.rs
+++ b/crates/mxf/src/write/tests.rs
@@ -47,6 +47,15 @@ fn op1a_config(rate: Rational, coding: PictureCoding) -> WriterConfig {
     cfg
 }
 
+#[test]
+fn op1a_rejects_an_unbounded_pcm_edit_unit_before_padding() {
+    let mut cfg = WriterConfig::new(Pattern::Op1a, Rational::new(1, 36_000), PackageIds::from_seed("low-rate", "Low Rate"));
+    cfg.picture = Some(PictureDesc::new(PictureCoding::ProRes { profile: 3 }, 64, 36));
+    cfg.sound = vec![SoundDesc { sample_rate: 48_000, channels: 2, bits: 16 }];
+    let err = MxfWriter::new(Cursor::new(Vec::new()), cfg).err().unwrap();
+    assert!(err.to_string().contains("PCM edit unit"));
+}
+
 /// 10 ProRes-like pictures at 25 fps with stereo 16-bit and mono 24-bit sound pushed in uneven chunks.
 fn build_op1a() -> Vec<u8> {
     let cfg = op1a_config(Rational::new(25, 1), PictureCoding::ProRes { profile: 3 });
@@ -267,6 +276,22 @@ fn timestamps() {
     assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (2023, 11, 14, 22, 13, 20));
     let t = Timestamp::from_unix(951_782_400); // 2000-02-29
     assert_eq!((t.year, t.month, t.day), (2000, 2, 29));
+    // Years far outside chrono's own range are preserved with month/day/time intact and only the
+    // year clamped to the MXF `u16`, exactly as the old hand-rolled conversion did (not collapsed
+    // to the epoch — reviewer FredApps). `10_000_000_000_000` s → 318857-05-20 17:46:40.
+    let t = Timestamp::from_unix(10_000_000_000_000);
+    assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (65535, 5, 20, 17, 46, 40));
+    // Year 10000 (just past chrono's range) still fits the u16 field.
+    let t = Timestamp::from_unix(253_402_300_800);
+    assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (10000, 1, 1, 0, 0, 0));
+    // A negative year clamps to 0 but keeps its month/day/time.
+    let t = Timestamp::from_unix(-10_000_000_000_000);
+    assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (0, 8, 13, 6, 13, 20));
+    // The `i64` extremes the old code accepted.
+    let t = Timestamp::from_unix(i64::MAX);
+    assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (65535, 12, 4, 15, 30, 7));
+    let t = Timestamp::from_unix(i64::MIN);
+    assert_eq!((t.year, t.month, t.day, t.hour, t.minute, t.second), (0, 1, 27, 8, 29, 52));
 }
 
 #[test]
diff --git a/crates/ogg/README.md b/crates/ogg/README.md
index a3d7f9196..851b9863e 100644
--- a/crates/ogg/README.md
+++ b/crates/ogg/README.md
@@ -37,6 +37,6 @@ let packet = ogg.read_packet(&bytes, s, k)?;
 ## Tests
 
 `src/tests.rs` writes synthetic pages: timing with pre-skip and end trimming, packets across pages,
-a corrupted page (CRC), every truncation and 300 mutations. `crates/codecs/tests/ogg_oracle.rs`
+a corrupted page (CRC), every truncation and 300 mutations. `crates/codecs/tests/it/ogg_oracle.rs`
 compares with FFmpeg's libopus / Vorbis decodes (exact length; SNR ≥ 50 dB CELT, ≥ 10 dB SILK,
 Vorbis 139 dB) and checks random seeks against the continuous decode.
diff --git a/crates/ogg/src/lib.rs b/crates/ogg/src/lib.rs
index a251cca3e..2f734b104 100644
--- a/crates/ogg/src/lib.rs
+++ b/crates/ogg/src/lib.rs
@@ -211,11 +211,12 @@ pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
     let mut warnings = Vec::new();
     let mut pos = 0u64;
     let mut found_any = false;
+    let mut recovery_budget = 64 << 20;
     let mut hdr = [0u8; 27 + 255];
     while pos + 27 <= len {
         src.read_at(pos, &mut hdr[..27])?;
         if &hdr[..4] != b"OggS" || hdr[4] != 0 {
-            match find_capture(src, pos + 1, len)? {
+            match find_capture(src, pos + 1, len, &mut recovery_budget)? {
                 Some(p) => {
                     if found_any {
                         warnings.push(format!("lost sync at byte {pos}; resumed at {p}"));
@@ -328,12 +329,13 @@ pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
     Ok(OggFile { streams, warnings })
 }
 
-fn find_capture(src: &(impl ByteSource + ?Sized), from: u64, len: u64) -> Result<Option<u64>> {
+fn find_capture(src: &(impl ByteSource + ?Sized), from: u64, len: u64, budget: &mut usize) -> Result<Option<u64>> {
     let mut at = from;
-    while at + 4 <= len {
-        let n = ((len - at) as usize).min(1 << 20);
+    while at + 4 <= len && *budget > 0 {
+        let n = ((len - at) as usize).min(1 << 20).min(*budget);
         let mut buf = vec![0u8; n];
         src.read_at(at, &mut buf)?;
+        *budget = budget.saturating_sub(n);
         if let Some(i) = buf.windows(4).position(|w| w == b"OggS") {
             return Ok(Some(at + i as u64));
         }
diff --git a/crates/ogg/src/tests.rs b/crates/ogg/src/tests.rs
index f1879b36b..b2d7c4c77 100644
--- a/crates/ogg/src/tests.rs
+++ b/crates/ogg/src/tests.rs
@@ -2,6 +2,15 @@
 
 use super::*;
 
+#[test]
+fn recovery_scan_stops_when_its_shared_budget_is_spent() {
+    let source = b"junkOggS".to_vec();
+    let mut budget = 3;
+    assert_eq!(find_capture(&source, 0, source.len() as u64, &mut budget).unwrap(), None);
+    let mut budget = source.len();
+    assert_eq!(find_capture(&source, 0, source.len() as u64, &mut budget).unwrap(), Some(4));
+}
+
 /// Write one page holding `segments` (lacing already computed by `lace`).
 fn page(out: &mut Vec<u8>, flags: u8, granule: i64, serial: u32, seq: u32, lacing: &[u8], body: &[u8]) {
     let start = out.len();
diff --git a/crates/opus/src/header.rs b/crates/opus/src/header.rs
index 2fe0c752a..2e51ce270 100644
--- a/crates/opus/src/header.rs
+++ b/crates/opus/src/header.rs
@@ -90,6 +90,38 @@ impl OpusHead {
         v
     }
 
+    /// Validate a header independently of its wire parser. This is required for callers of
+    /// [`crate::Decoder::from_head`], which may construct an `OpusHead` directly with `usize`
+    /// values that cannot occur in the byte format.
+    pub fn validate(&self) -> Result<()> {
+        if !(1..=255).contains(&self.channels) || self.mapping.len() != self.channels {
+            return Err(Error::InvalidHeader("bad channel count or mapping length"));
+        }
+        if self.mapping_family == 0 {
+            if self.channels > 2 || self.streams != 1 || self.coupled_streams != self.channels - 1 || self.mapping.iter().copied().ne(0..self.channels as u8) {
+                return Err(Error::InvalidHeader("invalid family 0 mapping"));
+            }
+            return Ok(());
+        }
+        if self.mapping_family == 3 {
+            return Err(Error::Unsupported("channel mapping family 3 (projection)"));
+        }
+        if self.streams == 0
+            || self.streams > 255
+            || self.coupled_streams > self.streams
+            || self.streams.checked_add(self.coupled_streams).is_none_or(|n| n > 255)
+        {
+            return Err(Error::InvalidHeader("bad stream counts"));
+        }
+        if self.mapping_family == 1 && !(1..=8).contains(&self.channels) {
+            return Err(Error::InvalidHeader("family 1 allows 1 to 8 channels"));
+        }
+        if self.mapping.iter().any(|&m| m != 255 && m as usize >= self.streams + self.coupled_streams) {
+            return Err(Error::InvalidHeader("channel mapping out of range"));
+        }
+        Ok(())
+    }
+
     fn build(channels: usize, pre_skip: u16, input_sample_rate: u32, output_gain: i16, family: u8, rest: &[u8]) -> Result<OpusHead> {
         if channels == 0 {
             return Err(Error::InvalidHeader("zero channels"));
@@ -120,7 +152,9 @@ impl OpusHead {
             }
             (streams, coupled, mapping)
         };
-        Ok(OpusHead { channels, pre_skip, input_sample_rate, output_gain, mapping_family: family, streams, coupled_streams: coupled, mapping })
+        let head = OpusHead { channels, pre_skip, input_sample_rate, output_gain, mapping_family: family, streams, coupled_streams: coupled, mapping };
+        head.validate()?;
+        Ok(head)
     }
 
     /// Linear output gain factor.
@@ -176,4 +210,19 @@ mod tests {
         assert_eq!(head.pre_skip, 312);
         assert_eq!(head.channels, 2);
     }
+
+    #[test]
+    fn directly_constructed_headers_are_checked_before_decoder_allocation() {
+        let head = OpusHead {
+            channels: 1,
+            pre_skip: 0,
+            input_sample_rate: 48_000,
+            output_gain: 0,
+            mapping_family: 255,
+            streams: usize::MAX,
+            coupled_streams: 0,
+            mapping: vec![0],
+        };
+        assert!(crate::Decoder::from_head(head, 48_000).is_err());
+    }
 }
diff --git a/crates/opus/src/multistream.rs b/crates/opus/src/multistream.rs
index a41ba10c3..f47c38179 100644
--- a/crates/opus/src/multistream.rs
+++ b/crates/opus/src/multistream.rs
@@ -32,6 +32,7 @@ impl Decoder {
 
     /// Creates a decoder for a parsed header at `sample_rate` (8/12/16/24/48 kHz).
     pub fn from_head(head: OpusHead, sample_rate: u32) -> Result<Decoder> {
+        head.validate()?;
         let mut streams = Vec::with_capacity(head.streams);
         for s in 0..head.streams {
             let ch = if s < head.coupled_streams { 2 } else { 1 };
diff --git a/crates/opus/tests/common/mod.rs b/crates/opus/tests/it/common/mod.rs
similarity index 86%
rename from crates/opus/tests/common/mod.rs
rename to crates/opus/tests/it/common/mod.rs
index 6c6ec2754..01cc76605 100644
--- a/crates/opus/tests/common/mod.rs
+++ b/crates/opus/tests/it/common/mod.rs
@@ -32,12 +32,15 @@ fn spectra(x: &[f32], channels: usize, ch: usize, rate: u32) -> Vec<[f64; NFREQ]
     let w: Vec<f64> = (0..win).map(|i| 0.5 - 0.5 * (2.0 * std::f64::consts::PI * (i as f64 + 0.5) / win as f64).cos()).collect();
     let nb = NFREQ / scale;
     let mut out = Vec::with_capacity(nframes);
+    let tw = twiddles(win);
     let mut buf = vec![(0f64, 0f64); win];
+    let mut spec = vec![(0f64, 0f64); win];
+    let mut scratch = vec![(0f64, 0f64); win];
     for f in 0..nframes {
         for i in 0..win {
             buf[i] = (x[(f * step + i) * channels + ch] as f64 * w[i], 0.0);
         }
-        let spec = fft(&buf);
+        fft(&buf, 1, &mut spec, &tw, &mut scratch);
         let mut ps = [0f64; NFREQ];
         for (k, p) in ps.iter_mut().enumerate().take(nb) {
             *p = spec[k].0 * spec[k].0 + spec[k].1 * spec[k].1;
@@ -47,28 +50,49 @@ fn spectra(x: &[f32], channels: usize, ch: usize, rate: u32) -> Vec<[f64; NFREQ]
     out
 }
 
-/// Recursive mixed-radix DFT (sizes with factors 2, 3, 5).
-fn fft(x: &[(f64, f64)]) -> Vec<(f64, f64)> {
-    let n = x.len();
+/// `e^(-2πi·j/n)` for `j` in `0..n`: the twiddle factors of every sub-transform of a size-`n` FFT.
+fn twiddles(n: usize) -> Vec<(f64, f64)> {
+    (0..n)
+        .map(|j| {
+            let ang = -2.0 * std::f64::consts::PI * j as f64 / n as f64;
+            (ang.cos(), ang.sin())
+        })
+        .collect()
+}
+
+/// Recursive mixed-radix DFT (sizes with factors 2, 3, 5) of `x[0], x[xs], x[2·xs], …` into
+/// `out`. `tw` is `twiddles` of the top-level size, which `out.len()` divides; `scratch` holds at
+/// least `out.len()` values.
+fn fft(x: &[(f64, f64)], xs: usize, out: &mut [(f64, f64)], tw: &[(f64, f64)], scratch: &mut [(f64, f64)]) {
+    let n = out.len();
     if n == 1 {
-        return x.to_vec();
+        out[0] = x[0];
+        return;
     }
     let p = [2usize, 3, 5].into_iter().find(|p| n.is_multiple_of(*p)).unwrap_or(n);
     let m = n / p;
-    let subs: Vec<Vec<(f64, f64)>> = (0..p).map(|r| fft(&x.iter().skip(r).step_by(p).copied().collect::<Vec<_>>())).collect();
-    let mut out = vec![(0f64, 0f64); n];
-    for (k, o) in out.iter_mut().enumerate() {
+    let stride = tw.len() / n;
+    for r in 0..p {
+        fft(&x[r * xs..], xs * p, &mut out[r * m..(r + 1) * m], tw, scratch);
+    }
+    for (k, o) in scratch[..n].iter_mut().enumerate() {
+        let j = k % m;
         let mut acc = (0f64, 0f64);
-        for (r, sub) in subs.iter().enumerate() {
-            let v = sub[k % m];
-            let ang = -2.0 * std::f64::consts::PI * (r * k) as f64 / n as f64;
-            let (c, s) = (ang.cos(), ang.sin());
+        // e = r·k mod n, kept below n without a division per term.
+        let mut e = 0;
+        for r in 0..p {
+            let v = out[r * m + j];
+            let (c, s) = tw[e * stride];
             acc.0 += v.0 * c - v.1 * s;
             acc.1 += v.0 * s + v.1 * c;
+            e += k;
+            if e >= n {
+                e -= n;
+            }
         }
         *o = acc;
     }
-    out
+    out.copy_from_slice(&scratch[..n]);
 }
 
 /// Opus quality metric in the spirit of `opus_compare` (RFC 6716 §6.1): a per-band,
diff --git a/crates/opus/tests/it/main.rs b/crates/opus/tests/it/main.rs
new file mode 100644
index 000000000..48dc2080a
--- /dev/null
+++ b/crates/opus/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod common;
+mod oracle;
+mod robustness;
+mod vectors;
diff --git a/crates/opus/tests/oracle.rs b/crates/opus/tests/it/oracle.rs
similarity index 99%
rename from crates/opus/tests/oracle.rs
rename to crates/opus/tests/it/oracle.rs
index 0917479ed..f80236737 100644
--- a/crates/opus/tests/oracle.rs
+++ b/crates/opus/tests/it/oracle.rs
@@ -7,7 +7,7 @@
 //! streams containing SILK differ by the (non-normative) SILK resampler, so they are held to a
 //! lower SNR bound and the spectral quality metric.
 
-mod common;
+use crate::common;
 
 use std::process::Command;
 
diff --git a/crates/opus/tests/robustness.rs b/crates/opus/tests/it/robustness.rs
similarity index 100%
rename from crates/opus/tests/robustness.rs
rename to crates/opus/tests/it/robustness.rs
diff --git a/crates/opus/tests/vectors.rs b/crates/opus/tests/it/vectors.rs
similarity index 99%
rename from crates/opus/tests/vectors.rs
rename to crates/opus/tests/it/vectors.rs
index e36529b7c..7b36fbe7a 100644
--- a/crates/opus/tests/vectors.rs
+++ b/crates/opus/tests/it/vectors.rs
@@ -7,7 +7,7 @@
 //! `.dec` output using our implementation of the opus_compare-style quality metric
 //! (see `common::opus_quality`), for stereo (`.dec`) and mono (`m.dec`) output at 48 kHz.
 
-mod common;
+use crate::common;
 
 use std::path::PathBuf;
 
diff --git a/crates/platform/README.md b/crates/platform/README.md
index b78c57735..00371ba97 100644
--- a/crates/platform/README.md
+++ b/crates/platform/README.md
@@ -289,18 +289,18 @@ level 4 High tier, which many hardware decoders refuse; it is now level 4.1 Main
 
 | test | what |
 |---|---|
-| `tests/videotoolbox.rs` (macOS) | H.264 High, HEVC Main (open GOP: CRA + RASL) and HEVC Main 10, 640×360 (coded 368: cropping) with B-frames: every picture **bit-exact** with our software decoder, same pts order, count, colour and aspect, also after `reset` + reseek to every later sync sample, mid-stream `flush`, and a full pass after resets; forced mid-stream failures (`VtDecoder::fail_after`) at five points continue with the software decoder's exact output; seeded mutation of samples and parameter sets (bit flips, truncation, corrupt length prefixes) never panics or hangs; HEVC 4:2:2 10-bit is bit-exact with ffmpeg's decode |
-| `tests/fallback.rs` (every OS) | `HybridDecoder` with a stand-in hardware decoder failing after N samples (every sync sample ± a few, first / last sample, after a seek): output identical to the software decoder; in-band parameter sets identical to the sample entry's stay in hardware, different ones switch to software |
+| `tests/it/videotoolbox.rs` (macOS) | H.264 High, HEVC Main (open GOP: CRA + RASL) and HEVC Main 10, 640×360 (coded 368: cropping) with B-frames: every picture **bit-exact** with our software decoder, same pts order, count, colour and aspect, also after `reset` + reseek to every later sync sample, mid-stream `flush`, and a full pass after resets; forced mid-stream failures (`VtDecoder::fail_after`) at five points continue with the software decoder's exact output; seeded mutation of samples and parameter sets (bit flips, truncation, corrupt length prefixes) never panics or hangs; HEVC 4:2:2 10-bit is bit-exact with ffmpeg's decode |
+| `tests/it/fallback.rs` (every OS) | `HybridDecoder` with a stand-in hardware decoder failing after N samples (every sync sample ± a few, first / last sample, after a seek): output identical to the software decoder; in-band parameter sets identical to the sample entry's stay in hardware, different ones switch to software |
 | `tests/setting.rs` | Hardware decoding Off gives the software decoder through `make_video_decoder` and the media stack (no hardware frames); Auto gives VideoToolbox where available |
-| `tests/hardware_encode.rs` (macOS) | what the hardware path takes and declines; round trip through our software decoder (every picture, in order, luma PSNR above 30 dB, keyframes no further apart than asked, no composition offsets); an export through `filmcraft_export` that decodes in our decoder and in ffmpeg / ffprobe (profile, size, frame count, BT.709); the built-in encoder still exporting everything hardware declines; exact output size at sizes that are not multiples of 16; hostile configurations (zero, huge, odd sizes, frame rates, bitrates, keyframe intervals, wrong planes) give errors and never panic; encoders dropped at any point do not crash or hang. The same for **HEVC**: Main profile, 8-bit 4:2:0, `hvc1` entry with VPS / SPS / PPS and 4-byte lengths, MP4 and QuickTime, AAC audio, two-pass refused, the format list agreeing with the probe, ffprobe reading `codec_name=hevc`, `profile=Main`, `codec_tag_string=hvc1`, `pix_fmt=yuv420p`, BT.709 |
-| `tests/nvenc.rs` (Windows / Linux, NVIDIA) | H.264 from NVENC (1280×720, 6 Mbps, 72 frames) decodes with our decoder at worst 46.9 dB luma PSNR; IDR at 0, 24 and 48; dts / pts right |
-| `tests/nvenc_export.rs` (Windows / Linux; fallback also tested without NVIDIA) | Export with hardware encoding against the software encoder through the export pipeline: the two decoded files at worst 54.8 dB luma PSNR; ffmpeg decodes the file without errors; declined cases go to the software encoder; the counters |
-| `tests/nvenc_hevc.rs` (Windows, NVIDIA with HEVC) | HEVC from NVENC (1280×720, 6 Mbps, 72 frames, keyframe every 24) decodes with our HEVC decoder at worst 48.9 dB luma / 51.0 dB chroma PSNR; IDR at 0, 24, 48; dts strictly increasing, pts a permutation, `sps_max_num_reorder_pics` within the dts shift; no parameter sets in the samples; the `hvcC`'s profile / tier / level bytes are the SPS's own; VUI BT.709 limited and timing `(1, 24)`; hostile configurations, sizes, planes and encoders dropped mid-stream give errors, never panics; keyframes every 1–2 pictures without B-frames |
-| `tests/nvenc_hevc_export.rs` (Windows, NVIDIA with HEVC) | H.265 export through the real pipeline, MP4 and QuickTime, toggle Auto and Off: counters (72 frames, 1 session, 0 declined), our decoder against the software H.264 export at worst 54.8 dB luma PSNR, ffprobe `codec_name=hevc`, `profile=Main`, `codec_tag_string=hvc1`, `pix_fmt=yuv420p`, BT.709 limited, 72 frames, 24/1, keyframes at 0 and 48, start 0, `ffmpeg -xerror` clean; with AAC audio; 1920×1080 and 642×362 cropped back from the coded size; every decline (HDR, analysis pass, two-pass, interlaced, non-square pixels, MXF, sizes over 65535, odd sizes, sizes outside the GPU's limits) an error naming NVENC, counted once; H.264 with hardware encoding Off never touches NVENC |
-| `tests/nvenc_rgba_input.rs` (Windows, NVIDIA) | RGBA input, HEVC Main and H.264 High, 1280×720: solid red, green, blue, white, black and grey decode (our decoder) to the exact BT.709 limited codes of `rgba_to_yuv420_8`, within 2; a moving picture at worst 47.7 dB luma / 50.7 dB chroma PSNR against that conversion; Main 10 has no RGBA input; short pictures and planar / RGBA pictures for the other kind of encoder are errors |
-| `tests/nvenc_hevc_probe.rs` (Windows) | the HEVC probe in a fresh process: its cost, the cached answer, `available(Hevc)` following it after `register()` (twice) |
+| `tests/it/hardware_encode.rs` (macOS) | what the hardware path takes and declines; round trip through our software decoder (every picture, in order, luma PSNR above 30 dB, keyframes no further apart than asked, no composition offsets); an export through `filmcraft_export` that decodes in our decoder and in ffmpeg / ffprobe (profile, size, frame count, BT.709); the built-in encoder still exporting everything hardware declines; exact output size at sizes that are not multiples of 16; hostile configurations (zero, huge, odd sizes, frame rates, bitrates, keyframe intervals, wrong planes) give errors and never panic; encoders dropped at any point do not crash or hang. The same for **HEVC**: Main profile, 8-bit 4:2:0, `hvc1` entry with VPS / SPS / PPS and 4-byte lengths, MP4 and QuickTime, AAC audio, two-pass refused, the format list agreeing with the probe, ffprobe reading `codec_name=hevc`, `profile=Main`, `codec_tag_string=hvc1`, `pix_fmt=yuv420p`, BT.709 |
+| `tests/it/nvenc.rs` (Windows / Linux, NVIDIA) | H.264 from NVENC (1280×720, 6 Mbps, 72 frames) decodes with our decoder at worst 46.9 dB luma PSNR; IDR at 0, 24 and 48; dts / pts right |
+| `tests/it/nvenc_export.rs` (Windows / Linux; fallback also tested without NVIDIA) | Export with hardware encoding against the software encoder through the export pipeline: the two decoded files at worst 54.8 dB luma PSNR; ffmpeg decodes the file without errors; declined cases go to the software encoder; the counters |
+| `tests/it/nvenc_hevc.rs` (Windows, NVIDIA with HEVC) | HEVC from NVENC (1280×720, 6 Mbps, 72 frames, keyframe every 24) decodes with our HEVC decoder at worst 48.9 dB luma / 51.0 dB chroma PSNR; IDR at 0, 24, 48; dts strictly increasing, pts a permutation, `sps_max_num_reorder_pics` within the dts shift; no parameter sets in the samples; the `hvcC`'s profile / tier / level bytes are the SPS's own; VUI BT.709 limited and timing `(1, 24)`; hostile configurations, sizes, planes and encoders dropped mid-stream give errors, never panics; keyframes every 1–2 pictures without B-frames |
+| `tests/it/nvenc_hevc_export.rs` (Windows, NVIDIA with HEVC) | H.265 export through the real pipeline, MP4 and QuickTime, toggle Auto and Off: counters (72 frames, 1 session, 0 declined), our decoder against the software H.264 export at worst 54.8 dB luma PSNR, ffprobe `codec_name=hevc`, `profile=Main`, `codec_tag_string=hvc1`, `pix_fmt=yuv420p`, BT.709 limited, 72 frames, 24/1, keyframes at 0 and 48, start 0, `ffmpeg -xerror` clean; with AAC audio; 1920×1080 and 642×362 cropped back from the coded size; every decline (HDR, analysis pass, two-pass, interlaced, non-square pixels, MXF, sizes over 65535, odd sizes, sizes outside the GPU's limits) an error naming NVENC, counted once; H.264 with hardware encoding Off never touches NVENC |
+| `tests/it/nvenc_rgba_input.rs` (Windows, NVIDIA) | RGBA input, HEVC Main and H.264 High, 1280×720: solid red, green, blue, white, black and grey decode (our decoder) to the exact BT.709 limited codes of `rgba_to_yuv420_8`, within 2; a moving picture at worst 47.7 dB luma / 50.7 dB chroma PSNR against that conversion; Main 10 has no RGBA input; short pictures and planar / RGBA pictures for the other kind of encoder are errors |
+| `tests/it/nvenc_hevc_probe.rs` (Windows) | the HEVC probe in a fresh process: its cost, the cached answer, `available(Hevc)` following it after `register()` (twice) |
 | `tests/nvenc_hevc_warm.rs` (Windows) | `register()` answers the HEVC and the Main 10 questions on a thread of its own, before anyone asks; the answers are kept and `hdr_available(Hevc)` follows the Main 10 probe |
-| `tests/nvenc_hevc_main10.rs` (Windows, NVIDIA with 10-bit HEVC) | HEVC Main 10 in process, PQ and HLG: a float picture (grey ramp to peak white, a moving box, saturated BT.2020 bars) is converted with `rgbf_to_yuv420_10`, encoded and decoded with our HEVC decoder (`Yuv16`, 10 bits, codes below 1024): worst 71.1 dB luma / 70.6 dB chroma PSNR on the 10-bit scale, 803 distinct luma levels on a ramp row, peak code 940 survives; IDR at 0 and 24; the VUI is BT.2020 / 16 or 18 / BT.2020 NCL / limited; the IDR samples carry two prefix SEI NAL units whose messages are byte-for-byte the expected 137 / 144 payloads (HLG: none; other pictures: none); Main and Main 10 refuse each other's pictures; hostile sizes, bitrates, signals, huge or empty SEI payloads, encoders dropped with SEI in flight |
+| `tests/it/nvenc_hevc_main10.rs` (Windows, NVIDIA with 10-bit HEVC) | HEVC Main 10 in process, PQ and HLG: a float picture (grey ramp to peak white, a moving box, saturated BT.2020 bars) is converted with `rgbf_to_yuv420_10`, encoded and decoded with our HEVC decoder (`Yuv16`, 10 bits, codes below 1024): worst 71.1 dB luma / 70.6 dB chroma PSNR on the 10-bit scale, 803 distinct luma levels on a ramp row, peak code 940 survives; IDR at 0 and 24; the VUI is BT.2020 / 16 or 18 / BT.2020 NCL / limited; the IDR samples carry two prefix SEI NAL units whose messages are byte-for-byte the expected 137 / 144 payloads (HLG: none; other pictures: none); Main and Main 10 refuse each other's pictures; hostile sizes, bitrates, signals, huge or empty SEI payloads, encoders dropped with SEI in flight |
 | `tests/nvenc_hevc_hdr_export.rs` (Windows, NVIDIA with 10-bit HEVC) | HDR sequences through the real export job (PQ MP4, HLG MP4, PQ QuickTime): 24 frames, 1 session, 0 declined; ffprobe `hevc` / `Main 10` / `hvc1` / `yuv420p10le`, `bt2020` / `smpte2084` or `arib-std-b67` / `bt2020nc` / `tv`; PQ first-frame side data Mastering display (max 10000000/10000, min 1/10000) and Content light level, HLG none; `ffmpeg -xerror` clean; ffmpeg's yuv420p10le picture equals our decoder's, code for code; our importer reads PQ / HLG, BT.2020, 10-bit, and the `colr` / `mdcv` / `clli` boxes; luma PSNR against a ProRes HDR export of the same sequence 62.6 dB (PQ) / 61.8 dB (HLG); `settings.sdr` and SDR sequences stay Main 8-bit BT.709 with no HDR boxes; the factory rejects mismatched or wrong-length pictures and clamps NaN / infinity |
 | `src/nvenc/abi_tests.rs` (Windows / Linux) | FFI structs' sizes, alignments, field offsets, constants, GUIDs and the bit-field masks of the `flags` words (H.264, HEVC, and the HEVC picture parameters with the SEI payload array) against a C compiler's view of NVIDIA's `nvEncodeAPI.h` (12.1) |
 | `src/nvenc/{mod,hevc,export}.rs` unit tests (Windows) | HEVC NAL types, stripping and parameter-set splitting (including `IDR_N_LP`, whose header byte reads as a PPS in H.264, and one-byte or truncated NAL units); the `hvcC` built from real VPS / SPS / PPS (Main and Main 10: accepted as what was asked for, refused as the other, other depths refused), every truncation and bit flip of the SPS, wrong profile, size and NAL types; HEVC levels; P010 layout (shift, little-endian, interleaving, pitch in bytes, narrow pitches and short buffers); the 10-bit capability decline; the SEI messages |
diff --git a/crates/platform/src/hybrid.rs b/crates/platform/src/hybrid.rs
index c010e79e0..8323938b8 100644
--- a/crates/platform/src/hybrid.rs
+++ b/crates/platform/src/hybrid.rs
@@ -21,6 +21,9 @@ const LOG_MAX_SAMPLES: usize = 600;
 const LOG_MAX_BYTES: usize = 256 << 20;
 /// Presentation times remembered as returned (older ones are forgotten first).
 const EMITTED_MAX: usize = 4096;
+/// Pictures held while software replays a hardware run.  The replay log is bounded by bytes and
+/// samples, but an invalid stream can still make one sample produce many decoded pictures.
+const REPLAY_OUTPUT_MAX: usize = 4096;
 
 /// A hardware decoder with a transparent software fallback.
 pub struct HybridDecoder {
@@ -99,6 +102,16 @@ impl HybridDecoder {
         }
     }
 
+    /// Retain software replay output without letting a corrupt access unit turn the bounded
+    /// sample replay into an unbounded frame queue.
+    fn retain_replay(frames: &mut Vec<DecodedFrame>, mut out: Vec<DecodedFrame>) -> Result<()> {
+        if frames.len().saturating_add(out.len()) > REPLAY_OUTPUT_MAX {
+            return Err(CodecError::Decode("software fallback replay produced too many frames".into()));
+        }
+        frames.append(&mut out);
+        Ok(())
+    }
+
     /// In-band parameter sets (sequence header, key frame format) that differ from the sample
     /// entry's (the hardware session was set up from those).
     fn parameter_sets_changed(&self, sample: &[u8]) -> bool {
@@ -157,7 +170,7 @@ impl HybridDecoder {
         for (i, (s, p)) in log.iter().enumerate() {
             let Some(sw) = self.sw.as_mut() else { break };
             match sw.decode(s, *p) {
-                Ok(out) => frames.extend(out),
+                Ok(out) => Self::retain_replay(&mut frames, out)?,
                 Err(e) if i == last => rejected = Some(e),
                 Err(e) => log::warn!("software replay after the hardware decoder failed: {e}"),
             }
@@ -250,3 +263,24 @@ impl VideoDecoder for HybridDecoder {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use filmcraft_frame::VideoFrame;
+
+    use super::*;
+
+    fn frame(pts: i64) -> DecodedFrame {
+        DecodedFrame { pts, frame: VideoFrame::rgba8(1, 1, vec![0, 0, 0, 255]), draft: false }
+    }
+
+    #[test]
+    fn replay_output_has_a_hard_limit() {
+        let mut retained = Vec::new();
+        HybridDecoder::retain_replay(&mut retained, (0..REPLAY_OUTPUT_MAX as i64).map(frame).collect()).unwrap();
+
+        let err = HybridDecoder::retain_replay(&mut retained, vec![frame(REPLAY_OUTPUT_MAX as i64)]).unwrap_err();
+        assert!(err.to_string().contains("too many frames"));
+        assert_eq!(retained.len(), REPLAY_OUTPUT_MAX);
+    }
+}
diff --git a/crates/platform/src/nvenc/export.rs b/crates/platform/src/nvenc/export.rs
index 4344cb52f..2f83fa00f 100644
--- a/crates/platform/src/nvenc/export.rs
+++ b/crates/platform/src/nvenc/export.rs
@@ -108,7 +108,7 @@ impl VideoEncoder for NvencEncoder {
             return Err(ExportError::Encode(format!("NVENC: a {}x{} picture for a {}x{} encoder", f.width, f.height, self.w, self.h)));
         }
         let (w, h) = (self.w as usize, self.h as usize);
-        let hint = if self.enc.codec() == Codec::H264 { " (turn Export ▸ Hardware encoding off to use the software encoder)" } else { "" };
+        let hint = if self.enc.codec() == Codec::H264 { " (turn Export > Hardware encoding off to use the software encoder)" } else { "" };
         let ps = match (self.enc.is_ten_bit(), f.hdr) {
             // Main 10 takes the encoded R'G'B' floats: 10-bit limited-range BT.2020 NCL (or the signal's matrix)
             (true, Some(rgb)) => {
diff --git a/crates/platform/src/vaapi/h264.rs b/crates/platform/src/vaapi/h264.rs
index bc79ee9a4..6e709c4ad 100644
--- a/crates/platform/src/vaapi/h264.rs
+++ b/crates/platform/src/vaapi/h264.rs
@@ -333,7 +333,7 @@ impl<A: Accel> Front<A> {
         let fpoc = if mmco5 { 0 } else { p.poc.frame() };
         let meta = Arc::new(output_meta(&p.sps, p.pts, p.first.idr));
         let mut outs = Vec::new();
-        self.dpb.store_picture(&p.first, surface, fpoc, p.sps.max_frame_num(), p.sps.max_num_ref_frames as usize, meta, &mut outs);
+        self.dpb.store_picture(&p.first, surface, fpoc, p.sps.max_frame_num(), p.sps.max_num_ref_frames as usize, meta, &mut outs).map_err(decode_err)?;
         self.read_out(outs, frames)
     }
 }
diff --git a/crates/platform/src/videotoolbox.rs b/crates/platform/src/videotoolbox.rs
index 2ac6723ca..b1c04740b 100644
--- a/crates/platform/src/videotoolbox.rs
+++ b/crates/platform/src/videotoolbox.rs
@@ -48,6 +48,16 @@ const NV16_VIDEO: u32 = u32::from_be_bytes(*b"422v");
 const NV16_FULL: u32 = u32::from_be_bytes(*b"422f");
 const P210_VIDEO: u32 = u32::from_be_bytes(*b"x422");
 const P210_FULL: u32 = u32::from_be_bytes(*b"xf22");
+/// H.264 and HEVC parameter parsing both enforce a maximum decoded-picture
+/// buffer and reorder depth of 16 pictures.
+const MAX_REORDER_DEPTH: usize = 16;
+
+fn validate_reorder_depth(reorder: usize) -> std::result::Result<(), String> {
+    if reorder > MAX_REORDER_DEPTH {
+        return Err("VideoToolbox reorder depth is too large".into());
+    }
+    Ok(())
+}
 
 /// How decoded buffers are laid out and what each output picture carries.
 #[derive(Clone, Debug)]
@@ -437,6 +447,7 @@ impl VtDecoder {
     /// A decoder for the stream, or why VideoToolbox does not take it (unsupported format, no
     /// hardware decoder, session creation failed).
     pub fn new(info: NalStreamInfo) -> std::result::Result<Self, String> {
+        validate_reorder_depth(info.reorder)?;
         let layout = layout(&info)?;
         if !hardware_available(info.codec) {
             return Err("no hardware decoder".into());
@@ -569,3 +580,14 @@ impl VideoDecoder for VtDecoder {
         self.info.is_disposable(sample)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reorder_depth_matches_supported_stream_limits() {
+        assert!(validate_reorder_depth(MAX_REORDER_DEPTH).is_ok());
+        assert!(validate_reorder_depth(MAX_REORDER_DEPTH + 1).is_err());
+    }
+}
diff --git a/crates/platform/tests/common/mod.rs b/crates/platform/tests/it/common/mod.rs
similarity index 96%
rename from crates/platform/tests/common/mod.rs
rename to crates/platform/tests/it/common/mod.rs
index e4f39c59e..74f11bdae 100644
--- a/crates/platform/tests/common/mod.rs
+++ b/crates/platform/tests/it/common/mod.rs
@@ -9,6 +9,10 @@ use filmcraft_codecs::{DecodedFrame, VideoDecoder};
 use filmcraft_frame::PixelData;
 use filmcraft_isobmff::SampleEntry;
 
+/// NVENC sessions are a limited resource on consumer GPUs, and the encoder counters are
+/// process-wide: one NVENC test at a time across every module of the binary.
+pub static NVENC_SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
 /// The parity fixtures: (file, ffmpeg arguments). B-frames everywhere (reordering), a 360-line
 /// picture (coded 368: cropping), two GOPs or more (seeks), and an open-GOP HEVC stream (CRA with
 /// RASL pictures).
diff --git a/crates/platform/tests/fallback.rs b/crates/platform/tests/it/fallback.rs
similarity index 84%
rename from crates/platform/tests/fallback.rs
rename to crates/platform/tests/it/fallback.rs
index 8c00e52f5..3b7da8d5c 100644
--- a/crates/platform/tests/fallback.rs
+++ b/crates/platform/tests/it/fallback.rs
@@ -5,7 +5,7 @@
 //! damaged sample that the hardware decoded but the software decoder rejects, inside the replayed
 //! run, loses no picture.
 
-mod common;
+use crate::common;
 
 use common::*;
 use filmcraft_codecs::hw::NalStreamInfo;
@@ -51,30 +51,31 @@ fn failures_anywhere_continue_with_the_software_output() {
     for (name, _) in FIXTURES {
         let Some(path) = named(&ff, name) else { continue };
         let s = read_stream(&path);
-        let reference = decode_all(filmcraft_codecs::software_video_decoder(&s.entry).unwrap().as_mut(), &s.samples);
         let syncs: Vec<usize> = (0..s.samples.len()).filter(|&i| s.sync[i]).collect();
-        let mut points: Vec<usize> = vec![0, 1, 3, 7, s.samples.len() - 1, s.samples.len()];
-        for &k in &syncs {
-            points.extend([k, k + 1, k + 2, k + 5]);
-        }
+        let [_, k, .., last] = syncs[..] else { panic!("{name}: three GOPs or more") };
+        // The stream up to a few samples into its last GOP: past the last failure point the
+        // hybrid only passes the software decoder's output on.
+        let samples = &s.samples[..(last + 6).min(s.samples.len())];
+        let reference = decode_all(filmcraft_codecs::software_video_decoder(&s.entry).unwrap().as_mut(), samples);
+        // The hybrid's paths differ by what the replay log holds and what the hardware had
+        // pending: in the first GOP (nothing out yet, then pictures held for reordering), at and
+        // just after the second restart point (the log starts over, or an HEVC CRA keeps the GOP
+        // before it), at the last one (a CRA drops the GOP before the previous one), at the last
+        // sample and never. Failing anywhere else takes one of those paths.
+        let points = [0, 1, 3, 7, k, k + 1, k + 2, k + 5, last, last + 2, samples.len() - 1, samples.len()];
         for fail_after in points {
             let mut d = hybrid(&s, fail_after);
-            let out = decode_all(&mut d, &s.samples);
-            assert_eq!(d.is_hardware(), fail_after >= s.samples.len(), "{name}: fell back at {fail_after}");
+            let out = decode_all(&mut d, samples);
+            assert_eq!(d.is_hardware(), fail_after >= samples.len(), "{name}: fell back at {fail_after}");
             assert_same(&format!("{name} failing after {fail_after} samples"), &out, &reference);
         }
         // a failure after a seek (reset) into the second GOP
-        if let Some(&k) = syncs.get(1) {
-            let tail = &s.samples[k..];
-            let expect = {
-                let mut sw = filmcraft_codecs::software_video_decoder(&s.entry).unwrap();
-                decode_all(sw.as_mut(), tail)
-            };
-            let mut d = hybrid(&s, k + 4);
-            decode_all(&mut d, &s.samples[..k]);
-            d.reset();
-            assert_same(&format!("{name} failing after a seek"), &decode_all(&mut d, tail), &expect);
-        }
+        let tail = &samples[k..];
+        let expect = decode_all(filmcraft_codecs::software_video_decoder(&s.entry).unwrap().as_mut(), tail);
+        let mut d = hybrid(&s, k + 4);
+        decode_all(&mut d, &samples[..k]);
+        d.reset();
+        assert_same(&format!("{name} failing after a seek"), &decode_all(&mut d, tail), &expect);
     }
 }
 
@@ -179,7 +180,9 @@ fn a_sample_software_rejects_during_the_replay_loses_no_pictures() {
         // the second restart point, and a disposable picture before it that is not the first sample
         let Some(next) = (1..s.samples.len()).find(|&i| s.sync[i]) else { continue };
         let Some(d) = (2..next.saturating_sub(2)).find(|&i| info.is_disposable(&s.samples[i].0)) else { continue };
-        let mut stream = s.samples.clone();
+        // the first two GOPs: the replay and the restart after it
+        let end = (next + 1..s.samples.len()).find(|&i| s.sync[i]).unwrap_or(s.samples.len());
+        let mut stream = s.samples[..end].to_vec();
         stream[d].0 = damaged(&s.samples[d].0, header);
         let (reference, rejected) = decode_lenient(filmcraft_codecs::software_video_decoder(&s.entry).unwrap().as_mut(), &stream);
         assert_eq!(rejected, [d], "{name}: the software decoder rejects the damaged sample (and only it)");
diff --git a/crates/platform/tests/hardware_encode.rs b/crates/platform/tests/it/hardware_encode.rs
similarity index 100%
rename from crates/platform/tests/hardware_encode.rs
rename to crates/platform/tests/it/hardware_encode.rs
diff --git a/crates/platform/tests/hevc_probe.rs b/crates/platform/tests/it/hevc_probe.rs
similarity index 100%
rename from crates/platform/tests/hevc_probe.rs
rename to crates/platform/tests/it/hevc_probe.rs
diff --git a/crates/platform/tests/it/main.rs b/crates/platform/tests/it/main.rs
new file mode 100644
index 000000000..b863c7d04
--- /dev/null
+++ b/crates/platform/tests/it/main.rs
@@ -0,0 +1,13 @@
+mod common;
+mod fallback;
+mod hardware_encode;
+mod hevc_probe;
+mod media_foundation;
+mod nvenc;
+mod nvenc_export;
+mod nvenc_hevc;
+mod nvenc_hevc_export;
+mod nvenc_hevc_main10;
+mod nvenc_hevc_probe;
+mod nvenc_rgba_input;
+mod videotoolbox;
diff --git a/crates/platform/tests/media_foundation.rs b/crates/platform/tests/it/media_foundation.rs
similarity index 99%
rename from crates/platform/tests/media_foundation.rs
rename to crates/platform/tests/it/media_foundation.rs
index 31c53a7b7..5b7a09d7f 100644
--- a/crates/platform/tests/media_foundation.rs
+++ b/crates/platform/tests/it/media_foundation.rs
@@ -6,7 +6,7 @@
 //! hang. Skips without ffmpeg (fixture generator) or without a hardware decoder.
 #![cfg(target_os = "windows")]
 
-mod common;
+use crate::common;
 
 use std::time::Duration;
 
diff --git a/crates/platform/tests/nvenc.rs b/crates/platform/tests/it/nvenc.rs
similarity index 100%
rename from crates/platform/tests/nvenc.rs
rename to crates/platform/tests/it/nvenc.rs
diff --git a/crates/platform/tests/nvenc_export.rs b/crates/platform/tests/it/nvenc_export.rs
similarity index 95%
rename from crates/platform/tests/nvenc_export.rs
rename to crates/platform/tests/it/nvenc_export.rs
index e0d32a20c..d02bcca35 100644
--- a/crates/platform/tests/nvenc_export.rs
+++ b/crates/platform/tests/it/nvenc_export.rs
@@ -13,9 +13,6 @@ use filmcraft_project::{ItemKind, Label, MediaClip, MediaRef, Project, SequenceS
 use filmcraft_render::SourceMap;
 use filmcraft_time::{FrameRate, Tick, TimeRange};
 
-/// The encoder counters are process-wide: one test at a time.
-static SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
 fn project(w: u32, h: u32, frames: i64) -> (Arc<Project>, filmcraft_project::ItemId, SourceMap) {
     let rate = FrameRate::FPS_24;
     let mut p = Project::new("x");
@@ -79,7 +76,7 @@ fn settings(path: String, hw: HardwareEncoding) -> ExportSettings {
 
 #[test]
 fn hardware_export_matches_the_software_export() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     let (p, seq, m) = project(1280, 720, 72);
     let soft_path = tmp("soft.mp4");
@@ -117,7 +114,7 @@ fn hardware_export_matches_the_software_export() {
 
 #[test]
 fn what_nvenc_does_not_take_goes_to_the_software_encoder() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     let (p, seq, m) = project(640, 360, 24);
     let run = |name: &str, f: &dyn Fn(&mut ExportSettings)| {
diff --git a/crates/platform/tests/nvenc_hevc.rs b/crates/platform/tests/it/nvenc_hevc.rs
similarity index 95%
rename from crates/platform/tests/nvenc_hevc.rs
rename to crates/platform/tests/it/nvenc_hevc.rs
index acd2bee9b..f0aebcc45 100644
--- a/crates/platform/tests/nvenc_hevc.rs
+++ b/crates/platform/tests/it/nvenc_hevc.rs
@@ -43,9 +43,6 @@ fn config(w: u32, h: u32) -> Config {
     }
 }
 
-/// NVENC sessions are a limited resource on consumer GPUs: one test at a time.
-static SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
 type Sources = Vec<(Vec<u8>, Vec<u8>, Vec<u8>)>;
 
 /// `None` (the test skips) only on a machine without an HEVC encoder; on one that has it, a
@@ -94,7 +91,7 @@ fn hex(b: &[u8]) -> String {
 
 #[test]
 fn the_stream_decodes_to_the_source() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let (w, h) = (1280u32, 720u32);
     let Some((enc, packets, sources)) = encode_all(&config(w, h), 72) else { return };
     assert_eq!(enc.codec(), Codec::Hevc);
@@ -179,7 +176,7 @@ fn the_stream_decodes_to_the_source() {
 
 #[test]
 fn nothing_to_encode_with_is_an_error_not_a_crash() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC here");
         return;
@@ -222,7 +219,7 @@ fn calm<T>(what: &str, f: impl FnOnce() -> T) -> T {
 
 #[test]
 fn hostile_configurations_give_errors_not_crashes() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC here");
         return;
@@ -266,7 +263,7 @@ fn hostile_configurations_give_errors_not_crashes() {
 
 #[test]
 fn an_encoder_dropped_mid_stream_releases_everything() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC here");
         return;
@@ -285,7 +282,7 @@ fn an_encoder_dropped_mid_stream_releases_everything() {
 
 #[test]
 fn high_bitrates_move_up_a_level_and_stay_in_the_main_tier() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     // 1080p30 at a 12 / 18 Mbit/s peak: above level 4's Main tier (12), where NVENC's own choice was
     // level 4 High tier, which many hardware decoders refuse
     for (w, h, fps, kbps, max_kbps, level_idc) in
@@ -302,7 +299,7 @@ fn high_bitrates_move_up_a_level_and_stay_in_the_main_tier() {
 
 #[test]
 fn a_keyframe_every_one_or_two_pictures_is_written_without_b_frames() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     // NVENC wants a GOP longer than the B-frame pattern: short GOPs drop the B-frames, they do not fail
     for keyint in [1u32, 2] {
         let cfg = Config { keyint, ..config(640, 360) };
@@ -324,7 +321,7 @@ fn a_keyframe_every_one_or_two_pictures_is_written_without_b_frames() {
 
 #[test]
 fn vui_timing_matches_integer_and_fractional_frame_rates() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     for fps in [(24, 1), (25, 1), (30_000, 1_001)] {
         let mut cfg = config(640, 360);
         cfg.fps = fps;
diff --git a/crates/platform/tests/nvenc_hevc_export.rs b/crates/platform/tests/it/nvenc_hevc_export.rs
similarity index 97%
rename from crates/platform/tests/nvenc_hevc_export.rs
rename to crates/platform/tests/it/nvenc_hevc_export.rs
index 95f074bb8..5fb79a9f7 100644
--- a/crates/platform/tests/nvenc_hevc_export.rs
+++ b/crates/platform/tests/it/nvenc_hevc_export.rs
@@ -21,9 +21,6 @@ use filmcraft_project::{ItemKind, Label, MediaClip, MediaRef, Project, SequenceS
 use filmcraft_render::SourceMap;
 use filmcraft_time::{FrameRate, Tick, TimeRange};
 
-/// The encoder counters are process-wide: one test at a time.
-static SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
 fn project(w: u32, h: u32, frames: i64) -> (Arc<Project>, filmcraft_project::ItemId, SourceMap) {
     let rate = FrameRate::FPS_24;
     let mut p = Project::new("x");
@@ -115,7 +112,7 @@ fn delta(before: filmcraft_export::HwEncodeStats) -> (u64, u64, u64) {
 
 #[test]
 fn hevc_exports_play_everywhere() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     assert_eq!(filmcraft_export::available(Format::Hevc), hevc_available(), "the format is available iff NVENC can encode HEVC");
     if !hevc_available() {
@@ -173,7 +170,7 @@ fn hevc_exports_play_everywhere() {
 
 #[test]
 fn hevc_export_with_audio() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC here");
@@ -202,7 +199,7 @@ fn hevc_export_with_audio() {
 
 #[test]
 fn sizes_that_are_not_multiples_of_the_coding_block_are_cropped_back() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC here");
@@ -230,7 +227,7 @@ fn sizes_that_are_not_multiples_of_the_coding_block_are_cropped_back() {
 
 #[test]
 fn what_nvenc_cannot_do_is_an_error_that_says_why() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     filmcraft_platform::register();
     let rate = FrameRate::FPS_24;
     let base = hevc(tmp("declined.mp4"));
diff --git a/crates/platform/tests/nvenc_hevc_main10.rs b/crates/platform/tests/it/nvenc_hevc_main10.rs
similarity index 96%
rename from crates/platform/tests/nvenc_hevc_main10.rs
rename to crates/platform/tests/it/nvenc_hevc_main10.rs
index 76d0c9ccc..1b49795dd 100644
--- a/crates/platform/tests/nvenc_hevc_main10.rs
+++ b/crates/platform/tests/it/nvenc_hevc_main10.rs
@@ -16,9 +16,6 @@ const W: usize = 1280;
 const H: usize = 720;
 const FRAMES: usize = 48;
 
-/// NVENC sessions are a limited resource on consumer GPUs: one test at a time.
-static SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
 fn config(w: u32, h: u32) -> Config {
     Config {
         width: w,
@@ -134,7 +131,7 @@ fn hex(b: &[u8]) -> String {
 }
 
 fn round_trip(name: &str, signal: ColorSignal, want_sei: bool) {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let Some((enc, packets, sources)) = encode_all(&config(W as u32, H as u32), &signal, FRAMES) else { return };
     assert!(enc.is_ten_bit());
     assert_eq!(packets.len(), FRAMES, "{name}: one packet per picture");
@@ -239,7 +236,7 @@ fn calm<T>(what: &str, f: impl FnOnce() -> T) -> T {
 
 #[test]
 fn main_10_and_main_encoders_refuse_each_others_pictures() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_hdr_available() {
         eprintln!("SKIPPED: no NVENC HEVC Main 10 encoder");
         return;
@@ -268,7 +265,7 @@ fn main_10_and_main_encoders_refuse_each_others_pictures() {
 
 #[test]
 fn hostile_main_10_configurations_give_errors_not_crashes() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_hdr_available() {
         eprintln!("SKIPPED: no NVENC HEVC Main 10 encoder");
         return;
@@ -315,7 +312,7 @@ fn hostile_main_10_configurations_give_errors_not_crashes() {
 
 #[test]
 fn the_probe_follows_the_encoder() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let hdr = hevc_hdr_available();
     assert!(!hdr || hevc_available(), "Main 10 implies HEVC");
     assert_eq!(hevc_hdr_available(), hdr, "the answer is kept");
diff --git a/crates/platform/tests/nvenc_hevc_probe.rs b/crates/platform/tests/it/nvenc_hevc_probe.rs
similarity index 100%
rename from crates/platform/tests/nvenc_hevc_probe.rs
rename to crates/platform/tests/it/nvenc_hevc_probe.rs
diff --git a/crates/platform/tests/nvenc_rgba_input.rs b/crates/platform/tests/it/nvenc_rgba_input.rs
similarity index 94%
rename from crates/platform/tests/nvenc_rgba_input.rs
rename to crates/platform/tests/it/nvenc_rgba_input.rs
index 4009f3e68..275b1e227 100644
--- a/crates/platform/tests/nvenc_rgba_input.rs
+++ b/crates/platform/tests/it/nvenc_rgba_input.rs
@@ -6,9 +6,6 @@
 use filmcraft_isobmff::{AvcConfig, SampleEntry};
 use filmcraft_platform::nvenc::{Codec, Config, Nvenc, Packet, Profile, Signal, available, hevc_available};
 
-/// NVENC sessions are a limited resource on consumer GPUs: one test at a time.
-static SERIAL: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
 /// A moving test picture: gradient background, a moving box, a little texture.
 fn moving(w: usize, h: usize, i: usize) -> Vec<u8> {
     let mut v = vec![0u8; w * h * 4];
@@ -122,7 +119,7 @@ fn check(profile: Profile) {
 
 #[test]
 fn hevc_rgba_input_converts_like_the_export() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC encoder");
         return;
@@ -132,7 +129,7 @@ fn hevc_rgba_input_converts_like_the_export() {
 
 #[test]
 fn h264_rgba_input_converts_like_the_export() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !available() {
         eprintln!("SKIPPED: no NVENC");
         return;
@@ -142,7 +139,7 @@ fn h264_rgba_input_converts_like_the_export() {
 
 #[test]
 fn main10_has_no_rgba_input_and_short_pictures_are_errors() {
-    let _one = SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _one = crate::common::NVENC_SERIAL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if !hevc_available() {
         eprintln!("SKIPPED: no NVENC HEVC encoder");
         return;
diff --git a/crates/platform/tests/videotoolbox.rs b/crates/platform/tests/it/videotoolbox.rs
similarity index 99%
rename from crates/platform/tests/videotoolbox.rs
rename to crates/platform/tests/it/videotoolbox.rs
index c2ce2f6ae..2db339b1b 100644
--- a/crates/platform/tests/videotoolbox.rs
+++ b/crates/platform/tests/it/videotoolbox.rs
@@ -6,7 +6,7 @@
 //! hang. Skips without ffmpeg (fixture generator) or without a hardware decoder.
 #![cfg(target_os = "macos")]
 
-mod common;
+use crate::common;
 
 use std::time::Duration;
 
diff --git a/crates/platform/tests/media_stack.rs b/crates/platform/tests/media_stack.rs
index a7d244f5d..e8be399d8 100644
--- a/crates/platform/tests/media_stack.rs
+++ b/crates/platform/tests/media_stack.rs
@@ -2,6 +2,7 @@
 //! decoding Auto and Off (Windows). Its own test binary: the switch is process-wide.
 #![cfg(target_os = "windows")]
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use common::*;
diff --git a/crates/platform/tests/nvdec.rs b/crates/platform/tests/nvdec.rs
index d87f15611..ef1a689dc 100644
--- a/crates/platform/tests/nvdec.rs
+++ b/crates/platform/tests/nvdec.rs
@@ -4,9 +4,11 @@
 //! `reset` + reseek; a forced mid-stream failure must continue in software with the software
 //! decoder's exact output; what the hardware path does not take is declined; damaged samples give
 //! errors or fall back, never crash or hang. Skips without ffmpeg (fixture generator) or without
-//! an NVIDIA GPU.
+//! an NVIDIA GPU. Its own test binary: one test turns the process-wide Hardware decoding switch
+//! off and on.
 #![cfg(all(target_os = "linux", target_pointer_width = "64"))]
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use std::time::Duration;
diff --git a/crates/platform/tests/setting.rs b/crates/platform/tests/setting.rs
index c58f4a953..259a02c31 100644
--- a/crates/platform/tests/setting.rs
+++ b/crates/platform/tests/setting.rs
@@ -2,6 +2,7 @@
 //! Off gives the software decoder (and no hardware frames), Auto the hardware one where the
 //! system has it. Its own test binary: the switch is process-wide.
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use common::*;
diff --git a/crates/platform/tests/vaapi.rs b/crates/platform/tests/vaapi.rs
index 507e7768c..f7c140661 100644
--- a/crates/platform/tests/vaapi.rs
+++ b/crates/platform/tests/vaapi.rs
@@ -8,9 +8,11 @@
 //! continue in software with the software decoder's exact output; what the hardware path does not
 //! take (interlaced and 10-bit H.264, 4:2:2 HEVC) is declined; damaged samples and parameter sets give
 //! errors or fall back, never crash or hang. Skips without ffmpeg (fixture generator) or without a
-//! VA-API driver.
+//! VA-API driver. Its own test binary: one test turns the process-wide Hardware decoding switch off
+//! and on.
 #![cfg(target_os = "linux")]
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use std::time::Duration;
diff --git a/crates/platform/tests/vaapi_displays.rs b/crates/platform/tests/vaapi_displays.rs
index 8ec45334a..acdb721d8 100644
--- a/crates/platform/tests/vaapi_displays.rs
+++ b/crates/platform/tests/vaapi_displays.rs
@@ -7,6 +7,7 @@
 //! Skips without ffmpeg (fixture generator) or without a VA-API driver.
 #![cfg(target_os = "linux")]
 
+#[path = "it/common/mod.rs"]
 mod common;
 
 use common::*;
diff --git a/crates/project/src/caption.rs b/crates/project/src/caption.rs
index d8236e8bd..30c279d26 100644
--- a/crates/project/src/caption.rs
+++ b/crates/project/src/caption.rs
@@ -239,25 +239,36 @@ pub fn plain_text(s: &str) -> String {
     while let Some(c) = chars.next() {
         match c {
             '<' => {
-                // a tag runs to the next '>' (if none, keep the '<' literally)
-                let rest: String = chars.clone().collect();
-                if let Some(end) = rest.find('>') {
-                    for _ in 0..rest[..=end].chars().count() {
-                        chars.next();
+                // A tag runs to the next '>'.  Scan forward once; preserving an unterminated
+                // tag as literal text must not rescan every later opening bracket.
+                let mut literal = String::new();
+                let mut closed = false;
+                for next in chars.by_ref() {
+                    if next == '>' {
+                        closed = true;
+                        break;
                     }
-                } else {
+                    literal.push(next);
+                }
+                if !closed {
                     out.push('<');
+                    out.push_str(&literal);
                 }
             }
             '{' if chars.peek() == Some(&'\\') => {
                 // SSA-style override blocks some SRT files carry: {\an8}
-                let rest: String = chars.clone().collect();
-                if let Some(end) = rest.find('}') {
-                    for _ in 0..rest[..=end].chars().count() {
-                        chars.next();
+                let mut literal = String::new();
+                let mut closed = false;
+                for next in chars.by_ref() {
+                    if next == '}' {
+                        closed = true;
+                        break;
                     }
-                } else {
+                    literal.push(next);
+                }
+                if !closed {
                     out.push('{');
+                    out.push_str(&literal);
                 }
             }
             '&' => {
@@ -300,6 +311,14 @@ mod tests {
         assert_eq!(plain_text("<v Bob>Hi</v>"), "Hi");
     }
 
+    #[test]
+    fn malformed_caption_markup_is_preserved_without_repeated_suffix_scans() {
+        let angle = "<".repeat(10_000);
+        let ssa = format!("{{\\{}", "{".repeat(10_000));
+        assert_eq!(plain_text(&angle), angle);
+        assert_eq!(plain_text(&ssa), ssa);
+    }
+
     #[test]
     fn caption_at() {
         let mut t = CaptionTrack::new(TrackId(1), "Subtitle".into(), CaptionFormat::Subtitle);
diff --git a/crates/project/src/graphic.rs b/crates/project/src/graphic.rs
index 978917e32..23994171a 100644
--- a/crates/project/src/graphic.rs
+++ b/crates/project/src/graphic.rs
@@ -35,6 +35,47 @@ pub fn is_layer(e: &EffectInstance) -> bool {
     is_layer_id(&e.effect)
 }
 
+/// Give every graphic layer without a uid (or with a uid another layer already uses) a fresh one
+/// that is unique among `effects`; non-layer effects are left alone.
+///
+/// This is the project-format lazy upgrade: files written before layers had uids (or with a
+/// duplicate written by a hostile/buggy producer) get stable identities when they are opened, so
+/// reorder/delete/undo and the Program monitor's text editor keep addressing the same layer.
+/// The optional `layer.uid` field means the file schema does not change; a save simply writes the
+/// assigned uid. Returns whether anything changed.
+pub fn ensure_layer_uids(effects: &mut [EffectInstance]) -> bool {
+    let mut used: std::collections::BTreeSet<u64> =
+        effects.iter().filter(|e| is_layer(e)).filter_map(|e| e.layer.as_ref()).map(|x| x.uid).filter(|uid| *uid != 0).collect();
+    let mut seen = std::collections::BTreeSet::new();
+    let mut next = 1u64;
+    let mut changed = false;
+    for e in effects.iter_mut().filter(|e| is_layer(e)) {
+        let uid = e.layer.as_ref().map_or(0, |x| x.uid);
+        if uid != 0 && seen.insert(uid) {
+            continue;
+        }
+        // Zero means "not assigned yet"; a repeated uid must move to a free one so two identical
+        // layers can never share an identity.
+        while used.contains(&next) {
+            let Some(after) = next.checked_add(1) else {
+                // A hostile file used every uid; leave this layer without one rather than loop.
+                next = 0;
+                break;
+            };
+            next = after;
+        }
+        if next == 0 {
+            continue;
+        }
+        e.layer.get_or_insert_with(Default::default).uid = next;
+        used.insert(next);
+        seen.insert(next);
+        changed = true;
+        next = next.saturating_add(1);
+    }
+    changed
+}
+
 fn p(id: &'static str, label: &'static str, kind: ParamKind, default: ParamValue, animatable: bool, group: &'static str) -> ParamDef {
     ParamDef { id, label, kind, default, animatable, group: if group.is_empty() { None } else { Some(group) } }
 }
@@ -499,6 +540,43 @@ mod tests {
         assert_eq!(layer_display_name(&e, 0), "Hello");
     }
 
+    #[test]
+    fn assigning_a_new_layer_uid_never_reuses_an_existing_layers_uid() {
+        let make = |uid| {
+            let mut layer = new_text_layer("text", Vec2::new(10.0, 20.0), 40.0);
+            layer.layer = Some(Box::new(crate::graphic_design::LayerExtra { uid, ..Default::default() }));
+            layer
+        };
+        for initial in [[1, 0, 2, 1], [0, 1, 2, 1], [1, 2, 0, 1]] {
+            let mut layers: Vec<_> = initial.into_iter().map(make).collect();
+            assert!(ensure_layer_uids(&mut layers));
+            let uids: Vec<_> = layers.iter().map(crate::gtemplate::layer_uid).collect();
+            assert_eq!(uids.iter().copied().collect::<std::collections::BTreeSet<_>>().len(), 4, "{uids:?}");
+            assert_eq!(uids[initial.iter().position(|uid| *uid == 1).unwrap()], 1);
+            assert_eq!(uids[initial.iter().position(|uid| *uid == 2).unwrap()], 2);
+            assert!(!ensure_layer_uids(&mut layers), "a second pass must preserve identity");
+        }
+    }
+
+    #[test]
+    fn layer_uids_are_unique_and_repair_legacy_or_duplicate_entries() {
+        let a = new_text_layer("one", Vec2::new(10.0, 20.0), 40.0);
+        let mut b = new_text_layer("two", Vec2::new(10.0, 20.0), 40.0);
+        let mut shape = crate::effect::find_effect(SHAPE_LAYER).unwrap().instance();
+        // Legacy file: no uids at all; one layer already carries a duplicate uid.
+        assert_eq!(crate::gtemplate::layer_uid(&a), 0);
+        b.layer = Some(Box::new(crate::graphic_design::LayerExtra { uid: 7, ..Default::default() }));
+        shape.layer = Some(Box::new(crate::graphic_design::LayerExtra { uid: 7, ..Default::default() }));
+        let mut effects = vec![a, b, shape];
+        assert!(ensure_layer_uids(&mut effects));
+        let uids: Vec<u64> = effects.iter().filter(|e| is_layer(e)).map(crate::gtemplate::layer_uid).collect();
+        assert!(uids.iter().all(|uid| *uid != 0));
+        let unique: std::collections::BTreeSet<u64> = uids.iter().copied().collect();
+        assert_eq!(unique.len(), uids.len(), "every layer keeps its own identity: {uids:?}");
+        // Idempotent: a second pass changes nothing.
+        assert!(!ensure_layer_uids(&mut effects));
+    }
+
     #[test]
     fn defaults_centre_and_shadow_direction() {
         let mut e = crate::effect::find_effect(SHAPE_LAYER).unwrap().instance();
diff --git a/crates/project/src/gtemplate.rs b/crates/project/src/gtemplate.rs
index be225a8b6..644b9b28f 100644
--- a/crates/project/src/gtemplate.rs
+++ b/crates/project/src/gtemplate.rs
@@ -35,6 +35,8 @@
 //! The built-in templates ([`builtin_templates`]) are original designs made for FilmCraft in code
 //! (no image, font or template files), under the project licence.
 
+use std::collections::{HashMap, HashSet};
+
 use filmcraft_geom::Vec2;
 use filmcraft_time::{TICKS_PER_SECOND, Tick};
 use serde::{Deserialize, Serialize};
@@ -278,24 +280,22 @@ impl GraphicsTemplate {
         if self.canvas[0] == 0 || self.canvas[1] == 0 || self.canvas[0] > 16384 || self.canvas[1] > 16384 {
             return bad(format!("bad canvas size {:?}", self.canvas));
         }
-        let mut uids = Vec::new();
+        let mut layers = HashMap::with_capacity(self.layers.len());
         for (i, l) in self.layers.iter().enumerate() {
             if !graphic::is_layer(l) {
                 return bad(format!("layer {i} is `{}`, not a graphic layer", l.effect));
             }
             let uid = layer_uid(l);
-            if uid == 0 || uids.contains(&uid) {
+            if uid == 0 || layers.insert(uid, l).is_some() {
                 return bad(format!("layer {i} has no unique uid"));
             }
-            uids.push(uid);
         }
-        let mut ids = Vec::new();
+        let mut ids = HashSet::with_capacity(self.controls.len());
         for c in &self.controls {
-            if c.id.is_empty() || ids.contains(&c.id) {
+            if c.id.is_empty() || !ids.insert(c.id.as_str()) {
                 return bad(format!("control `{}` has no unique id", c.name));
             }
-            ids.push(c.id.clone());
-            let Some(l) = self.layers.iter().find(|l| layer_uid(l) == c.layer) else {
+            let Some(l) = layers.get(&c.layer) else {
                 return bad(format!("control `{}` points at a missing layer", c.name));
             };
             if c.param != "enabled" && !l.params.contains_key(&c.param) {
@@ -350,14 +350,8 @@ pub fn layer_uid(e: &EffectInstance) -> u64 {
 }
 
 /// Give every layer without a uid a fresh one (unique among `layers`).
-pub fn ensure_uids(layers: &mut [EffectInstance]) {
-    let mut next = layers.iter().map(layer_uid).max().unwrap_or(0) + 1;
-    for l in layers.iter_mut() {
-        if layer_uid(l) == 0 {
-            l.layer.get_or_insert_with(Default::default).uid = next;
-            next += 1;
-        }
-    }
+pub fn ensure_uids(layers: &mut [EffectInstance]) -> bool {
+    graphic::ensure_layer_uids(layers)
 }
 
 // ------------------------------------------------------------------------------------------------
diff --git a/crates/project/src/keyframe.rs b/crates/project/src/keyframe.rs
index 1ddfbc156..bf6754c2c 100644
--- a/crates/project/src/keyframe.rs
+++ b/crates/project/src/keyframe.rs
@@ -285,6 +285,38 @@ impl Param {
         self.value_at(t).as_f64().unwrap_or(0.0)
     }
 
+    /// Borrowing text evaluation for read-only observers (the Program monitor's IME producer).
+    ///
+    /// Text parameters never interpolate, so the result is the applicable static or keyframed
+    /// `ParamValue::Text`; an interpolating non-text value yields `None`. Unlike
+    /// [`Self::value_at`] this does not clone the document-sized string.
+    pub fn text_ref_at(&self, t: Tick) -> Option<&str> {
+        fn text(v: &ParamValue) -> Option<&str> {
+            match v {
+                ParamValue::Text(s) => Some(s.as_str()),
+                _ => None,
+            }
+        }
+        let k = &self.keyframes;
+        if k.is_empty() {
+            return text(&self.value);
+        }
+        if t <= k[0].time {
+            return text(&k[0].value);
+        }
+        let last = &k[k.len() - 1];
+        if t >= last.time {
+            return text(&last.value);
+        }
+        let i = match k.binary_search_by_key(&t, |kf| kf.time) {
+            Ok(i) => return text(&k[i].value),
+            Err(i) => i - 1,
+        };
+        // Hold semantics match `value_at`: non-interpolating values (including text) stay until
+        // the next keyframe; an interpolating segment never evaluates to text.
+        if k[i].interp == Interpolation::Hold || !k[i].value.interpolates() { text(&k[i].value) } else { None }
+    }
+
     /// Allocation-free [`Param::f64_at`] for scalar parameters (Float / Choice / Bool), for
     /// per-sample evaluation in the audio mixer. Non-scalar values evaluate to 0.
     pub fn scalar_at(&self, t: Tick) -> f64 {
@@ -405,6 +437,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn text_ref_at_borrows_without_cloning_and_holds_non_interpolating_values() {
+        let p = Param::new(ParamValue::Text("abc".into()));
+        assert_eq!(p.text_ref_at(Tick(0)), Some("abc"));
+        let f = Param::new(ParamValue::Float(1.0));
+        assert_eq!(f.text_ref_at(Tick(0)), None);
+        let mut p = Param::new(ParamValue::Text("a".into()));
+        p.toggle_animation(Tick(0));
+        p.set_at(Tick(100), ParamValue::Text("b".into()));
+        assert_eq!(p.text_ref_at(Tick(50)), Some("a"), "text does not interpolate");
+        assert_eq!(p.text_ref_at(Tick(100)), Some("b"));
+    }
+
     #[test]
     fn toggle_off_keeps_value() {
         let mut p = Param::new(ParamValue::Float(1.0));
diff --git a/crates/project/src/lib.rs b/crates/project/src/lib.rs
index fb55786db..05693820f 100644
--- a/crates/project/src/lib.rs
+++ b/crates/project/src/lib.rs
@@ -760,6 +760,9 @@ pub struct Track {
     /// Audio Track Mixer state: automation mode and lanes, sends, output, record arm.
     #[serde(default)]
     pub mixer: MixerStrip,
+    /// Colour label tinting the track's header and lane background (`None` = no colour).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub label: Option<Label>,
 }
 
 impl Track {
@@ -780,6 +783,7 @@ impl Track {
             pan: 0.0,
             effects: Vec::new(),
             mixer: MixerStrip::default(),
+            label: None,
         }
     }
     pub fn end(&self) -> Tick {
@@ -1320,6 +1324,9 @@ impl ProjectView {
 }
 
 /// A LUT imported into the project (`lut.import`). Lumetri refers to it as `lib:<id>`.
+/// Largest embedded LUT source accepted from a project or import (8 MiB).
+pub const MAX_LUT_TEXT_BYTES: usize = 8 << 20;
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct ProjectLut {
     pub id: String,
@@ -1340,6 +1347,11 @@ impl Default for Project {
 }
 
 impl Project {
+    /// The highest `next_id` a loaded project may carry. Ids are handed out one at a time, so no
+    /// amount of editing gets near it; a file past it is damaged, and refusing it keeps
+    /// `alloc_id` from overflowing.
+    pub const MAX_NEXT_ID: u64 = u64::MAX / 2;
+
     pub fn new(name: &str) -> Self {
         Self {
             name: name.into(),
@@ -1362,6 +1374,72 @@ impl Project {
         id
     }
 
+    /// The largest id in use, of any kind. They all come from `next_id`, so a project read from a
+    /// file must have its `next_id` past this. Ids that are only referenced count too (a clip whose
+    /// item is gone): a new item taking that id would be picked up by the reference. The root bin
+    /// counts, so there is always one.
+    pub fn max_id(&self) -> u64 {
+        let mut max = 0;
+        let mut see = |id: u64| max = max.max(id);
+        let mut bins = vec![&self.root];
+        while let Some(bin) = bins.pop() {
+            see(bin.id.0);
+            for c in &bin.children {
+                match c {
+                    BinEntry::Item(i) => see(i.0),
+                    BinEntry::Bin(sub) => bins.push(sub),
+                }
+            }
+        }
+        self.search_bins.iter().for_each(|b| see(b.id.0));
+        // deleting an item leaves these entries behind: a new item taking that id would inherit them
+        self.transcripts.keys().chain(self.source_graphics.keys()).chain(self.narrations.keys()).for_each(|i| see(i.0));
+        // `lut.import` names LUTs `lut<id>`
+        self.luts.iter().filter_map(|l| l.id.strip_prefix("lut")?.parse().ok()).for_each(&mut see);
+        fn mixer(m: &MixerStrip) -> impl Iterator<Item = u64> + '_ {
+            m.sends.iter().map(|s| s.target.0).chain(m.output.map(|t| t.0))
+        }
+        for (id, item) in &self.items {
+            see(id.0);
+            see(item.id.0);
+            match &item.kind {
+                ItemKind::Media(m) => m.markers.iter().for_each(|mk| see(mk.id.0)),
+                ItemKind::Subclip { parent, .. } => see(parent.0),
+                ItemKind::Sequence(s) => {
+                    s.markers.iter().for_each(|mk| see(mk.id.0));
+                    mixer(&s.master_mixer).for_each(&mut see);
+                    for t in s.all_tracks().chain(&s.submix_tracks) {
+                        see(t.id.0);
+                        mixer(&t.mixer).for_each(&mut see);
+                        for c in &t.items {
+                            see(c.id.0);
+                            see(c.item.0);
+                            c.link.into_iter().chain(c.group).for_each(&mut see);
+                            c.markers.iter().for_each(|mk| see(mk.id.0));
+                        }
+                        for tr in &t.transitions {
+                            see(tr.id.0);
+                            tr.from.into_iter().chain(tr.to).for_each(|c| see(c.0));
+                        }
+                    }
+                    for t in &s.caption_tracks {
+                        see(t.id.0);
+                        t.captions.iter().for_each(|c| see(c.id.0));
+                    }
+                    for cam in s.multicam.iter().flat_map(|m| &m.cameras) {
+                        cam.video_track.iter().chain(&cam.audio_tracks).for_each(|t| see(t.0));
+                        cam.source.iter().for_each(|i| see(i.0));
+                    }
+                    if let Some(m) = &s.merged {
+                        m.video.iter().chain(&m.audio).for_each(|i| see(i.0));
+                    }
+                }
+                _ => {}
+            }
+        }
+        max
+    }
+
     /// Add an item to a bin (root when None / not found).
     pub fn add_item(&mut self, name: &str, label: Label, kind: ItemKind, bin: Option<BinId>) -> ItemId {
         let id = ItemId(self.alloc_id());
@@ -1672,6 +1750,32 @@ fn resolve_auto_points_sized(e: &mut EffectInstance, frame: (u32, u32), source:
 }
 
 impl Project {
+    /// Lazy upgrade for graphic layers written before they had stable uids: assign a unique
+    /// [`crate::graphic_design::LayerExtra::uid`] to every uid-less or duplicated graphic layer
+    /// in sequences and source graphics.
+    ///
+    /// Called when a project file is opened, before undo history starts, so every later undo
+    /// snapshot carries the same identity. The field is already optional in the file schema, so
+    /// this changes no schema version and older builds still read the file. Returns whether any
+    /// layer changed.
+    pub fn ensure_graphic_layer_uids(&mut self) -> bool {
+        let mut changed = false;
+        for item in self.items.values_mut() {
+            if let ItemKind::Sequence(seq) = &mut item.kind {
+                let seq = std::sync::Arc::make_mut(seq);
+                for track in seq.video_tracks.iter_mut().chain(seq.audio_tracks.iter_mut()) {
+                    for it in &mut track.items {
+                        changed |= crate::graphic::ensure_layer_uids(&mut it.effects);
+                    }
+                }
+            }
+        }
+        for graphic in self.source_graphics.values_mut() {
+            changed |= crate::graphic::ensure_layer_uids(&mut graphic.layers);
+        }
+        changed
+    }
+
     /// Available picture and sound, resolving a subclip to its parent media. Missing parents,
     /// cycles and overly deep subclip chains carry neither stream.
     pub fn source_streams(&self, item: ItemId) -> (bool, bool) {
diff --git a/crates/prores/README.md b/crates/prores/README.md
index 99336e2bc..c852fa332 100644
--- a/crates/prores/README.md
+++ b/crates/prores/README.md
@@ -1,6 +1,6 @@
 # filmcraft-prores
 
-Clean-room Apple ProRes decoder and encoder in pure Rust, written from the public SMPTE RDD 36
+Clean-room Apple ProRes decoder and encoder in pure Rust, written from the public [SMPTE RDD 36:2022](https://pub.smpte.org/doc/rdd36/20220909-pub/rdd36-2022.pdf)
 bitstream description. Layer L0: depends only on `filmcraft-bitstream`, `thiserror` and (optional,
 feature `threads`, default on) `rayon`. Builds for `wasm32-unknown-unknown`; no `unsafe`.
 
@@ -58,7 +58,7 @@ does), so the decoder doesn't need to know.
   rayon task directly into the output planes.
 - Robustness: every size field is validated before allocation, codewords longer than 56 bits are
   rejected, and arithmetic is overflow-safe. Mutated streams return `Err`, never panic (see
-  `tests/fuzz.rs`).
+  `tests/it/fuzz.rs`).
 
 ## Encoder
 
@@ -79,7 +79,7 @@ does), so the decoder doesn't need to know.
 
 ## Accuracy (vs ffmpeg as an external oracle)
 
-`tests/oracle_decode.rs` decodes 29 fixtures made by ffmpeg's `prores_ks` and `prores_aw`
+`tests/it/oracle_decode.rs` decodes 29 fixtures made by ffmpeg's `prores_ks` and `prores_aw`
 encoders. They cover every profile, testsrc2/mandelbrot/SMPTE bars at 1920×1080, 1918×1080,
 1280×720, 640×360, 352×288, 70×38 and 333×201, interlaced 720×486 TFF/BFF and 1080i, 2-MB slices,
 and 4444 with 8- and 16-bit alpha. The results are compared with ffmpeg's decode at the native
@@ -89,15 +89,44 @@ bit-identical (86% for 12-bit XQ mandelbrot). Alpha is always bit-exact. The rem
 differences are the reference decoder's integer-IDCT rounding. This decoder is closer to the
 exact IDCT and does not reproduce that approximation.
 
-`tests/oracle_encode.rs` encodes 1920×1080 frames with every profile (testsrc2, mandelbrot and
+`tests/it/oracle_encode.rs` encodes 1920×1080 frames with every profile (testsrc2, mandelbrot and
 noisy content; 4444 with an alpha disc) and writes them into a minimal test-only MOV. ffmpeg then
 decodes them with `-xerror`, with no errors, and agrees with this decoder within ±1. HQ PSNR is
 69.9/69.2 dB (Y/C) on mandelbrot at 100% of the target rate. Busy content lands at 99.9–100.4%
 of the target.
 
+## Alpha bitstream conformance
+
+Every alpha difference is followed by a run code, including a final singleton
+(RDD 36:2022 §5.3.3, Tables 12–14). Omitting the final run produces a truncated
+alpha payload: FFmpeg may accept it, while macOS native HD decoding fails with AVFoundation `-11821` / underlying `-12137`. This affected
+both 4444 and 4444 XQ exports, including EffectCraft's alpha output
+([effectcraft#293](https://github.com/storytold/effectcraft/issues/293)).
+
+The encoder tests check exact singleton codewords at 8 and 16 bits, run-length
+boundaries through 2048 and split runs, final-value bit alignments, and complete
+encoded slices for both profiles and all four slice widths. A separate,
+bounds-checked parser follows the published syntax and requires every run and
+zero alignment bit; round-tripping through a permissive decoder alone cannot
+catch this defect.
+
+Native validation on Apple M5 / macOS 27.0.1 used 14 synthetic 1920×1080 clips:
+opaque, transparent, gradient, changing last pixel, moving block, noisy alpha,
+and RGB-only, for each 4444 profile. Before the fix, the gradient, last-pixel and
+noise cases failed in AVAssetReader (six clips); afterwards all 14 decoded all
+six frames. FFmpeg's decoded frame hashes are unchanged by the fix. Small
+128×32 clips passed even before the fix. Resolve itself and the reporter's
+M1 Pro / macOS 15.8 environment were not available for this check.
+
+EffectCraft 0.16.0's complete export pipeline was also tested using an animated
+synthetic PNG with varying alpha: 4444 / XQ × straight / premultiplied × motion
+blur off / on (eight six-frame HD movies). All eight failed native decoding with
+the pinned encoder, and all eight passed with this codec patched in. FFmpeg's
+decoded frame hashes remained identical for every before/after pair.
+
 ## Performance
 
-Measured with `cargo test --release -p filmcraft-prores --test perf -- --ignored --nocapture` on
+Measured with `cargo test --release -p filmcraft-prores --test it perf:: -- --ignored --nocapture` on
 an M4 Pro (14 cores) that was heavily loaded by other jobs, so these are lower bounds. A 1080p HQ
 frame at the full nominal rate (918 KB) decoded at up to 318 fps threaded and 53 fps on one
 thread. A prores_ks HQ mandelbrot frame (657 KB) decoded at 390 fps threaded. Encoding a 1080p
diff --git a/crates/prores/src/decode.rs b/crates/prores/src/decode.rs
index d25c49352..60318d848 100644
--- a/crates/prores/src/decode.rs
+++ b/crates/prores/src/decode.rs
@@ -6,6 +6,10 @@ use crate::header::{FrameHeader, PictureHeader, row_slice_widths};
 use crate::tables::*;
 use crate::{AlphaType, ChromaFormat, Error, Frame, Interlace, Result};
 
+/// Maximum aggregate decoded plane storage for one ProRes frame (256 MiB).
+// 1 GiB: 8K ProRes 4444 with alpha is 283 MB of 16-bit planes
+const MAX_FRAME_BYTES: usize = 1 << 30;
+
 /// Decoder options.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct DecodeOptions {
@@ -120,6 +124,15 @@ pub fn decode_frame_into(data: &[u8], opts: &DecodeOptions, out: &mut Frame) ->
     let width = hdr.width as usize;
     let height = hdr.height as usize;
     let cwidth = hdr.chroma.chroma_width(hdr.width as u32) as usize;
+    let luma = width.checked_mul(height).ok_or(Error::Invalid("frame dimensions overflow"))?;
+    let chroma = cwidth.checked_mul(height).ok_or(Error::Invalid("chroma dimensions overflow"))?;
+    let samples = luma
+        .checked_add(chroma.checked_mul(2).ok_or(Error::Invalid("chroma plane count overflows"))?)
+        .and_then(|n| if hdr.alpha == AlphaType::None { Some(n) } else { n.checked_add(luma) })
+        .ok_or(Error::Invalid("frame plane count overflows"))?;
+    if !samples.checked_mul(std::mem::size_of::<u16>()).is_some_and(|n| n <= MAX_FRAME_BYTES) {
+        return Err(Error::Invalid("frame dimensions exceed the decoder memory limit"));
+    }
     let interlaced = hdr.interlace != Interlace::Progressive;
     let mb_width = width.div_ceil(16);
     let mb_height = if interlaced { height.div_ceil(32) } else { height.div_ceil(16) };
diff --git a/crates/prores/src/encode.rs b/crates/prores/src/encode.rs
index 06d8cb655..24c925393 100644
--- a/crates/prores/src/encode.rs
+++ b/crates/prores/src/encode.rs
@@ -472,9 +472,9 @@ pub(crate) fn encode_alpha(w: &mut Writer, vals: &[u32], bits: u32) {
         }
         prev = v;
         idx += 1;
-        if idx >= n {
-            break;
-        }
+        // RDD 36:2022 §5.3.3 requires a run after every alpha difference,
+        // including a singleton at the end of the slice. Do not replace that
+        // final `1` with byte-alignment zeros: native decoders reject it.
         let mut run = 0;
         while idx + run < n && vals[idx + run] == prev && run < 2047 {
             run += 1;
@@ -493,3 +493,118 @@ pub(crate) fn encode_alpha(w: &mut Writer, vals: &[u32], bits: u32) {
         idx += run;
     }
 }
+
+#[cfg(test)]
+mod alpha_tests {
+    use super::*;
+
+    #[test]
+    fn alpha_final_singleton_has_a_run_code() {
+        // RDD 36:2022 §5.3.3: every difference is followed by a run, including
+        // the final one. Tables 13/14 encode -1; Table 12 encodes run 1 as `1`.
+        // With 16-bit alpha the difference occupies exactly one byte, so the
+        // required final run must start another byte, followed by zero padding.
+        for (bits, expected) in [(16, vec![0x01, 0x80]), (8, vec![0x0c])] {
+            let mut w = Writer::new();
+            encode_alpha(&mut w, &[(1 << bits) - 2], bits);
+            assert_eq!(w.finish(), expected, "{bits}-bit final singleton");
+        }
+    }
+}
+
+#[cfg(test)]
+mod alpha_conformance_tests {
+    use super::*;
+    use filmcraft_bitstream::BitReader;
+
+    /// RDD 36:2022 §5.3.3 and Tables 12–14, using a bounds-checked reader.
+    /// Unlike the production decoder's zero-padded hot path, this checks every
+    /// final run and all alignment bits, so a truncated run cannot be accepted.
+    fn read_alpha(data: &[u8], bits: u32, count: usize) -> Vec<u32> {
+        let mut r = BitReader::new(data);
+        let mask = (1u32 << bits) - 1;
+        let mut prev = mask;
+        let mut out = Vec::new();
+        while out.len() < count {
+            let diff = if r.read_bits(1).unwrap() == 1 {
+                r.read_bits(bits).unwrap()
+            } else {
+                let code = r.read_bits(if bits == 16 { 7 } else { 4 }).unwrap();
+                let magnitude = (code >> 1) + 1;
+                if code & 1 == 0 { magnitude } else { magnitude.wrapping_neg() }
+            };
+            prev = prev.wrapping_add(diff) & mask;
+            let run = if r.read_bits(1).unwrap() == 1 {
+                1
+            } else {
+                let short = r.read_bits(4).unwrap();
+                if short == 0 { r.read_bits(11).unwrap() + 1 } else { short + 1 }
+            } as usize;
+            assert!(run <= count - out.len(), "alpha run exceeds the slice");
+            out.extend(std::iter::repeat_n(prev, run));
+        }
+        assert!(r.bits_left() < 8, "only byte-alignment padding may remain");
+        while r.bits_left() > 0 {
+            assert_eq!(r.read_bits(1).unwrap(), 0, "alignment padding must be zero");
+        }
+        out
+    }
+
+    #[test]
+    fn alpha_runs_cover_boundaries_and_final_values() {
+        for bits in [8, 16] {
+            let mask = (1 << bits) - 1;
+            for run in [1, 2, 15, 16, 17, 2047, 2048, 2049, 4096] {
+                for tail in 0..=8 {
+                    let mut values = vec![mask - 1; run];
+                    // Short negative/positive deltas, modulo transitions and
+                    // escaped full-width deltas, ending on every bit alignment.
+                    values.extend([0, mask, 1, 7, 8, 64, 65, mask / 2].into_iter().take(tail));
+                    let mut w = Writer::new();
+                    encode_alpha(&mut w, &values, bits);
+                    assert_eq!(read_alpha(&w.finish(), bits, values.len()), values, "bits={bits}, run={run}, tail={tail}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn encoded_alpha_slices_have_complete_final_runs() {
+        for profile in [Profile::P4444, Profile::P4444Xq] {
+            for log2_slice_mbs in 0..=3 {
+                let (width, height) = (128, 32);
+                let mut frame = Frame::new(width, height, ChromaFormat::Yuv444, 16, true);
+                frame.y.fill(32768);
+                frame.cb.fill(32768);
+                frame.cr.fill(32768);
+                let alpha = frame.alpha.as_mut().unwrap();
+                for (i, a) in alpha.iter_mut().enumerate() {
+                    *a = (i as u16).wrapping_mul(257);
+                }
+                let mut cfg = EncoderConfig::new(profile, width, height);
+                cfg.log2_slice_mbs = log2_slice_mbs;
+                let bytes = Encoder::with_config(cfg).encode(&frame).unwrap();
+                let (_, start, _) = FrameHeader::parse(&bytes).unwrap();
+                let picture = &bytes[start..];
+                let header = PictureHeader::parse(picture).unwrap();
+                let table = &picture[header.header_size..][..2 * header.num_slices];
+                let mut offset = header.header_size + table.len();
+                let sw = 16 << log2_slice_mbs;
+                for (i, size) in table.as_chunks::<2>().0.iter().enumerate() {
+                    let size = u16::from_be_bytes([size[0], size[1]]) as usize;
+                    let slice = &picture[offset..offset + size];
+                    offset += size;
+                    let color_bytes: usize = slice[2..8].as_chunks::<2>().0.iter().map(|b| u16::from_be_bytes([b[0], b[1]]) as usize).sum();
+                    let payload = &slice[(slice[0] >> 3) as usize + color_bytes..];
+                    let actual = read_alpha(payload, 16, sw * 16);
+                    let x0 = i % (width as usize / sw) * sw;
+                    let y0 = i / (width as usize / sw) * 16;
+                    let alpha = frame.alpha.as_ref().unwrap();
+                    let expected: Vec<u32> = (y0..y0 + 16).flat_map(|y| (x0..x0 + sw).map(move |x| alpha[y * width as usize + x] as u32)).collect();
+                    assert_eq!(actual, expected, "{profile:?}, slice {i}, log2={log2_slice_mbs}");
+                }
+                assert_eq!(offset, picture.len());
+            }
+        }
+    }
+}
diff --git a/crates/prores/src/tables.rs b/crates/prores/src/tables.rs
index a395e906f..975e9d3f5 100644
--- a/crates/prores/src/tables.rs
+++ b/crates/prores/src/tables.rs
@@ -88,13 +88,13 @@ pub(crate) fn qscale(qidx: u8) -> u32 {
 /// Orthonormal 1-D DCT-II basis: `BASIS[u][x] = C(u)/2 · cos((2x+1)uπ/16)`, `C(0) = 1/√2`.
 pub(crate) const BASIS: [[f32; 8]; 8] = [
     [0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39, 0.353_553_39],
-    [0.490_392_64, 0.415_734_8, 0.277_785_12, 0.097_545_16, -0.097_545_16, -0.277_785_12, -0.415_734_8, -0.490_392_64],
+    [0.49039264, 0.415_734_8, 0.277_785_12, 0.097_545_16, -0.097_545_16, -0.277_785_12, -0.415_734_8, -0.49039264],
     [0.461_939_77, 0.191_341_72, -0.191_341_72, -0.461_939_77, -0.461_939_77, -0.191_341_72, 0.191_341_72, 0.461_939_77],
-    [0.415_734_8, -0.097_545_16, -0.490_392_64, -0.277_785_12, 0.277_785_12, 0.490_392_64, 0.097_545_16, -0.415_734_8],
+    [0.415_734_8, -0.097_545_16, -0.49039264, -0.277_785_12, 0.277_785_12, 0.49039264, 0.097_545_16, -0.415_734_8],
     [0.353_553_39, -0.353_553_39, -0.353_553_39, 0.353_553_39, 0.353_553_39, -0.353_553_39, -0.353_553_39, 0.353_553_39],
-    [0.277_785_12, -0.490_392_64, 0.097_545_16, 0.415_734_8, -0.415_734_8, -0.097_545_16, 0.490_392_64, -0.277_785_12],
+    [0.277_785_12, -0.49039264, 0.097_545_16, 0.415_734_8, -0.415_734_8, -0.097_545_16, 0.49039264, -0.277_785_12],
     [0.191_341_72, -0.461_939_77, 0.461_939_77, -0.191_341_72, -0.191_341_72, 0.461_939_77, -0.461_939_77, 0.191_341_72],
-    [0.097_545_16, -0.277_785_12, 0.415_734_8, -0.490_392_64, 0.490_392_64, -0.415_734_8, 0.277_785_12, -0.097_545_16],
+    [0.097_545_16, -0.277_785_12, 0.415_734_8, -0.49039264, 0.49039264, -0.415_734_8, 0.277_785_12, -0.097_545_16],
 ];
 
 #[cfg(test)]
diff --git a/crates/prores/tests/common/mod.rs b/crates/prores/tests/it/common/mod.rs
similarity index 100%
rename from crates/prores/tests/common/mod.rs
rename to crates/prores/tests/it/common/mod.rs
diff --git a/crates/prores/tests/fuzz.rs b/crates/prores/tests/it/fuzz.rs
similarity index 99%
rename from crates/prores/tests/fuzz.rs
rename to crates/prores/tests/it/fuzz.rs
index cd012a04c..4b4292f8a 100644
--- a/crates/prores/tests/fuzz.rs
+++ b/crates/prores/tests/it/fuzz.rs
@@ -1,6 +1,6 @@
 //! Robustness: mutated and random inputs must never panic (errors are fine).
 
-mod common;
+use crate::common;
 use filmcraft_prores::*;
 
 struct Rng(u64);
diff --git a/crates/prores/tests/it/fuzz_hostile.rs b/crates/prores/tests/it/fuzz_hostile.rs
new file mode 100644
index 000000000..04a9cb35a
--- /dev/null
+++ b/crates/prores/tests/it/fuzz_hostile.rs
@@ -0,0 +1,107 @@
+//! Hostile-input robustness: every header byte set to extreme values, every bit flipped,
+//! truncation at (nearly) every length must never panic or run away (errors are fine).
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use filmcraft_prores::*;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+fn seeds() -> Vec<Vec<u8>> {
+    let mut v = Vec::new();
+    for (p, w, h) in [(Profile::Proxy, 96u32, 48u32), (Profile::Hq, 70, 38), (Profile::P4444, 64, 32), (Profile::P4444Xq, 48, 20)] {
+        let chroma = p.chroma();
+        let mut f = Frame::new(w, h, chroma, 10, chroma == ChromaFormat::Yuv444);
+        for (i, s) in f.y.iter_mut().enumerate() {
+            *s = (64 + (i * 37) % 800) as u16;
+        }
+        if let Some(a) = f.alpha.as_mut() {
+            for (i, s) in a.iter_mut().enumerate() {
+                *s = if i % 5 == 0 { 1023 } else { (i % 1024) as u16 };
+            }
+        }
+        let mut cfg = EncoderConfig::new(p, w, h);
+        cfg.log2_slice_mbs = (w % 4) as u8;
+        if let Ok(d) = Encoder::with_config(cfg).encode(&f) {
+            v.push(d);
+        }
+    }
+    v
+}
+
+fn run(d: &[u8], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for depth in [None, Some(8), Some(16)] {
+            let _ = decode_frame_with(d, &DecodeOptions { bit_depth: depth, threads: depth.is_none() });
+        }
+        let _ = probe(d);
+    }));
+    assert!(res.is_ok(), "panic: {label}");
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+#[test]
+fn hostile_frames_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let seeds = seeds();
+    assert!(!seeds.is_empty());
+    for (si, seed) in seeds.iter().enumerate() {
+        let stride = (seed.len() / 400).max(1);
+        for n in (0..seed.len()).step_by(stride) {
+            run(&seed[..n], &format!("seed {si} truncate {n}"));
+        }
+        for p in 0..seed.len().min(256) {
+            for v in [0u8, 0xff, 0x80, 0x01, 0x7f] {
+                let mut d = seed.clone();
+                d[p] = v;
+                run(&d, &format!("seed {si} byte {p}={v:#x}"));
+            }
+            for b in 0..8 {
+                let mut d = seed.clone();
+                d[p] ^= 1 << b;
+                run(&d, &format!("seed {si} flip {p}.{b}"));
+            }
+        }
+        // Whole big-endian 32-bit words of the header set to 0 / huge values (sizes, counts, dimensions).
+        for p in 0..seed.len().min(128) {
+            for v in [0u32, 0xffff_ffff, 0x0001_0000, 0x7fff_ffff] {
+                let mut d = seed.clone();
+                if let Some(s) = d.get_mut(p..p + 4) {
+                    s.copy_from_slice(&v.to_be_bytes());
+                }
+                run(&d, &format!("seed {si} u32 {p}={v:#x}"));
+            }
+        }
+        let mut rng = Rng(0x9e3779b97f4a7c15 ^ si as u64);
+        let iters = std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()).unwrap_or(1000);
+        for i in 0..iters {
+            let mut d = seed.clone();
+            for _ in 0..1 + rng.below(8) {
+                let p = rng.below(d.len());
+                if rng.below(2) == 0 {
+                    d[p] ^= 1 << rng.below(8);
+                } else {
+                    d[p] = rng.next() as u8;
+                }
+            }
+            run(&d, &format!("seed {si} random {i}"));
+        }
+    }
+}
diff --git a/crates/prores/tests/it/main.rs b/crates/prores/tests/it/main.rs
new file mode 100644
index 000000000..f6423aad1
--- /dev/null
+++ b/crates/prores/tests/it/main.rs
@@ -0,0 +1,7 @@
+mod common;
+mod fuzz;
+mod fuzz_hostile;
+mod oracle_decode;
+mod oracle_encode;
+mod perf;
+mod roundtrip;
diff --git a/crates/prores/tests/oracle_decode.rs b/crates/prores/tests/it/oracle_decode.rs
similarity index 99%
rename from crates/prores/tests/oracle_decode.rs
rename to crates/prores/tests/it/oracle_decode.rs
index 1b93eda97..660aceb52 100644
--- a/crates/prores/tests/oracle_decode.rs
+++ b/crates/prores/tests/it/oracle_decode.rs
@@ -1,6 +1,6 @@
 //! Decoder accuracy against ffmpeg's ProRes decoder (oracle only; skipped without ffmpeg).
 
-mod common;
+use crate::common;
 use common::*;
 use filmcraft_prores::{AlphaType, ChromaFormat, DecodeOptions, Interlace, decode_frame, decode_frame_with, probe};
 
diff --git a/crates/prores/tests/oracle_encode.rs b/crates/prores/tests/it/oracle_encode.rs
similarity index 99%
rename from crates/prores/tests/oracle_encode.rs
rename to crates/prores/tests/it/oracle_encode.rs
index ed269a6d3..5fd9adc9f 100644
--- a/crates/prores/tests/oracle_encode.rs
+++ b/crates/prores/tests/it/oracle_encode.rs
@@ -1,6 +1,6 @@
 //! Encoder conformance and quality against ffmpeg's ProRes decoder (oracle only).
 
-mod common;
+use crate::common;
 use common::*;
 use filmcraft_prores::{ChromaFormat, DecodeOptions, Encoder, Frame, Profile, decode_frame, decode_frame_with};
 
diff --git a/crates/prores/tests/perf.rs b/crates/prores/tests/it/perf.rs
similarity index 95%
rename from crates/prores/tests/perf.rs
rename to crates/prores/tests/it/perf.rs
index a35e12828..1c9902b93 100644
--- a/crates/prores/tests/perf.rs
+++ b/crates/prores/tests/it/perf.rs
@@ -1,7 +1,7 @@
 //! Decode/encode throughput. Run with
-//! `cargo test --release -p filmcraft-prores --test perf -- --ignored --nocapture`.
+//! `cargo test --release -p filmcraft-prores --test it perf:: -- --ignored --nocapture`.
 
-mod common;
+use crate::common;
 use filmcraft_prores::*;
 use std::time::Instant;
 
diff --git a/crates/prores/tests/roundtrip.rs b/crates/prores/tests/it/roundtrip.rs
similarity index 99%
rename from crates/prores/tests/roundtrip.rs
rename to crates/prores/tests/it/roundtrip.rs
index e3b058e0b..b6ced3ba5 100644
--- a/crates/prores/tests/roundtrip.rs
+++ b/crates/prores/tests/it/roundtrip.rs
@@ -1,6 +1,6 @@
 //! Encoder → decoder round trips on synthetic content (no external tools needed).
 
-mod common;
+use crate::common;
 use common::psnr;
 use filmcraft_prores::*;
 
diff --git a/crates/render/src/graphics.rs b/crates/render/src/graphics.rs
index dd98fe744..316c60dad 100644
--- a/crates/render/src/graphics.rs
+++ b/crates/render/src/graphics.rs
@@ -8,6 +8,17 @@ use rayon::prelude::*;
 
 use crate::image::Image;
 
+/// Effect text is metadata-controlled; do not let its measured bounds allocate an unbounded mask.
+const MAX_BURN_TEXT_PIXELS: usize = 16 << 20;
+
+fn bounded_raster_size(w: f32, h: f32) -> Option<(usize, usize)> {
+    if !w.is_finite() || !h.is_finite() || w <= 0.0 || h <= 0.0 {
+        return None;
+    }
+    let (w, h) = (w.ceil() as usize, h.ceil() as usize);
+    (w.checked_mul(h)? <= MAX_BURN_TEXT_PIXELS).then_some((w, h))
+}
+
 /// sRGB-encoded straight colour (0..1) → premultiplied linear.
 pub fn premul_linear(c: [f32; 4]) -> [f32; 4] {
     let a = c[3].clamp(0.0, 1.0);
@@ -59,7 +70,7 @@ pub fn paint_mask(img: &mut Image, m: &Mask, x0: i32, y0: i32, color: [f32; 4],
 /// Draw `text` centred on `pos` (layer pixels) at `px` pixels in white over a black box of
 /// `box_alpha` (the Timecode and Clip Name effects).
 pub fn burn_text(img: &mut Image, text: &str, family: &str, pos: Vec2, px: f32, box_alpha: f32) {
-    if text.is_empty() || pos.x.is_nan() {
+    if text.is_empty() || !pos.x.is_finite() || !pos.y.is_finite() || !px.is_finite() || px <= 0.0 {
         return;
     }
     let st = TextStyle { family: family.into(), style: "Regular".into(), size: px, ..Default::default() };
@@ -72,10 +83,27 @@ pub fn burn_text(img: &mut Image, text: &str, family: &str, pos: Vec2, px: f32,
     let boxp = filmcraft_text::Path::rect(bx + b[0] - pad, by - vm.cap_height - pad, bx + b[2] + pad, by + vm.descent * 0.6 + pad);
     if let Some(bb) = boxp.bounds() {
         let (x0, y0) = (bb.0.floor() as i32, bb.1.floor() as i32);
-        let m =
-            filmcraft_text::raster::fill(&boxp, (bb.2.ceil() as i32 - x0).max(1) as usize, (bb.3.ceil() as i32 - y0).max(1) as usize, -x0 as f32, -y0 as f32);
-        paint_mask(img, &m, x0, y0, [0.0, 0.0, 0.0, 1.0], box_alpha);
+        if let Some((w, h)) = bounded_raster_size(bb.2 - x0 as f32, bb.3 - y0 as f32) {
+            let m = filmcraft_text::raster::fill(&boxp, w, h, -x0 as f32, -y0 as f32);
+            paint_mask(img, &m, x0, y0, [0.0, 0.0, 0.0, 1.0], box_alpha);
+        }
+    }
+    let bounds = l.bounds;
+    if bounded_raster_size(bounds[2] - bounds[0], bounds[3] - bounds[1]).is_none() {
+        return;
     }
     let (m, x0, y0) = render::rasterize(&l, &render::at(bx, by.round()));
     paint_mask(img, &m, x0, y0, [1.0, 1.0, 1.0, 1.0], 1.0);
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn burn_in_raster_budget_rejects_huge_and_non_finite_bounds() {
+        assert_eq!(bounded_raster_size(4096.0, 4096.0), Some((4096, 4096)));
+        assert_eq!(bounded_raster_size(4097.0, 4096.0), None);
+        assert_eq!(bounded_raster_size(f32::INFINITY, 1.0), None);
+    }
+}
diff --git a/crates/render/src/image.rs b/crates/render/src/image.rs
index 194ac2fff..62c9d50ff 100644
--- a/crates/render/src/image.rs
+++ b/crates/render/src/image.rs
@@ -11,14 +11,38 @@ pub struct Image {
 }
 
 impl Image {
+    pub const MAX_PIXELS: usize = 268_435_456;
+
     pub fn new(w: usize, h: usize) -> Self {
-        Self { w, h, px: vec![0.0; w * h * 4] }
+        let len = w.checked_mul(h).filter(|&px| px <= Self::MAX_PIXELS).and_then(|px| px.checked_mul(4)).unwrap_or(0);
+        let (w, h, px) = if len == 0 && (w > 0 || h > 0) {
+            (0, 0, Vec::new())
+        } else {
+            let mut px = Vec::new();
+            if px.try_reserve_exact(len).is_ok() {
+                px.resize(len, 0.0);
+                (w, h, px)
+            } else {
+                (0, 0, Vec::new())
+            }
+        };
+        Self { w, h, px }
     }
     pub fn filled(w: usize, h: usize, c: [f32; 4]) -> Self {
-        let mut px = Vec::with_capacity(w * h * 4);
-        for _ in 0..w * h {
-            px.extend_from_slice(&c);
-        }
+        let len = w.checked_mul(h).filter(|&px| px <= Self::MAX_PIXELS).and_then(|px| px.checked_mul(4)).unwrap_or(0);
+        let (w, h, px) = if len == 0 && (w > 0 || h > 0) {
+            (0, 0, Vec::new())
+        } else {
+            let mut px = Vec::new();
+            if px.try_reserve_exact(len).is_ok() {
+                for _ in 0..w * h {
+                    px.extend_from_slice(&c);
+                }
+                (w, h, px)
+            } else {
+                (0, 0, Vec::new())
+            }
+        };
         Self { w, h, px }
     }
     #[inline]
@@ -83,6 +107,9 @@ impl Image {
     /// Resample `self` into a `w`×`h` image through `m` (maps source pixels → destination pixels).
     /// Uses bilinear filtering, with a box pre-filter (mip level) when minifying by more than 2×.
     pub fn transformed(&self, w: usize, h: usize, m: &Affine) -> Image {
+        if self.w == 0 || self.h == 0 || w == 0 || h == 0 {
+            return Image::new(w, h);
+        }
         let Some(inv) = m.inverse() else { return Image::new(w, h) };
         // minification factor
         let sx = (m.a * m.a + m.b * m.b).sqrt();
@@ -93,6 +120,9 @@ impl Image {
             let m2 = m.then_apply(&Affine::scale(2.0, 2.0));
             return half.transformed(w, h, &m2);
         }
+        if w == 0 || h == 0 {
+            return Image::new(0, 0);
+        }
         let mut out = Image::new(w, h);
         // Destination bounds of the source rect, to skip empty rows/cols.
         let b = m.bounds(&filmcraft_geom::Rect::new(0.0, 0.0, self.w as f64, self.h as f64));
@@ -119,6 +149,9 @@ impl Image {
 
     /// Half-size box downsample.
     pub fn downsample2(&self) -> Image {
+        if self.w == 0 || self.h == 0 {
+            return Image::new(0, 0);
+        }
         let (w, h) = ((self.w / 2).max(1), (self.h / 2).max(1));
         let mut out = Image::new(w, h);
         out.px.par_chunks_mut(w * 4).enumerate().for_each(|(y, row)| {
@@ -161,6 +194,9 @@ impl Image {
 
     /// Apply a per-pixel function on straight-alpha colour (alpha preserved).
     pub fn map_rgb(&mut self, f: impl Fn([f32; 3], usize, usize) -> [f32; 3] + Sync) {
+        if self.w == 0 || self.h == 0 {
+            return;
+        }
         let w = self.w;
         self.px.par_chunks_mut(w * 4).enumerate().for_each(|(y, row)| {
             for x in 0..w {
@@ -179,6 +215,9 @@ impl Image {
 
     /// Convert to straight sRGB RGBA8.
     pub fn to_rgba8(&self) -> Vec<u8> {
+        if self.w == 0 || self.h == 0 {
+            return Vec::new();
+        }
         let mut out = vec![0u8; self.w * self.h * 4];
         out.par_chunks_mut(self.w * 4).zip(self.px.par_chunks(self.w * 4)).for_each(|(o, s)| filmcraft_frame::linear_premul_to_srgb8(s, o));
         out
@@ -186,6 +225,9 @@ impl Image {
 
     /// Opaque version over black (for monitors).
     pub fn over_black_rgba8(&self) -> Vec<u8> {
+        if self.w == 0 || self.h == 0 {
+            return Vec::new();
+        }
         let mut out = vec![0u8; self.w * self.h * 4];
         out.par_chunks_mut(self.w * 4).zip(self.px.par_chunks(self.w * 4)).for_each(|(o, s)| {
             for (o, s) in o.as_chunks_mut::<4>().0.iter_mut().zip(s.as_chunks::<4>().0) {
@@ -197,4 +239,23 @@ impl Image {
         });
         out
     }
+
+    /// [`Self::over_black_rgba8`] with each pixel's alpha in the fourth byte: the color bytes are
+    /// the same (the sRGB of the premultiplied linear color), so the picture still shows over
+    /// black, and the alpha says where it is transparent.
+    pub fn over_black_with_alpha_rgba8(&self) -> Vec<u8> {
+        if self.w == 0 || self.h == 0 {
+            return Vec::new();
+        }
+        let mut out = vec![0u8; self.w * self.h * 4];
+        out.par_chunks_mut(self.w * 4).zip(self.px.par_chunks(self.w * 4)).for_each(|(o, s)| {
+            for (o, s) in o.as_chunks_mut::<4>().0.iter_mut().zip(s.as_chunks::<4>().0) {
+                o[0] = filmcraft_color::linear_to_srgb_u8(s[0]);
+                o[1] = filmcraft_color::linear_to_srgb_u8(s[1]);
+                o[2] = filmcraft_color::linear_to_srgb_u8(s[2]);
+                o[3] = (s[3].clamp(0.0, 1.0) * 255.0).round() as u8;
+            }
+        });
+        out
+    }
 }
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 1136585a2..653cd4327 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -84,7 +84,11 @@ impl Default for RenderOptions {
 }
 
 /// Output size for a sequence at a scale.
+///
+/// A non-finite or non-positive scale is invalid and falls back to 1.0 rather than being cast to a
+/// zero pixel count (which would silently collapse the frame to 1x1).
 pub fn output_size(seq: &Sequence, scale: f32) -> (usize, usize) {
+    let scale = if scale.is_finite() && scale > 0.0 { scale } else { 1.0 };
     (((seq.settings.width as f32 * scale).round() as usize).max(1), ((seq.settings.height as f32 * scale).round() as usize).max(1))
 }
 
diff --git a/crates/render/src/luts.rs b/crates/render/src/luts.rs
index aa2c29632..c7afe3cda 100644
--- a/crates/render/src/luts.rs
+++ b/crates/render/src/luts.rs
@@ -10,10 +10,11 @@
 //! Parsed LUTs are cached by content, so a library LUT is parsed once however many clips use it.
 
 use std::collections::HashMap;
+use std::hash::{Hash, Hasher};
 use std::sync::{Arc, Mutex, OnceLock};
 
 use filmcraft_color::{ColorSpace, Lut, Lut3d, LutFormat, Range};
-use filmcraft_project::Project;
+use filmcraft_project::{MAX_LUT_TEXT_BYTES, Project};
 
 /// A built-in LUT: id, label, and how it is made.
 pub struct Builtin {
@@ -80,12 +81,38 @@ impl Builtin {
     }
 }
 
-fn cache() -> &'static Mutex<HashMap<String, Arc<Lut>>> {
-    static C: OnceLock<Mutex<HashMap<String, Arc<Lut>>>> = OnceLock::new();
+/// Identity of immutable project LUT text. Pointer equality is intentional: an `Arc<str>` changes
+/// identity whenever a project edit replaces its text, while clones of an unchanged project share
+/// it. Keeping the Arc in the cache also prevents allocator-address reuse from aliasing old LUTs.
+#[derive(Clone, Debug)]
+struct LutText(Arc<str>);
+
+impl PartialEq for LutText {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.0, &other.0)
+    }
+}
+
+impl Eq for LutText {}
+
+impl Hash for LutText {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        (Arc::as_ptr(&self.0) as *const ()).hash(state);
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+enum CacheKey {
+    Builtin(String),
+    Library { text: LutText, format: String },
+}
+
+fn cache() -> &'static Mutex<HashMap<CacheKey, Arc<Lut>>> {
+    static C: OnceLock<Mutex<HashMap<CacheKey, Arc<Lut>>>> = OnceLock::new();
     C.get_or_init(Default::default)
 }
 
-fn cached(key: String, make: impl FnOnce() -> Option<Lut>) -> Option<Arc<Lut>> {
+fn cached(key: CacheKey, make: impl FnOnce() -> Option<Lut>) -> Option<Arc<Lut>> {
     if let Some(l) = cache().lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
         return Some(l.clone());
     }
@@ -103,25 +130,18 @@ pub fn resolve(project: Option<&Project>, spec: &str) -> Option<Arc<Lut>> {
     let spec = spec.trim();
     if let Some(id) = spec.strip_prefix("builtin:") {
         let b = builtins().iter().find(|b| b.id == id)?;
-        return cached(format!("builtin:{id}"), || Some(b.generate()));
+        return cached(CacheKey::Builtin(id.to_string()), || Some(b.generate()));
     }
     let id = spec.strip_prefix("lib:")?;
     let entry = project?.luts.iter().find(|l| l.id == id)?;
-    let key = format!("lib:{:016x}", hash(&entry.text));
+    if entry.text.len() > MAX_LUT_TEXT_BYTES {
+        return None;
+    }
+    let key = CacheKey::Library { text: LutText(entry.text.clone()), format: entry.format.clone() };
     let fmt = LutFormat::from_path(&format!("x.{}", entry.format));
     cached(key, || Lut::parse(&entry.text, fmt).ok())
 }
 
-fn hash(s: &str) -> u64 {
-    // FNV-1a
-    let mut h = 0xcbf2_9ce4_8422_2325u64;
-    for b in s.as_bytes() {
-        h ^= *b as u64;
-        h = h.wrapping_mul(0x100_0000_01b3);
-    }
-    h ^ s.len() as u64
-}
-
 /// Human-readable name of a LUT reference (for panels).
 pub fn label(project: Option<&Project>, spec: &str) -> String {
     if spec.is_empty() {
@@ -169,4 +189,31 @@ mod tests {
         assert_eq!(label(Some(&p), "lib:lut1"), "Swap");
         assert_eq!(label(Some(&p), "lib:x"), "x (missing)");
     }
+
+    #[test]
+    fn library_cache_uses_retained_text_identity_without_rehashing_source() {
+        let text: Arc<str> = Lut::from_cube(Lut3d::from_fn(3, |c| c)).to_cube().into();
+        let a = CacheKey::Library { text: LutText(text.clone()), format: "cube".into() };
+        let b = CacheKey::Library { text: LutText(text), format: "cube".into() };
+        let c = CacheKey::Library { text: LutText(Arc::<str>::from(a_match_source_but_not_identity())), format: "cube".into() };
+        assert_eq!(a, b, "unchanged project snapshots share their LUT identity");
+        assert_ne!(a, c, "replacement text gets a new cache identity even when bytes match");
+    }
+
+    fn a_match_source_but_not_identity() -> String {
+        Lut::from_cube(Lut3d::from_fn(3, |c| c)).to_cube()
+    }
+
+    #[test]
+    fn oversized_embedded_lut_is_not_parsed() {
+        let mut p = Project::new("t");
+        p.luts.push(filmcraft_project::ProjectLut {
+            id: "too-big".into(),
+            name: "too-big".into(),
+            source_path: None,
+            format: "cube".into(),
+            text: "#".repeat(MAX_LUT_TEXT_BYTES + 1).into(),
+        });
+        assert!(resolve(Some(&p), "lib:too-big").is_none());
+    }
 }
diff --git a/crates/render/src/offline.rs b/crates/render/src/offline.rs
index 248670db2..40abec3d0 100644
--- a/crates/render/src/offline.rs
+++ b/crates/render/src/offline.rs
@@ -87,7 +87,7 @@ pub fn slate(w: usize, h: usize, file_name: &str, reason: OfflineReason) -> Imag
     }
     let hint = match reason {
         OfflineReason::MadeOffline => "Link Media… brings it back",
-        _ => "File ▸ Link Media… reconnects it",
+        _ => "File > Link Media… reconnects it",
     };
     text(&mut img, hint, "Regular", Vec2::new(cx as f64, (ty0 + tri_h + s * 0.205) as f64), s * 0.028, [0.85, 0.72, 0.72, 1.0], pw * 0.94);
     img
diff --git a/crates/render/src/plan.rs b/crates/render/src/plan.rs
index 120785ded..c40b534d9 100644
--- a/crates/render/src/plan.rs
+++ b/crates/render/src/plan.rs
@@ -27,6 +27,10 @@ use filmcraft_time::Tick;
 use crate::gpufx::FxOp;
 use crate::{Blend, RenderOptions, SourceProvider, motion_matrix, output_size};
 
+/// A GPU frame plan retains every resolved source frame. Nested sequences may share the same
+/// child sequence many times, so recursion depth alone does not bound this expansion.
+const MAX_PLAN_LAYERS: usize = 4096;
+
 /// One layer for the GPU, bottom to top.
 #[derive(Clone)]
 pub struct PlanLayer {
@@ -93,33 +97,63 @@ pub enum PlanStep {
 }
 
 #[derive(Default)]
-struct PlanStack(Vec<PlanStep>);
+struct PlanStack {
+    steps: Vec<PlanStep>,
+    exhausted: bool,
+    /// Layers held in `steps`, kept as they are pushed so the cap check stays O(1).
+    layers: usize,
+}
 
 impl PlanStack {
-    fn push(&mut self, layer: PlanLayer) {
-        if let Some(PlanStep::Layers(layers)) = self.0.last_mut() {
-            layers.push(layer);
-        } else {
-            self.0.push(PlanStep::Layers(vec![layer]));
-        }
+    fn layer_count(&self) -> usize {
+        self.layers
     }
 
-    fn into_layers(self, width: usize, height: usize) -> Vec<PlanLayer> {
+    fn push(&mut self, layer: PlanLayer) {
+        if self.exhausted {
+            return;
+        }
+        if self.layer_count() >= MAX_PLAN_LAYERS {
+            self.exhausted = true;
+            return;
+        }
+        if let Some(PlanStep::Layers(layers)) = self.steps.last_mut() {
+            layers.push(layer);
+        } else {
+            self.steps.push(PlanStep::Layers(vec![layer]));
+        }
+        self.layers = self.layers.saturating_add(1);
+    }
+
+    fn push_transition(&mut self, inputs: [Vec<PlanLayer>; 2], effect: filmcraft_project::EffectInstance, progress: f32, scale: f32) {
+        let added: usize = inputs.iter().map(Vec::len).sum();
+        if self.exhausted || self.layer_count().saturating_add(added) > MAX_PLAN_LAYERS {
+            self.exhausted = true;
+            return;
+        }
+        self.layers = self.layers.saturating_add(added);
+        self.steps.push(PlanStep::Transition { inputs, effect, progress, scale });
+    }
+
+    fn into_layers(self, width: usize, height: usize) -> Option<Vec<PlanLayer>> {
+        if self.exhausted {
+            return None;
+        }
         match self.finish(width, height) {
-            FramePlan::Layers { layers, .. } => layers,
-            plan => vec![PlanLayer::new(cpu_frame(execute_cpu(&plan)), Affine::IDENTITY, 1.0, Blend::Normal)],
+            FramePlan::Layers { layers, .. } => Some(layers),
+            plan => Some(vec![PlanLayer::new(cpu_frame(execute_cpu(&plan)), Affine::IDENTITY, 1.0, Blend::Normal)]),
         }
     }
 
     fn finish(mut self, width: usize, height: usize) -> FramePlan {
-        if self.0.len() <= 1 && self.0.first().is_none_or(|s| matches!(s, PlanStep::Layers(_))) {
-            let layers = match self.0.pop() {
+        if self.steps.len() <= 1 && self.steps.first().is_none_or(|s| matches!(s, PlanStep::Layers(_))) {
+            let layers = match self.steps.pop() {
                 Some(PlanStep::Layers(layers)) => layers,
                 _ => Vec::new(),
             };
             FramePlan::Layers { width, height, layers }
         } else {
-            FramePlan::Composite { width, height, steps: self.0 }
+            FramePlan::Composite { width, height, steps: self.steps }
         }
     }
 }
@@ -200,6 +234,9 @@ pub fn plan_frame(project: &Project, seq_id: ItemId, t: Tick, opts: RenderOption
     }
     let mut layers = PlanStack::default();
     push_tracks(project, seq, t, opts, sources, 0, &mut layers);
+    if layers.exhausted {
+        return FramePlan::Image(crate::render_sequence(project, seq_id, t, opts, sources));
+    }
     if opts.captions {
         for o in crate::caption_overlays(seq, t, w, h) {
             layers.push(PlanLayer::new(
@@ -210,6 +247,9 @@ pub fn plan_frame(project: &Project, seq_id: ItemId, t: Tick, opts: RenderOption
             ));
         }
     }
+    if layers.exhausted {
+        return FramePlan::Image(crate::render_sequence(project, seq_id, t, opts, sources));
+    }
     layers.finish(w, h)
 }
 
@@ -258,6 +298,9 @@ pub(crate) fn layered_at(project: &Project, seq: &Sequence, t: Tick) -> bool {
 fn push_tracks(project: &Project, seq: &Sequence, t: Tick, opts: RenderOptions, sources: &dyn SourceProvider, nest: u32, layers: &mut PlanStack) {
     let (w, h) = output_size(seq, opts.scale);
     for tr in &seq.video_tracks {
+        if layers.exhausted {
+            return;
+        }
         if !tr.enabled {
             continue;
         }
@@ -273,7 +316,11 @@ fn push_tracks(project: &Project, seq: &Sequence, t: Tick, opts: RenderOptions,
                         if let Some(item) = item {
                             let mut input = PlanStack::default();
                             push_item(project, seq, item, t, opts, sources, 1.0, Some(Blend::Normal), nest, &mut input);
-                            *slot = input.into_layers(w, h);
+                            let Some(input_layers) = input.into_layers(w, h) else {
+                                layers.exhausted = true;
+                                return;
+                            };
+                            *slot = input_layers;
                         }
                     }
                     let progress = if trn.reverse {
@@ -282,7 +329,7 @@ fn push_tracks(project: &Project, seq: &Sequence, t: Tick, opts: RenderOptions,
                     } else {
                         p
                     };
-                    layers.0.push(PlanStep::Transition { inputs, effect: trn.effect.clone(), progress, scale: opts.scale });
+                    layers.push_transition(inputs, trn.effect.clone(), progress, opts.scale);
                 }
                 "dip_to_black" | "dip_to_white" => {
                     let col = if trn.effect.effect == "dip_to_black" { [0.0, 0.0, 0.0, 1.0] } else { [1.0, 1.0, 1.0, 1.0] };
@@ -345,6 +392,9 @@ fn push_item(
     nest: u32,
     out: &mut PlanStack,
 ) {
+    if out.exhausted {
+        return;
+    }
     // frame time (`ft`) vs. effect time (`mt`): they differ inside a frame hold without Hold Filters
     let ft = item.source_time_at(t);
     let mt = item.effect_time_at(t);
@@ -383,6 +433,9 @@ fn push_item(
         && nest_is_plain(project, seq, nested, ft)
     {
         push_tracks(project, nested, ft, opts, sources, nest + 1, out);
+        if out.exhausted {
+            return;
+        }
         let (w, h) = output_size(nested, opts.scale);
         for o in crate::caption_overlays(nested, ft, w, h) {
             out.push(PlanLayer::new(
@@ -563,9 +616,20 @@ mod tests {
             scale: 1.0,
         }];
         let expected = execute_cpu(&FramePlan::Composite { width: 1, height: 1, steps: steps.clone() });
-        let layers = PlanStack(steps).into_layers(1, 1);
+        let layers = PlanStack { steps, exhausted: false, layers: 1 }.into_layers(1, 1).unwrap();
         let got = execute_cpu(&FramePlan::Layers { width: 1, height: 1, layers });
         assert_eq!(got.px, expected.px);
         assert!(got.px.iter().any(|v| *v != 0.0));
     }
+
+    #[test]
+    fn layer_plan_has_a_global_budget() {
+        let frame = Arc::new(VideoFrame::rgba_f32(1, 1, vec![0.0; 4]));
+        let mut stack = PlanStack::default();
+        for _ in 0..=MAX_PLAN_LAYERS {
+            stack.push(PlanLayer::new(frame.clone(), Affine::IDENTITY, 1.0, Blend::Normal));
+        }
+        assert!(stack.exhausted);
+        assert_eq!(stack.layer_count(), MAX_PLAN_LAYERS);
+    }
 }
diff --git a/crates/render/src/tests.rs b/crates/render/src/tests.rs
index 31eed64ca..9b6b5e1e8 100644
--- a/crates/render/src/tests.rs
+++ b/crates/render/src/tests.rs
@@ -79,6 +79,19 @@ fn half_resolution_matches_full_downsampled() {
     }
 }
 
+/// The monitor conversion with alpha has the color of the opaque one and the image's alpha.
+#[test]
+fn over_black_with_alpha_keeps_the_color_and_the_alpha() {
+    let img = Image { w: 3, h: 1, px: vec![1.0, 0.5, 0.0, 1.0, 0.0, 0.0, 0.0, 0.0, 0.5, 0.25, 0.0, 0.5] };
+    let opaque = img.over_black_rgba8();
+    let with_alpha = img.over_black_with_alpha_rgba8();
+    for i in 0..3 {
+        assert_eq!(with_alpha[i * 4..i * 4 + 3], opaque[i * 4..i * 4 + 3], "pixel {i}");
+    }
+    assert_eq!([with_alpha[3], with_alpha[7], with_alpha[11]], [255, 0, 128]);
+    assert_eq!([opaque[3], opaque[7], opaque[11]], [255, 255, 255]);
+}
+
 #[test]
 fn motion_scale_and_position() {
     let (mut p, red, _o, seq, map) = setup();
diff --git a/crates/render/src/transitions/special.rs b/crates/render/src/transitions/special.rs
index f214f41af..fe506aeb4 100644
--- a/crates/render/src/transitions/special.rs
+++ b/crates/render/src/transitions/special.rs
@@ -18,6 +18,19 @@ fn rot(x: f32, y: f32, deg: f32) -> (f32, f32) {
     (x * c + y * s, -x * s + y * c)
 }
 
+/// Pixel bounds `(x0, y0, x1, y1)` of everything not fully transparent in either frame.
+fn content_bounds(a: &Image, b: &Image) -> Option<(f32, f32, f32, f32)> {
+    let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0, 0);
+    for (y, (ra, rb)) in a.px.chunks(a.w * 4).zip(b.px.chunks(b.w * 4)).enumerate() {
+        for (x, (pa, pb)) in ra.chunks(4).zip(rb.chunks(4)).enumerate() {
+            if pa.get(3).is_some_and(|v| *v > 0.0) || pb.get(3).is_some_and(|v| *v > 0.0) {
+                (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x + 1), y1.max(y + 1));
+            }
+        }
+    }
+    (x0 < x1 && y0 < y1).then_some((x0 as f32, y0 as f32, x1 as f32, y1 as f32))
+}
+
 pub(super) fn apply(id: &str, t: &Tx) -> Option<Image> {
     let p = t.p;
     let (w, h) = (t.wf, t.hf);
@@ -165,15 +178,22 @@ pub(super) fn apply(id: &str, t: &Tx) -> Option<Image> {
             let cursor = t.flag("cursor");
             let n = cols * rows;
             let cur = (p * n).floor();
-            let (cw, ch) = (w / cols, h / rows);
+            // lay the grid over the visible content (a text layer is mostly transparent)
+            let Some((bx0, by0, bx1, by1)) = content_bounds(t.a, t.b) else {
+                return Some(t.a.clone().lerp(t.b, p));
+            };
+            let (cw, ch) = ((bx1 - bx0) / cols, (by1 - by0) / rows);
             paint(t.w, t.h, |x, y| {
-                let (ci, ri) = ((x / cw).floor().min(cols - 1.0), (y / ch).floor().min(rows - 1.0));
+                if x < bx0 || x >= bx1 || y < by0 || y >= by1 {
+                    return if p < 0.5 { t.pa(x, y) } else { t.pb(x, y) };
+                }
+                let (ci, ri) = (((x - bx0) / cw).floor().min(cols - 1.0), ((y - by0) / ch).floor().min(rows - 1.0));
                 let i = ri * cols + ci;
                 if i < cur {
                     t.pb(x, y)
                 } else if i == cur && cursor {
                     // a caret block in the lower part of the cell
-                    let ly = (y - ri * ch) / ch;
+                    let ly = (y - by0 - ri * ch) / ch;
                     if ly > 0.15 { over(t.pa(x, y), scale4([1.0, 1.0, 1.0, 1.0], 0.75)) } else { t.pa(x, y) }
                 } else {
                     t.pa(x, y)
diff --git a/crates/render/src/transitions/tests.rs b/crates/render/src/transitions/tests.rs
index e2f25a184..e4d9a295f 100644
--- a/crates/render/src/transitions/tests.rs
+++ b/crates/render/src/transitions/tests.rs
@@ -479,3 +479,40 @@ fn lens_blur_frame_time() {
         before / after
     );
 }
+
+/// #3086: on a text layer the typewriter grid and caret follow the text, not the whole frame.
+#[test]
+fn typewriter_cursor_stays_on_the_text_block() {
+    let (x0, x1, y0, y1) = (40usize, 88usize, 30usize, 42usize);
+    let layer = paint(W, H, |x, y| {
+        let (xi, yi) = (x as usize, y as usize);
+        if (x0..x1).contains(&xi) && (y0..y1).contains(&yi) { [0.3, 0.3, 0.3, 1.0] } else { [0.0; 4] }
+    });
+    let def = transitions().find(|d| d.id == "typewriter").unwrap();
+    for rows in [1.0, 3.0] {
+        let mut e = def.instance();
+        e.params.get_mut("columns").unwrap().value = ParamValue::Float(8.0);
+        e.params.get_mut("rows").unwrap().value = ParamValue::Float(rows);
+        e.params.get_mut("cursor").unwrap().value = ParamValue::Bool(true);
+        for p in [0.3, 0.6] {
+            let m = apply(&e, &layer, &layer, p);
+            let (mut cx0, mut cx1, mut cy0, mut cy1) = (usize::MAX, 0, usize::MAX, 0);
+            for y in 0..H {
+                for x in 0..W {
+                    let i = (y * W + x) * 4;
+                    let (o, s) = (&m.px[i..i + 4], &layer.px[i..i + 4]);
+                    if s[3] == 0.0 {
+                        assert!(o[3] == 0.0, "rows={rows} p={p}: transparent pixel ({x}, {y}) painted");
+                    }
+                    if o.iter().zip(s).any(|(a, b)| (a - b).abs() > 1e-4) {
+                        (cx0, cx1, cy0, cy1) = (cx0.min(x), cx1.max(x + 1), cy0.min(y), cy1.max(y + 1));
+                    }
+                }
+            }
+            assert!(cx0 < cx1, "rows={rows} p={p}: no cursor visible");
+            assert!(cx0 >= x0 && cx1 <= x1 && cy0 >= y0 && cy1 <= y1, "rows={rows} p={p}: cursor x{cx0}..{cx1} y{cy0}..{cy1} outside block");
+            let max_h = ((y1 - y0) as f64 / rows).ceil() as usize;
+            assert!(cy1 - cy0 <= max_h, "rows={rows} p={p}: cursor {} px tall, row is {max_h}", cy1 - cy0);
+        }
+    }
+}
diff --git a/crates/render/tests/it/main.rs b/crates/render/tests/it/main.rs
new file mode 100644
index 000000000..73e898571
--- /dev/null
+++ b/crates/render/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod median_radius;
+mod noise_frame_cadence;
+mod sharpen_preview_res;
+mod underline_direction;
diff --git a/crates/render/tests/median_radius.rs b/crates/render/tests/it/median_radius.rs
similarity index 100%
rename from crates/render/tests/median_radius.rs
rename to crates/render/tests/it/median_radius.rs
diff --git a/crates/render/tests/noise_frame_cadence.rs b/crates/render/tests/it/noise_frame_cadence.rs
similarity index 100%
rename from crates/render/tests/noise_frame_cadence.rs
rename to crates/render/tests/it/noise_frame_cadence.rs
diff --git a/crates/render/tests/sharpen_preview_res.rs b/crates/render/tests/it/sharpen_preview_res.rs
similarity index 100%
rename from crates/render/tests/sharpen_preview_res.rs
rename to crates/render/tests/it/sharpen_preview_res.rs
diff --git a/crates/render/tests/underline_direction.rs b/crates/render/tests/it/underline_direction.rs
similarity index 100%
rename from crates/render/tests/underline_direction.rs
rename to crates/render/tests/it/underline_direction.rs
diff --git a/crates/speech/Cargo.toml b/crates/speech/Cargo.toml
index 67f6d8fd6..d64ea0d88 100644
--- a/crates/speech/Cargo.toml
+++ b/crates/speech/Cargo.toml
@@ -14,7 +14,7 @@ default = []
 # Whisper inference on the CPU via candle (pure Rust). Off by default (and in wasm builds).
 whisper = ["dep:candle-core", "dep:candle-nn"]
 # Model downloads over HTTPS (pure-Rust TLS: rustls + RustCrypto, OS certificate verification).
-download = ["dep:ureq", "dep:rustls", "dep:rustls-rustcrypto", "dep:sha2"]
+download = ["dep:ureq", "dep:rustls", "dep:rustls-rustcrypto"]
 
 [dependencies]
 filmcraft-time = { workspace = true }
@@ -28,8 +28,11 @@ rayon = { workspace = true }
 ureq = { version = "3", default-features = false, features = ["rustls-no-provider", "platform-verifier"], optional = true }
 rustls = { version = "0.23", default-features = false, optional = true }
 rustls-rustcrypto = { version = "0.0.2-alpha", optional = true }
-sha2 = { version = "0.10", optional = true }
+sha2 = "0.10"
 
 [[example]]
 name = "transcribe"
 required-features = ["whisper"]
+
+[dev-dependencies]
+tempfile = "3.27"
diff --git a/crates/speech/src/diarize.rs b/crates/speech/src/diarize.rs
index 3271b0257..d09a6b749 100644
--- a/crates/speech/src/diarize.rs
+++ b/crates/speech/src/diarize.rs
@@ -46,6 +46,9 @@ impl Default for Params {
 const N_MELS: usize = 40;
 const N_MFCC: usize = 20;
 const FRAME_TICKS: i64 = TICKS_PER_SAMPLE * crate::mel::HOP as i64;
+/// Agglomerative linkage is cubic in the number of turns; beyond this, retain a safe single-speaker
+/// transcript instead of making a document-controlled amount of work.
+const MAX_CLUSTER_CHUNKS: usize = 256;
 
 /// Word index ranges of the chunks.
 pub fn chunks(t: &Transcript, p: &Params) -> Vec<std::ops::Range<usize>> {
@@ -125,6 +128,9 @@ pub fn diarize(audio: &[f32], t: &mut Transcript, p: &Params) -> usize {
     if ch.len() < 2 {
         return one(t);
     }
+    if ch.len() > MAX_CLUSTER_CHUNKS {
+        return one(t);
+    }
     let (frames, energy, mfcc) = mfcc_frames(audio);
     // chunk vectors: mean and std of MFCC 1..N over voiced frames
     let dim = 2 * (N_MFCC - 1);
@@ -329,4 +335,12 @@ mod tests {
         let t = Transcript { words: vec![w(0.0, 0.5), w(0.5, 1.0), w(2.0, 2.2), w(3.0, 3.6), w(3.6, 4.4)], ..Default::default() };
         assert_eq!(chunks(&t, &Params::default()), vec![0..3, 3..5]);
     }
+
+    #[test]
+    fn excessive_turns_fall_back_without_clustering() {
+        let words = (0..=MAX_CLUSTER_CHUNKS).map(|i| Word::new("x", seconds_tick(i as f64 * 2.0), seconds_tick(i as f64 * 2.0 + 1.0))).collect();
+        let mut t = Transcript { words, ..Default::default() };
+        assert_eq!(diarize(&[], &mut t, &Params::default()), 1);
+        assert!(t.words.iter().all(|word| word.speaker == Some(0)));
+    }
 }
diff --git a/crates/speech/src/models.rs b/crates/speech/src/models.rs
index 4d257159d..9fcccc5f5 100644
--- a/crates/speech/src/models.rs
+++ b/crates/speech/src/models.rs
@@ -12,6 +12,7 @@
 use std::path::{Path, PathBuf};
 
 use serde::Serialize;
+use sha2::Digest;
 
 /// One file of a model.
 #[derive(Clone, Copy, Debug, Serialize)]
@@ -195,16 +196,36 @@ pub fn model_dir(models_dir: &Path, m: &ModelInfo) -> PathBuf {
     models_dir.join(m.id)
 }
 
-/// All files present with their catalogue sizes (contents were verified when downloaded).
+fn valid_name(name: &str) -> bool {
+    !name.is_empty()
+        && !name.contains(['/', '\\'])
+        && !matches!(name, "." | "..")
+        && Path::new(name).components().count() == 1
+        && Path::new(name).file_name().is_some_and(|part| part == name)
+}
+
+fn valid_file(path: &Path, file: &ModelFile) -> bool {
+    if !valid_name(file.name) || !std::fs::metadata(path).is_ok_and(|metadata| metadata.is_file() && metadata.len() == file.size) {
+        return false;
+    }
+    let Ok(mut input) = std::fs::File::open(path) else { return false };
+    let mut hasher = sha2::Sha256::new();
+    if std::io::copy(&mut input, &mut hasher).is_err() {
+        return false;
+    }
+    format!("{:x}", hasher.finalize()).eq_ignore_ascii_case(file.sha256)
+}
+
+/// All files present and matching their pinned size and SHA-256.
 pub fn installed(models_dir: &Path, m: &ModelInfo) -> bool {
     let d = model_dir(models_dir, m);
-    m.files.iter().all(|f| std::fs::metadata(d.join(f.name)).is_ok_and(|md| md.len() == f.size))
+    m.files.iter().all(|f| valid_file(&d.join(f.name), f))
 }
 
 /// Bytes still to download for `m` (files already present are skipped).
 pub fn missing_bytes(models_dir: &Path, m: &ModelInfo) -> u64 {
     let d = model_dir(models_dir, m);
-    m.files.iter().filter(|f| !std::fs::metadata(d.join(f.name)).is_ok_and(|md| md.len() == f.size)).map(|f| f.size).sum()
+    m.files.iter().filter(|f| !valid_file(&d.join(f.name), f)).map(|f| f.size).sum()
 }
 
 /// The tokenizer shared by the multilingual models has one checksum.
@@ -231,15 +252,17 @@ pub fn download(models_dir: &Path, m: &ModelInfo, progress: DownloadProgress) ->
 #[cfg(feature = "download")]
 pub fn download_files(dir: &Path, files: &[ModelFile], progress: DownloadProgress) -> Result<(), crate::SpeechError> {
     use crate::SpeechError;
-    use sha2::Digest;
     use std::io::{Read, Write};
+    if let Some(file) = files.iter().find(|file| !valid_name(file.name)) {
+        return Err(SpeechError::Download(format!("invalid model artifact name: {:?}", file.name)));
+    }
     std::fs::create_dir_all(dir)?;
-    let total: u64 = files.iter().filter(|f| !std::fs::metadata(dir.join(f.name)).is_ok_and(|md| md.len() == f.size)).map(|f| f.size).sum();
+    let total: u64 = files.iter().filter(|f| !valid_file(&dir.join(f.name), f)).map(|f| f.size).sum();
     let agent = agent();
     let mut done = 0u64;
     for f in files {
         let dest = dir.join(f.name);
-        if std::fs::metadata(&dest).is_ok_and(|md| md.len() == f.size) {
+        if valid_file(&dest, f) {
             continue;
         }
         let part = dir.join(format!("{}.part", f.name));
@@ -322,4 +345,41 @@ mod tests {
         assert_eq!(missing_bytes(&dir, m), m.size());
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    #[test]
+    fn artifact_names_stay_inside_the_model_directory() {
+        for name in ["../escape", "/tmp/escape", r"..\escape", r"C:\escape", "", ".", ".."] {
+            assert!(!valid_name(name), "accepted {name:?}");
+        }
+        assert!(valid_name("model.safetensors"));
+    }
+
+    #[test]
+    fn same_length_corruption_is_not_installed() {
+        static FILES: &[ModelFile] = &[ModelFile {
+            name: "tiny.bin",
+            url: "https://example.invalid/tiny.bin",
+            sha256: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+            size: 3,
+        }];
+        let model = ModelInfo {
+            id: "integrity-test",
+            name: "integrity test",
+            multilingual: false,
+            description: "",
+            license: "",
+            license_url: "",
+            author: "",
+            source: "",
+            files: FILES,
+        };
+        let root = tempfile::tempdir().unwrap();
+        let directory = model_dir(root.path(), &model);
+        std::fs::create_dir_all(&directory).unwrap();
+        std::fs::write(directory.join("tiny.bin"), b"bad").unwrap();
+        assert!(!installed(root.path(), &model));
+        assert_eq!(missing_bytes(root.path(), &model), 3);
+        std::fs::write(directory.join("tiny.bin"), b"abc").unwrap();
+        assert!(installed(root.path(), &model));
+    }
 }
diff --git a/crates/speech/src/whisper/mod.rs b/crates/speech/src/whisper/mod.rs
index 6a602bce1..b84c82e9c 100644
--- a/crates/speech/src/whisper/mod.rs
+++ b/crates/speech/src/whisper/mod.rs
@@ -43,6 +43,8 @@ const N_FRAMES: usize = 3000;
 const FRAMES_PER_TS: usize = 2;
 const SAMPLES_PER_FRAME: usize = crate::mel::HOP;
 const MAX_TOKENS: usize = 224;
+/// More than the total alignment heads in any published Whisper architecture.
+const MAX_ALIGNMENT_HEADS: usize = 4_096;
 
 fn merr(e: candle_core::Error) -> SpeechError {
     SpeechError::Model(e.to_string())
@@ -66,11 +68,7 @@ impl Whisper {
         let gen_cfg: serde_json::Value = serde_json::from_slice(&read("generation_config.json")?).unwrap_or_default();
         let tok = Tokenizer::from_json(&String::from_utf8_lossy(&read("tokenizer.json")?))?;
         let weights = read("model.safetensors")?;
-        let alignment_heads = gen_cfg["alignment_heads"]
-            .as_array()
-            .map(|a| a.iter().filter_map(|p| Some((p[0].as_u64()? as usize, p[1].as_u64()? as usize))).collect::<Vec<_>>())
-            .filter(|v| !v.is_empty())
-            .unwrap_or_else(|| (cfg.decoder_layers / 2..cfg.decoder_layers).flat_map(|l| (0..cfg.decoder_attention_heads).map(move |h| (l, h))).collect());
+        let alignment_heads = alignment_heads(&cfg, &gen_cfg)?;
         let mut suppress: Vec<u32> =
             gen_cfg["suppress_tokens"].as_array().map(|a| a.iter().filter_map(|x| x.as_u64().map(|v| v as u32)).collect()).unwrap_or_default();
         suppress.extend(tok.non_text_specials());
@@ -193,6 +191,34 @@ impl Whisper {
     }
 }
 
+fn alignment_heads(cfg: &Config, generation: &serde_json::Value) -> Result<Vec<(usize, usize)>, SpeechError> {
+    let bad = |message: &str| SpeechError::Model(format!("generation_config.json: {message}"));
+    if let Some(values) = generation["alignment_heads"].as_array().filter(|values| !values.is_empty()) {
+        if values.len() > MAX_ALIGNMENT_HEADS {
+            return Err(bad("too many alignment heads"));
+        }
+        return values
+            .iter()
+            .map(|pair| {
+                let layer =
+                    pair.get(0).and_then(serde_json::Value::as_u64).and_then(|v| usize::try_from(v).ok()).ok_or_else(|| bad("invalid alignment head"))?;
+                let head =
+                    pair.get(1).and_then(serde_json::Value::as_u64).and_then(|v| usize::try_from(v).ok()).ok_or_else(|| bad("invalid alignment head"))?;
+                if layer >= cfg.decoder_layers || head >= cfg.decoder_attention_heads {
+                    return Err(bad("alignment head is outside the decoder architecture"));
+                }
+                Ok((layer, head))
+            })
+            .collect();
+    }
+    let first_layer = cfg.decoder_layers / 2;
+    let count = cfg.decoder_layers.saturating_sub(first_layer).checked_mul(cfg.decoder_attention_heads).ok_or_else(|| bad("alignment-head count overflow"))?;
+    if count > MAX_ALIGNMENT_HEADS {
+        return Err(bad("alignment-head fallback is too large"));
+    }
+    Ok((first_layer..cfg.decoder_layers).flat_map(|layer| (0..cfg.decoder_attention_heads).map(move |head| (layer, head))).collect())
+}
+
 fn softmax_at(x: &[f32], i: usize) -> f32 {
     let m = x.iter().copied().fold(f32::NEG_INFINITY, f32::max);
     let s: f32 = x.iter().map(|v| (v - m).exp()).sum();
@@ -335,6 +361,27 @@ impl Transcriber for Whisper {
 mod tests {
     use super::*;
 
+    fn config(layers: usize, heads: usize) -> Config {
+        Config {
+            num_mel_bins: 80,
+            d_model: 384,
+            encoder_layers: 4,
+            encoder_attention_heads: 6,
+            decoder_layers: layers,
+            decoder_attention_heads: heads,
+            max_source_positions: 1_500,
+            max_target_positions: 448,
+            vocab_size: 51_865,
+        }
+    }
+
+    #[test]
+    fn fallback_alignment_heads_are_bounded_before_collection() {
+        let error = alignment_heads(&config(usize::MAX, usize::MAX), &serde_json::Value::Null).unwrap_err();
+        assert!(error.to_string().contains("alignment-head"));
+        assert_eq!(alignment_heads(&config(4, 6), &serde_json::Value::Null).unwrap().len(), 12);
+    }
+
     #[test]
     fn repetition_guard() {
         let tb = 1000;
diff --git a/crates/speech/src/whisper/tokenizer.rs b/crates/speech/src/whisper/tokenizer.rs
index 2fa024b22..e9eba3328 100644
--- a/crates/speech/src/whisper/tokenizer.rs
+++ b/crates/speech/src/whisper/tokenizer.rs
@@ -9,6 +9,9 @@ use std::collections::HashMap;
 
 use crate::SpeechError;
 
+/// Generous ceiling above every published Whisper vocabulary, before allocating a dense id table.
+const MAX_VOCAB_ID: u64 = 1_000_000;
+
 pub struct Tokenizer {
     /// Bytes of each regular token, by id.
     bytes: Vec<Vec<u8>>,
@@ -48,7 +51,11 @@ impl Tokenizer {
         let v: serde_json::Value = serde_json::from_str(json).map_err(|e| bad(&e.to_string()))?;
         let vocab = v["model"]["vocab"].as_object().ok_or_else(|| bad("no model.vocab"))?;
         let table = unicode_to_byte();
-        let max = vocab.values().filter_map(|x| x.as_u64()).max().unwrap_or(0) as usize;
+        let max = vocab.values().filter_map(|x| x.as_u64()).max().unwrap_or(0);
+        if max > MAX_VOCAB_ID {
+            return Err(bad("vocab id is too large"));
+        }
+        let max = usize::try_from(max).map_err(|_| bad("vocab id is too large"))?;
         let mut bytes = vec![Vec::new(); max + 1];
         for (tok, id) in vocab {
             let id = id.as_u64().ok_or_else(|| bad("vocab id"))? as usize;
@@ -164,3 +171,18 @@ pub fn group_words(tok: &Tokenizer, ids: &[u32]) -> Vec<(String, std::ops::Range
     }
     groups.into_iter().map(|(b, r)| (String::from_utf8_lossy(&b).trim().to_string(), r)).filter(|(t, _)| !t.is_empty()).collect()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sparse_huge_vocab_id_is_rejected_before_allocation() {
+        let json = format!(r#"{{"model":{{"vocab":{{"x":{}}}}},"added_tokens":[]}}"#, MAX_VOCAB_ID + 1);
+        let error = match Tokenizer::from_json(&json) {
+            Err(error) => error,
+            Ok(_) => panic!("huge sparse vocabulary was accepted"),
+        };
+        assert!(error.to_string().contains("vocab id is too large"));
+    }
+}
diff --git a/crates/testkit/Cargo.toml b/crates/testkit/Cargo.toml
index eca8a6c87..f4da4a400 100644
--- a/crates/testkit/Cargo.toml
+++ b/crates/testkit/Cargo.toml
@@ -14,3 +14,8 @@ workspace = true
 # use it without creating dependency cycles.
 [dependencies]
 png = "0.18"
+chrono = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3.27"
+
diff --git a/crates/testkit/src/deadline.rs b/crates/testkit/src/deadline.rs
new file mode 100644
index 000000000..befb6508a
--- /dev/null
+++ b/crates/testkit/src/deadline.rs
@@ -0,0 +1,66 @@
+//! Hang guard for hostile-input sweeps: a test body runs on a worker thread, and a body that does not finish
+//! within the budget fails the test (naming the input it was last working on) instead of stalling CI forever.
+//! A merely slow body is not a failure, so a loaded runner or slow VM cannot fail a correct decoder.
+
+use std::panic::{AssertUnwindSafe, catch_unwind, resume_unwind};
+use std::sync::mpsc::{self, RecvTimeoutError};
+use std::sync::{Mutex, PoisonError};
+use std::time::Duration;
+
+static PROGRESS: Mutex<String> = Mutex::new(String::new());
+
+/// Record the input being worked on, so a hang report can name it. Cheap enough to call per input.
+pub fn set_progress(label: &str) {
+    let mut p = PROGRESS.lock().unwrap_or_else(PoisonError::into_inner);
+    p.clear();
+    p.push_str(label);
+}
+
+/// Run `f` on a worker thread and wait at most `secs` seconds (`FILMCRAFT_HOSTILE_TIMEOUT_SECS` overrides the
+/// budget). A panic in `f` is re-raised here; a timeout panics with the last [`set_progress`] label. A hung
+/// worker is abandoned (the failing test process exits anyway).
+pub fn with_deadline(secs: u64, f: impl FnOnce() + Send + 'static) {
+    let secs = std::env::var("FILMCRAFT_HOSTILE_TIMEOUT_SECS").ok().and_then(|v| v.parse::<u64>().ok()).filter(|&n| n > 0).unwrap_or(secs);
+    run_with_deadline(secs, f);
+}
+
+fn run_with_deadline(secs: u64, f: impl FnOnce() + Send + 'static) {
+    let (tx, rx) = mpsc::channel();
+    // a failed spawn shows up as "worker gone" below
+    let _ = std::thread::Builder::new().name("hostile deadline".into()).spawn(move || {
+        let _ = tx.send(catch_unwind(AssertUnwindSafe(f)));
+    });
+    match rx.recv_timeout(Duration::from_secs(secs)) {
+        Ok(Ok(())) => {}
+        Ok(Err(payload)) => resume_unwind(payload),
+        Err(RecvTimeoutError::Timeout) => {
+            let last = PROGRESS.lock().unwrap_or_else(PoisonError::into_inner).clone();
+            panic!("hostile-input test did not finish in {secs}s (hang); last input: {last}");
+        }
+        Err(RecvTimeoutError::Disconnected) => panic!("hostile-input worker thread could not run"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_slow_body_passes() {
+        with_deadline(30, || std::thread::sleep(Duration::from_millis(100)));
+    }
+
+    #[test]
+    #[should_panic(expected = "boom")]
+    fn a_panic_in_the_body_is_re_raised() {
+        with_deadline(30, || panic!("boom"));
+    }
+
+    #[test]
+    #[should_panic(expected = "last input: seed 7 byte 3")]
+    fn a_hang_fails_and_names_the_input() {
+        // a body that outlives the 1 s budget; the inner fn, so FILMCRAFT_HOSTILE_TIMEOUT_SECS cannot lengthen it
+        set_progress("seed 7 byte 3");
+        run_with_deadline(1, || std::thread::sleep(Duration::from_secs(30)));
+    }
+}
diff --git a/crates/testkit/src/fixtures.rs b/crates/testkit/src/fixtures.rs
index 62e9a1449..22e3c7a88 100644
--- a/crates/testkit/src/fixtures.rs
+++ b/crates/testkit/src/fixtures.rs
@@ -122,8 +122,8 @@ mod tests {
 
     #[test]
     fn generate_is_cached_and_atomic() {
-        let dir = std::env::temp_dir().join(format!("filmcraft-testkit-gen-{}", std::process::id()));
-        let out = dir.join("f.bin");
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("f.bin");
         let _ = std::fs::remove_file(&out);
         assert!(generate(&out, |_| false).is_none());
         assert!(!out.exists());
diff --git a/crates/testkit/src/golden.rs b/crates/testkit/src/golden.rs
index 922d4facb..03655f483 100644
--- a/crates/testkit/src/golden.rs
+++ b/crates/testkit/src/golden.rs
@@ -195,18 +195,31 @@ pub fn diff_image(a: &Rgba8, b: &Rgba8) -> Rgba8 {
 
 /// Today's date (UTC) as YYYY-MM-DD, for attribution sidecars.
 fn today() -> String {
-    let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
-    // civil-from-days (Howard Hinnant)
-    let z = (secs / 86_400) as i64 + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + (m <= 2) as i64;
-    format!("{y:04}-{m:02}-{d:02}")
+    let since = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
+    let (y, t) = utc_parts(since.as_secs());
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%d"))
+}
+
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month and day come from chrono and only the year is carried, which keeps every input exact
+/// instead of collapsing out-of-range years to the epoch. `secs` is `u64` (the clock is clamped at
+/// the epoch before 1970), so `days` always fits an `i64`.
+fn utc_parts(secs: u64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((secs / 86_400) as i64, (secs % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
 }
 
 /// The attribution sidecar text for a generated golden image.
@@ -283,6 +296,23 @@ pub fn assert_golden(golden: &Path, actual: &Rgba8, tol: Tolerance, title: &str,
 mod tests {
     use super::*;
 
+    fn ymd(secs: u64) -> String {
+        let (y, t) = utc_parts(secs);
+        format!("{y:04}-{}", t.format("%m-%d"))
+    }
+
+    #[test]
+    fn utc_parts_preserves_out_of_range_years() {
+        // `today()` uses `utc_parts`. Years far outside chrono's own range are preserved (the old
+        // hand-rolled civil-from-days kept them) rather than collapsing to the epoch.
+        assert_eq!(ymd(0), "1970-01-01");
+        assert_eq!(ymd(1_790_775_907), "2026-09-30");
+        assert_eq!(ymd(951_782_400), "2000-02-29"); // 2000 is a leap year
+        assert_eq!(ymd(253_402_300_800), "10000-01-01"); // just past chrono's range
+        assert_eq!(ymd(10_000_000_000_000), "318857-05-20");
+        assert_eq!(ymd(u64::MAX), "584554051223-11-09");
+    }
+
     fn ramp(w: u32, h: u32, alpha: u8) -> Rgba8 {
         let px = (0..w * h).flat_map(|i| [(i % w * 255 / w) as u8, (i / w * 255 / h) as u8, 77, alpha]).collect();
         Rgba8::new(w, h, px)
@@ -318,8 +348,8 @@ mod tests {
         if blessing() {
             return;
         }
-        let dir = std::env::temp_dir().join(format!("filmcraft-testkit-golden-{}", std::process::id()));
-        let path = dir.join("ramp.png");
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("ramp.png");
         let img = ramp(32, 16, 255);
         write_png(&path, &img).unwrap();
         assert!(check_golden(&path, &img, Tolerance::EXACT, "t", "unit test").is_ok());
@@ -330,7 +360,7 @@ mod tests {
         far.px.iter_mut().step_by(4).for_each(|v| *v = 255 - *v);
         let e = check_golden(&path, &far, Tolerance::RENDER, "t", "unit test").unwrap_err();
         assert!(e.contains("PSNR"), "{e}");
-        assert!(check_golden(&dir.join("missing.png"), &img, Tolerance::RENDER, "t", "unit test").unwrap_err().contains("FILMCRAFT_BLESS"));
+        assert!(check_golden(&dir.path().join("missing.png"), &img, Tolerance::RENDER, "t", "unit test").unwrap_err().contains("FILMCRAFT_BLESS"));
     }
 
     #[test]
diff --git a/crates/testkit/src/lib.rs b/crates/testkit/src/lib.rs
index 9846d9072..a67fbfaa5 100644
--- a/crates/testkit/src/lib.rs
+++ b/crates/testkit/src/lib.rs
@@ -10,14 +10,17 @@
 //! ffmpeg/ffprobe are external test oracles and fixture generators only; they are never linked
 //! or shipped (AGENTS.md §2).
 
+pub mod deadline;
 pub mod fixtures;
 pub mod golden;
 pub mod oracle;
 pub mod wav;
 
+pub use deadline::{set_progress, with_deadline};
 pub use fixtures::{fixtures_dir, temp_path, workspace_root};
 pub use oracle::{
-    ffmpeg, ffmpeg_or_skip, ffmpeg_supports_format, ffmpeg_version, ffmpeg_with_format_or_skip, ffprobe, ffprobe_or_skip, oracles_required, skip,
+    ffmpeg, ffmpeg_has_encoder, ffmpeg_or_skip, ffmpeg_supports_format, ffmpeg_version, ffmpeg_with_format_or_skip, ffprobe, ffprobe_or_skip, oracles_required,
+    skip,
 };
 
 /// `let ff = require_ffmpeg!();` — the ffmpeg path, or return from the test after printing
diff --git a/crates/testkit/src/oracle.rs b/crates/testkit/src/oracle.rs
index e0b13863c..ba8981084 100644
--- a/crates/testkit/src/oracle.rs
+++ b/crates/testkit/src/oracle.rs
@@ -11,6 +11,7 @@
 //! `FILMCRAFT_REQUIRE_ORACLES=1` is set (CI), which turns every skip into a failure.
 
 use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
 use std::sync::OnceLock;
 
 /// Environment variable that makes missing oracles a hard failure.
@@ -116,6 +117,19 @@ pub fn ffmpeg_or_skip(context: &str) -> Option<PathBuf> {
     tool_or_skip("ffmpeg", ffmpeg(), context)
 }
 
+/// Whether `ffmpeg -encoders` lists `encoder` (e.g. `libx265`): lets a test tell "this ffmpeg lacks the encoder"
+/// (skip) from "the encoder is there but failed" (a real failure).
+pub fn ffmpeg_has_encoder(ffmpeg: &Path, encoder: &str) -> bool {
+    let Ok(out) = Command::new(ffmpeg).args(["-hide_banner", "-encoders"]).stdin(Stdio::null()).output() else { return false };
+    encoders_output_lists(&String::from_utf8_lossy(&out.stdout), encoder)
+}
+
+/// Pure function of the `ffmpeg -encoders` output: whether `encoder` is one of the listed names.
+fn encoders_output_lists(output: &str, encoder: &str) -> bool {
+    // rows look like ` V....D libx264   libx264 H.264 …`; the name is the second whitespace-separated token
+    output.lines().any(|line| line.split_whitespace().nth(1) == Some(encoder))
+}
+
 /// ffprobe, or `None` after reporting a skip (see [`skip`]).
 pub fn ffprobe_or_skip(context: &str) -> Option<PathBuf> {
     tool_or_skip("ffprobe", ffprobe(), context)
@@ -177,12 +191,19 @@ pub fn ffmpeg_with_format_or_skip(context: &str, format_name: &str, min_version:
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn encoder_lookup_matches_the_name_column_only() {
+        let out = " V....D libx264              libx264 H.264 / AVC\n V....D libx265              libx265 H.265 / HEVC (libx265)\n A....D aac                  AAC (libx264 inside)\n";
+        assert!(encoders_output_lists(out, "libx264"));
+        assert!(encoders_output_lists(out, "libx265"));
+        assert!(!encoders_output_lists(out, "libsvtav1"));
+        assert!(!encoders_output_lists(out, "H.264"));
+    }
     use std::ffi::OsString;
 
-    fn tmpdir(tag: &str) -> PathBuf {
-        let d = std::env::temp_dir().join(format!("filmcraft-testkit-{tag}-{}", std::process::id()));
-        std::fs::create_dir_all(&d).unwrap();
-        d
+    fn tmpdir(_tag: &str) -> PathBuf {
+        tempfile::tempdir().unwrap().keep()
     }
 
     #[test]
diff --git a/crates/text/Cargo.toml b/crates/text/Cargo.toml
index 00989623d..811164495 100644
--- a/crates/text/Cargo.toml
+++ b/crates/text/Cargo.toml
@@ -21,3 +21,6 @@ unicode-bidi = "0.3.18"
 unicode-linebreak = "0.1.5"
 # UAX #29 extended grapheme clusters (MIT OR Apache-2.0).
 unicode-segmentation = "1.13"
+
+[dev-dependencies]
+tempfile = "3.27"
diff --git a/crates/text/build.rs b/crates/text/build.rs
index 715a8b7df..17a5bf843 100644
--- a/crates/text/build.rs
+++ b/crates/text/build.rs
@@ -5,7 +5,8 @@
 //! `crates/text`) this embeds every font listed in its
 //! `fonts/manifest.txt` as [`CRAFT_FONTS`](crate::fonts::CRAFT_FONTS); unset, `CRAFT_FONTS` is
 //! empty and nothing else changes. A `CRAFT_FONTS_DIR` that is not a checkout is a warning, or an
-//! error with `CRAFT_FONTS_REQUIRED=1` (release builds).
+//! error with `CRAFT_FONTS_REQUIRED=1` (release builds), which also makes an unset or empty
+//! `CRAFT_FONTS_DIR` an error.
 //!
 //! Native builds embed every font. The web (wasm32) build embeds only the UI font (BIZ UDPGothic
 //! Regular, ~4.5 MB) to stay under the web size budget (Cloudflare serves files up to 25 MiB).
@@ -18,15 +19,18 @@ fn main() {
     println!("cargo::rerun-if-changed=build.rs");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_DIR");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_REQUIRED");
+    let required = std::env::var_os("CRAFT_FONTS_REQUIRED").is_some_and(|v| v == "1");
     let mut src = String::from("pub static CRAFT_FONTS: &[CraftFont] = &[\n");
-    if let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR").map(PathBuf::from) {
-        match craft_fonts(&dir) {
+    match std::env::var_os("CRAFT_FONTS_DIR").filter(|d| !d.is_empty()).map(PathBuf::from) {
+        Some(dir) => match craft_fonts(&dir) {
             Ok(entries) => src.push_str(&entries),
-            Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
-                println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
-            }
+            Err(e) if required => println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display()),
             Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
+        },
+        None if required => {
+            println!("cargo::error=CRAFT_FONTS_REQUIRED=1 but CRAFT_FONTS_DIR is unset or empty: point it at a craft-fonts checkout (absolute path)");
         }
+        None => {}
     }
     src.push_str("];\n");
     let out = PathBuf::from(std::env::var_os("OUT_DIR").unwrap_or_default()).join("craft_fonts.rs");
diff --git a/crates/text/src/fonts.rs b/crates/text/src/fonts.rs
index a6c3f444f..5f97bcf98 100644
--- a/crates/text/src/fonts.rs
+++ b/crates/text/src/fonts.rs
@@ -6,8 +6,9 @@
 //! [`resolve`] maps a family + style name (as stored in projects) to a face and the synthetic
 //! bold/italic needed when the family lacks that style. Unknown families fall back to Inter.
 
+use std::ffi::OsStr;
 use std::path::PathBuf;
-use std::sync::{Arc, OnceLock, RwLock};
+use std::sync::{Arc, OnceLock, PoisonError, RwLock};
 
 use skrifa::instance::{LocationRef, Size};
 use skrifa::{FontRef, MetadataProvider};
@@ -114,16 +115,46 @@ fn walk(dir: &std::path::Path, depth: u32, out: &mut Vec<PathBuf>) {
     let Ok(rd) = std::fs::read_dir(dir) else { return };
     for e in rd.flatten() {
         let p = e.path();
-        if p.is_dir() {
+        let Ok(file_type) = e.file_type() else { continue };
+        // Font discovery is bounded to the configured folders: never follow a symlinked folder
+        // into a loop or an unrelated tree. Symlinked font files (NixOS, home-manager, Debian
+        // alternatives) still count.
+        let is_file = if file_type.is_symlink() { std::fs::metadata(&p).is_ok_and(|m| m.is_file()) } else { file_type.is_file() };
+        if file_type.is_dir() {
             if depth < 4 {
                 walk(&p, depth + 1, out);
             }
-        } else if p.extension().and_then(|x| x.to_str()).is_some_and(|x| matches!(x.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc")) {
+        } else if is_file && p.extension().and_then(OsStr::to_str).is_some_and(|x| matches!(x.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc")) {
             out.push(p);
         }
     }
 }
 
+#[cfg(all(test, unix))]
+mod directory_tests {
+    use super::walk;
+
+    #[test]
+    fn directory_source_does_not_follow_symlinked_font_trees() {
+        use std::os::unix::fs::symlink;
+
+        let root = tempfile::tempdir().unwrap();
+        let configured = root.path().join("configured");
+        let foreign = root.path().join("foreign");
+        std::fs::create_dir_all(&configured).unwrap();
+        std::fs::create_dir_all(&foreign).unwrap();
+        std::fs::write(configured.join("inside.ttf"), b"").unwrap();
+        std::fs::write(foreign.join("outside.ttf"), b"").unwrap();
+        symlink(&foreign, configured.join("loop")).unwrap();
+        symlink(foreign.join("outside.ttf"), configured.join("linked.ttf")).unwrap();
+
+        let mut found = Vec::new();
+        walk(&configured, 0, &mut found);
+        found.sort();
+        assert_eq!(found, vec![configured.join("inside.ttf"), configured.join("linked.ttf")]);
+    }
+}
+
 impl FontSource for DirectorySource {
     fn faces(&self) -> Vec<FaceInfo> {
         let mut files = Vec::new();
@@ -312,7 +343,7 @@ fn push(db: &mut Db, info: FaceInfo) -> FaceId {
 /// added.
 pub fn add_source(src: &dyn FontSource) -> usize {
     let faces = src.faces();
-    let mut d = db().write().unwrap_or_else(|e| e.into_inner());
+    let mut d = db().write().unwrap_or_else(PoisonError::into_inner);
     let mut n = 0;
     for f in faces {
         let dup = d.faces.iter().any(|g| g.info.family.eq_ignore_ascii_case(&f.family) && g.info.style.eq_ignore_ascii_case(&f.style));
@@ -328,7 +359,7 @@ pub fn add_source(src: &dyn FontSource) -> usize {
 pub fn add_font_data(data: Vec<u8>) -> Vec<FaceId> {
     let data = Arc::new(data);
     let names = read_faces_bytes(&data);
-    let mut d = db().write().unwrap_or_else(|e| e.into_inner());
+    let mut d = db().write().unwrap_or_else(PoisonError::into_inner);
     names.into_iter().map(|n| push(&mut d, info_from(n, FaceData::Shared(data.clone()), "user"))).collect()
 }
 
@@ -338,17 +369,17 @@ pub fn scan_system() -> usize {
     // Held for the whole scan: a concurrent caller waits for the complete list instead of
     // returning early and resolving against a half-filled database.
     static SCAN: std::sync::Mutex<()> = std::sync::Mutex::new(());
-    let _scan = SCAN.lock().unwrap_or_else(|e| e.into_inner());
+    let _scan = SCAN.lock().unwrap_or_else(PoisonError::into_inner);
     if system_scanned() {
         return 0;
     }
     let n = if cfg!(target_arch = "wasm32") { 0 } else { add_source(&DirectorySource::system()) };
-    db().write().unwrap_or_else(|e| e.into_inner()).scanned = true;
+    db().write().unwrap_or_else(PoisonError::into_inner).scanned = true;
     n
 }
 
 pub fn system_scanned() -> bool {
-    db().read().unwrap_or_else(|e| e.into_inner()).scanned
+    db().read().unwrap_or_else(PoisonError::into_inner).scanned
 }
 
 /// A face by id (unknown ids give the default face).
@@ -356,13 +387,13 @@ pub fn system_scanned() -> bool {
 // created, so `faces` is never empty.
 #[allow(clippy::expect_used)]
 pub fn face(id: FaceId) -> Arc<Face> {
-    let d = db().read().unwrap_or_else(|e| e.into_inner());
+    let d = db().read().unwrap_or_else(PoisonError::into_inner);
     d.faces.get(id).or_else(|| d.faces.first()).cloned().expect("bundled fonts present")
 }
 
 /// All faces (bundled first).
 pub fn all_faces() -> Vec<Arc<Face>> {
-    db().read().unwrap_or_else(|e| e.into_inner()).faces.clone()
+    db().read().unwrap_or_else(PoisonError::into_inner).faces.clone()
 }
 
 /// Families with their style names, sorted by family; styles in weight order.
diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index 50fbed58e..d14819349 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -544,10 +544,18 @@ fn paragraph(text: &str, base: usize, sty: &Styles, para: &ParagraphStyle) -> Ve
         let mut cluster_starts: Vec<usize> = extents.keys().copied().collect();
         cluster_starts.sort_unstable();
         let char_bytes: Vec<usize> = text[r.clone()].char_indices().map(|(b, _)| r.start + b).collect();
+        let mut first_member = 0usize;
         for (ci, &cs) in cluster_starts.iter().enumerate() {
             let (x0, x1, rtl) = extents[&cs];
             let next = cluster_starts.get(ci + 1).copied().unwrap_or(r.end);
-            let members: Vec<usize> = char_bytes.iter().copied().filter(|b| *b >= cs && *b < next).collect();
+            while first_member < char_bytes.len() && char_bytes[first_member] < cs {
+                first_member += 1;
+            }
+            let member_start = first_member;
+            while first_member < char_bytes.len() && char_bytes[first_member] < next {
+                first_member += 1;
+            }
+            let members = &char_bytes[member_start..first_member];
             let n = members.len().max(1) as f32;
             for (mi, b) in members.iter().enumerate() {
                 let f = mi as f32 / n;
@@ -931,13 +939,16 @@ mod tests {
     #[test]
     fn japanese_vertical_titles_with_an_installed_font() {
         // Japanese glyphs come from the craft-fonts (built with CRAFT_FONTS_DIR) or a system font:
-        // skip where neither is present.
+        // skip where neither is present. `covers_text` probes a face without keeping its file:
+        // `has_char` over every installed face would load each font file (a CJK collection once
+        // per face in it) and keep them all, gigabytes on a machine with Noto CJK installed.
         crate::fonts::scan_system();
-        if !crate::fonts::all_faces().iter().any(|f| "日本語縦書き".chars().all(|c| f.has_char(c))) {
+        let Some(face) = crate::fonts::all_faces().into_iter().find(|f| f.covers_text("日本語縦書き")) else {
             eprintln!("SKIPPED: no Japanese font installed");
             return;
-        }
-        let l = layout("日本語\n縦書き", &st(40.0), &ParagraphStyle { vertical: true, ..Default::default() });
+        };
+        let style = TextStyle { family: face.info.family.clone(), style: face.info.style.clone(), ..st(40.0) };
+        let l = layout("日本語\n縦書き", &style, &ParagraphStyle { vertical: true, ..Default::default() });
         assert!(l.vertical);
         assert_eq!(l.glyphs.len(), 6);
         assert!(l.glyphs.iter().all(|g| g.id != 0));
diff --git a/crates/text/src/render.rs b/crates/text/src/render.rs
index 940767db1..7c6cc7616 100644
--- a/crates/text/src/render.rs
+++ b/crates/text/src/render.rs
@@ -11,7 +11,7 @@
 //! Synthetic bold grows outlines by 2.5 % of the size per side; synthetic italic slants by 12°.
 
 use std::collections::HashMap;
-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError};
 
 use skrifa::instance::{LocationRef, Size};
 use skrifa::outline::{DrawSettings, OutlinePen};
@@ -59,7 +59,7 @@ impl OutlinePen for Rec {
 fn outline(face: FaceId, gid: u32) -> Option<Arc<Vec<Cmd>>> {
     static C: OnceLock<Mutex<HashMap<(FaceId, u32), Option<Arc<Vec<Cmd>>>>>> = OnceLock::new();
     let c = C.get_or_init(Default::default);
-    if let Some(v) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&(face, gid)) {
+    if let Some(v) = c.lock().unwrap_or_else(PoisonError::into_inner).get(&(face, gid)) {
         return v.clone();
     }
     let f = fonts::face(face);
@@ -69,7 +69,7 @@ fn outline(face: FaceId, gid: u32) -> Option<Arc<Vec<Cmd>>> {
         g.draw(DrawSettings::unhinted(Size::unscaled(), LocationRef::default()), &mut rec).ok()?;
         Some(Arc::new(rec.0))
     });
-    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
+    let mut m = c.lock().unwrap_or_else(PoisonError::into_inner);
     if m.len() > 20_000 {
         m.clear();
     }
@@ -131,35 +131,62 @@ pub struct GlyphMask {
 
 type GKey = (FaceId, u32, u32, u8, bool, bool);
 
-fn glyph_cache() -> &'static Mutex<HashMap<GKey, Option<Arc<GlyphMask>>>> {
-    static C: OnceLock<Mutex<HashMap<GKey, Option<Arc<GlyphMask>>>>> = OnceLock::new();
+/// No single glyph mask may consume more than this much memory. Larger glyphs are filled directly
+/// into the caller's clipped destination instead of first allocating their complete bounds.
+const MAX_GLYPH_MASK_BYTES: usize = 16 << 20;
+/// The glyph cache is shared by every project in the process, so constrain its bytes as well as
+/// its number of entries.
+const MAX_GLYPH_CACHE_BYTES: usize = 64 << 20;
+
+#[derive(Default)]
+struct GlyphCache {
+    entries: HashMap<GKey, Option<Arc<GlyphMask>>>,
+    bytes: usize,
+}
+
+fn glyph_cache() -> &'static Mutex<GlyphCache> {
+    static C: OnceLock<Mutex<GlyphCache>> = OnceLock::new();
     C.get_or_init(Default::default)
 }
 
+fn glyph_mask_bounds(path: &Path) -> Option<(i32, i32, usize, usize)> {
+    let (x0, y0, x1, y1) = path.bounds()?;
+    let (left, top, right, bottom) = (x0.floor() as i64, y0.floor() as i64, x1.ceil() as i64, y1.ceil() as i64);
+    let (left, top) = (i32::try_from(left).ok()?, i32::try_from(top).ok()?);
+    let w = usize::try_from(right.saturating_sub(i64::from(left))).ok()?.max(1);
+    let h = usize::try_from(bottom.saturating_sub(i64::from(top))).ok()?.max(1);
+    let bytes = w.checked_mul(h)?.checked_mul(std::mem::size_of::<f32>())?;
+    (bytes <= MAX_GLYPH_MASK_BYTES).then_some((left, top, w, h))
+}
+
 /// Rasterise glyph `g` at pixel size `px` with horizontal phase `frac` (0..1, quantised to ¼).
 pub fn glyph_mask(g: &Glyph, px: f32, frac: f32) -> Option<Arc<GlyphMask>> {
     let size_q = (px * 8.0).round().max(1.0) as u32;
     let frac_q = ((frac.rem_euclid(1.0) * 4.0).round() as u8) % 4;
     let key = (g.face, g.id, size_q, frac_q, g.synth_bold, g.synth_italic);
-    if let Some(v) = glyph_cache().lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
+    if let Some(v) = glyph_cache().lock().unwrap_or_else(PoisonError::into_inner).entries.get(&key) {
         return v.clone();
     }
     let px = size_q as f32 / 8.0;
     let fq = frac_q as f32 / 4.0;
     let gg = Glyph { x: 0.0, y: 0.0, size: px, ..*g };
     let path = glyph_path(&gg, &[1.0, 0.0, 0.0, 1.0, fq, 0.0]);
-    let v = path.bounds().map(|(x0, y0, x1, y1)| {
-        let left = x0.floor() as i32;
-        let top = y0.floor() as i32;
-        let w = (x1.ceil() as i32 - left).max(1) as usize;
-        let h = (y1.ceil() as i32 - top).max(1) as usize;
-        Arc::new(GlyphMask { mask: fill(&path, w, h, -left as f32, -top as f32), left, top })
-    });
-    let mut m = glyph_cache().lock().unwrap_or_else(|e| e.into_inner());
-    if m.len() > 16_384 {
-        m.clear();
+    let Some((left, top, w, h)) = glyph_mask_bounds(&path) else {
+        // Do not cache an oversized rejection: callers render it directly into their bounded
+        // output, and retaining attacker-selected keys would itself become a cache DoS.
+        return None;
+    };
+    let v = Some(Arc::new(GlyphMask { mask: fill(&path, w, h, -left as f32, -top as f32), left, top }));
+    let bytes = w * h * std::mem::size_of::<f32>();
+    let mut m = glyph_cache().lock().unwrap_or_else(PoisonError::into_inner);
+    if m.entries.len() > 16_384 || m.bytes.checked_add(bytes).is_none_or(|n| n > MAX_GLYPH_CACHE_BYTES) {
+        m.entries.clear();
+        m.bytes = 0;
     }
-    m.insert(key, v.clone());
+    if let Some(old) = m.entries.insert(key, v.clone()) {
+        m.bytes = m.bytes.saturating_sub(old.as_ref().map_or(0, |g| g.mask.a.len() * std::mem::size_of::<f32>()));
+    }
+    m.bytes = m.bytes.saturating_add(bytes);
     v
 }
 
@@ -223,6 +250,12 @@ pub fn draw_run(l: &Layout, m: &Xform, out: &mut Mask, origin: (i32, i32), run:
             let xi = x.floor();
             if let Some(gm) = glyph_mask(g, px, x - xi) {
                 out.add(&gm.mask, xi as i32 + gm.left - ox, y.round() as i32 + gm.top - oy);
+            } else {
+                // A huge glyph's mask would be mostly clipped away. Rasterise its outline straight
+                // into `out`, whose allocation is already bounded by the caller's canvas.
+                let gm = compose(m, &[1.0, 0.0, 0.0, 1.0, g.x, g.y]);
+                let p = glyph_path(g, &gm);
+                fill_into(&p, out, -ox as f32, -oy as f32);
             }
         }
         if !l.underlines.is_empty() {
@@ -280,6 +313,12 @@ mod tests {
         assert!(g.top < 0, "rises above the baseline");
     }
 
+    #[test]
+    fn oversized_glyph_mask_is_rejected_before_allocation() {
+        assert!(glyph_mask_bounds(&Path::rect(0.0, 0.0, 100_000.0, 100_000.0)).is_none());
+        assert!(glyph_mask_bounds(&Path::rect(0.0, 0.0, 32.0, 32.0)).is_some());
+    }
+
     #[test]
     fn cached_and_outline_paths_agree() {
         let l = layout("Title 42", &TextStyle { size: 48.0, ..Default::default() }, &ParagraphStyle::default());
diff --git a/crates/text/src/sfnt.rs b/crates/text/src/sfnt.rs
index c000f4423..fec6ed38d 100644
--- a/crates/text/src/sfnt.rs
+++ b/crates/text/src/sfnt.rs
@@ -108,22 +108,43 @@ fn name_string(b: &[u8], id: u16) -> Option<String> {
         if nid != id {
             continue;
         }
-        let raw = b.get(storage + off..storage + off + len)?;
-        let (rank, s) = match plat {
+        let rank = match plat {
             3 if enc == 1 || enc == 10 => {
+                if best.as_ref().is_some_and(|(current, _)| *current <= if lang == 0x409 { 0 } else { 1 }) {
+                    continue;
+                }
+                if lang == 0x409 { 0 } else { 1 }
+            }
+            0 => {
+                if best.as_ref().is_some_and(|(current, _)| *current <= 2) {
+                    continue;
+                }
+                2
+            }
+            1 if enc == 0 => {
+                if best.as_ref().is_some_and(|(current, _)| *current <= 3) {
+                    continue;
+                }
+                3
+            }
+            _ => continue,
+        };
+        // Only decode a record that can improve the selected name. A hostile name table may
+        // point thousands of records at the same huge string.
+        let raw = b.get(storage + off..storage + off + len)?;
+        let s = match plat {
+            3 => {
                 let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
-                (if lang == 0x409 { 0 } else { 1 }, String::from_utf16_lossy(&u))
+                String::from_utf16_lossy(&u)
             }
             0 => {
                 let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
-                (2, String::from_utf16_lossy(&u))
+                String::from_utf16_lossy(&u)
             }
-            1 if enc == 0 => (3, raw.iter().map(|&c| if c < 128 { c as char } else { '?' }).collect()),
-            _ => continue,
+            1 => raw.iter().map(|&c| if c < 128 { c as char } else { '?' }).collect(),
+            _ => return None,
         };
-        if best.as_ref().is_none_or(|(r0, _)| rank < *r0) {
-            best = Some((rank, s));
-        }
+        best = Some((rank, s));
     }
     best.map(|(_, s)| s).filter(|s| !s.trim().is_empty())
 }
@@ -185,4 +206,27 @@ mod tests {
         assert_eq!(faces.len(), 1);
         assert_eq!((faces[0].index, faces[0].family.as_str(), faces[0].style.as_str()), (1, "Inter", "Regular"));
     }
+
+    #[test]
+    fn later_non_improving_name_records_are_not_decoded() {
+        // The first record is the preferred Windows-English value. The second names an invalid
+        // range: it must be ignored instead of making the whole name lookup fail.
+        let mut table = vec![0; 30];
+        table[2..4].copy_from_slice(&2u16.to_be_bytes());
+        table[4..6].copy_from_slice(&30u16.to_be_bytes());
+        let first = 6usize;
+        table[first..first + 2].copy_from_slice(&3u16.to_be_bytes());
+        table[first + 2..first + 4].copy_from_slice(&1u16.to_be_bytes());
+        table[first + 4..first + 6].copy_from_slice(&0x409u16.to_be_bytes());
+        table[first + 6..first + 8].copy_from_slice(&1u16.to_be_bytes());
+        table[first + 8..first + 10].copy_from_slice(&4u16.to_be_bytes());
+        let second = first + 12;
+        table[second..second + 2].copy_from_slice(&3u16.to_be_bytes());
+        table[second + 2..second + 4].copy_from_slice(&1u16.to_be_bytes());
+        table[second + 4..second + 6].copy_from_slice(&0x409u16.to_be_bytes());
+        table[second + 6..second + 8].copy_from_slice(&1u16.to_be_bytes());
+        table[second + 8..second + 10].copy_from_slice(&u16::MAX.to_be_bytes());
+        table.extend_from_slice(&[0, b'A', 0, b'B']);
+        assert_eq!(name_string(&table, 1).as_deref(), Some("AB"));
+    }
 }
diff --git a/crates/time/src/lib.rs b/crates/time/src/lib.rs
index 23f328bf5..e9adb40f3 100644
--- a/crates/time/src/lib.rs
+++ b/crates/time/src/lib.rs
@@ -121,6 +121,7 @@ impl SubAssign for Tick {
 }
 
 /// A half-open time range `[start, start + duration)`.
+/// Zero or negative durations are empty and never overlap another range.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct TimeRange {
     pub start: Tick,
@@ -141,7 +142,7 @@ impl TimeRange {
         t >= self.start && t < self.end()
     }
     pub fn overlaps(&self, o: &TimeRange) -> bool {
-        self.start < o.end() && o.start < self.end()
+        !self.is_empty() && !o.is_empty() && self.start < o.end() && o.start < self.end()
     }
     pub fn intersect(&self, o: &TimeRange) -> Option<TimeRange> {
         let s = self.start.max(o.start);
@@ -416,11 +417,18 @@ pub fn format_time(t: Tick, rate: FrameRate, drop_frame: bool, display: TimeDisp
             format!("{}{}+{:02}", if neg { "-" } else { "" }, a / per_ft, a % per_ft)
         }
         TimeDisplay::AudioSamples => {
-            let secs = t.0.div_euclid(TICKS_PER_SECOND);
-            let rem = Tick(t.0.rem_euclid(TICKS_PER_SECOND)).to_units_floor(sample_rate);
-            format!("{:02}:{:02}:{:02}:{rem:05}", secs / 3600, (secs / 60) % 60, secs % 60)
+            let neg = t.0 < 0;
+            let a = t.0.unsigned_abs();
+            let tps = TICKS_PER_SECOND.unsigned_abs();
+            let secs = a / tps;
+            let rem = Tick((a % tps) as i64).to_units_floor(sample_rate);
+            format!("{}{:02}:{:02}:{:02}:{rem:05}", if neg { "-" } else { "" }, secs / 3600, (secs / 60) % 60, secs % 60)
+        }
+        TimeDisplay::Seconds => {
+            let s = format!("{:.3}", t.seconds());
+            // A tiny negative time rounds to zero but keeps its sign: drop it.
+            if s == "-0.000" { "0.000".to_string() } else { s }
         }
-        TimeDisplay::Seconds => format!("{:.3}", t.seconds()),
     }
 }
 
@@ -473,7 +481,15 @@ pub fn parse_timecode(input: &str, rate: FrameRate, drop_frame: bool, current: i
     } else {
         parts
             .iter()
-            .map(|p| if p.is_empty() { Ok(0) } else { p.parse::<i64>().map_err(|_| ParseError(format!("bad field `{p}`"))) })
+            .map(|p| {
+                if p.is_empty() {
+                    Ok(0)
+                } else if !p.bytes().all(|b| b.is_ascii_digit()) {
+                    Err(ParseError(format!("bad field `{p}`")))
+                } else {
+                    p.parse::<i64>().map_err(|_| ParseError(format!("bad field `{p}`")))
+                }
+            })
             .collect::<Result<_, _>>()?
     };
     if nums.len() > 4 {
@@ -507,6 +523,46 @@ mod tests {
     use super::*;
     use proptest::prelude::*;
 
+    #[test]
+    fn empty_time_ranges_never_overlap() {
+        let clip = TimeRange::new(Tick(0), Tick(10));
+        for duration in [0, -1, -5] {
+            let empty = TimeRange::new(Tick(5), Tick(duration));
+            assert!(empty.is_empty());
+            assert_eq!(empty.intersect(&clip), None);
+            assert!(!empty.overlaps(&clip), "duration {duration}");
+            assert!(!clip.overlaps(&empty), "duration {duration}");
+        }
+    }
+
+    #[test]
+    fn time_range_overlap_respects_half_open_boundaries() {
+        let clip = TimeRange::new(Tick(0), Tick(10));
+        for (start, duration, expected) in [(-5, 5, false), (10, 5, false), (-5, 6, true), (9, 5, true), (2, 3, true)] {
+            let other = TimeRange::new(Tick(start), Tick(duration));
+            assert_eq!(clip.overlaps(&other), expected);
+            assert_eq!(other.overlaps(&clip), expected);
+        }
+    }
+
+    #[test]
+    fn seconds_display_has_no_negative_zero() {
+        let f = |t: i64| format_time(Tick(t), FrameRate::default(), false, TimeDisplay::Seconds, 48000);
+        assert_eq!(f(-1), "0.000");
+        assert_eq!(f(-2), "0.000");
+        assert_eq!(f(-(TICKS_PER_SECOND / 2500)), "0.000");
+        assert_eq!(f(-TICKS_PER_SECOND), "-1.000");
+        assert_eq!(f(-TICKS_PER_SECOND / 1000), "-0.001");
+    }
+
+    #[test]
+    fn audio_samples_negative_time_has_leading_minus() {
+        let r = FrameRate::new(30000, 1001);
+        let f = |t| format_time(Tick(t), r, false, TimeDisplay::AudioSamples, 48000);
+        assert_eq!(f(-TICKS_PER_SECOND), "-00:00:01:00000");
+        assert_eq!(f(-(TICKS_PER_SECOND + TICKS_PER_SECOND / 2)), "-00:00:01:24000");
+    }
+
     /// Damaged files and projects can carry zero / negative rates and timebases, and users or
     /// agents can type huge timecodes: these used to panic (division by zero, overflow,
     /// crossed `clamp` bounds).
@@ -695,6 +751,14 @@ mod tests {
         assert!(parse_timecode("abc", r, false, 0).is_err());
     }
 
+    #[test]
+    fn signed_field_rejected() {
+        let r = FrameRate::FPS_25;
+        assert!(parse_timecode("00:00:-5:00", r, false, 0).is_err());
+        assert!(parse_timecode("00:+1:00:00", r, false, 0).is_err());
+        assert_eq!(parse_timecode("00:00:10:00", r, false, 0).unwrap(), 250);
+    }
+
     #[test]
     fn display_modes() {
         let r = FrameRate::FPS_24;
diff --git a/crates/tts-text/src/normalize.rs b/crates/tts-text/src/normalize.rs
index 1378b7269..6eac45a83 100644
--- a/crates/tts-text/src/normalize.rs
+++ b/crates/tts-text/src/normalize.rs
@@ -44,6 +44,8 @@ const MAX_INPUT: usize = 1_048_576;
 const MAX_PAUSE_MS: u32 = 10_000;
 /// Numbers with more than this many digits are read digit by digit (never overflow).
 const MAX_CARDINAL_DIGITS: usize = 12;
+/// A malformed pause marker is only inspected within this bounded prefix.
+const MAX_PAUSE_MARKER_BYTES: usize = 64;
 
 /// Normalize `text` into spoken-word tokens for `lang`.
 ///
@@ -95,6 +97,24 @@ pub fn normalize(text: &str, lang: Lang) -> Result<Vec<Token>, NormalizeError> {
                     out.push(Token::Punct(c));
                 }
             }
+            '-' if matches!(peek(rest, 1), Some('$' | '€' | '£'))
+                && !text
+                    .get(..pos)
+                    .and_then(|before| before.chars().next_back())
+                    .is_some_and(|b| b.is_alphanumeric() || matches!(b, '$' | '€' | '£' | '-')) =>
+            {
+                // A negative amount ("-$5"): keep the sign so a loss is not read as a gain.
+                // A hyphen right after a word or amount ("$10-$20") is a range, not a sign.
+                pos += 1;
+                match parse_money(rest.get(1..).unwrap_or(""), lang) {
+                    Some((words, used)) => {
+                        pos += used;
+                        out.push(Token::Word("minus".into()));
+                        push_words(&mut out, &words);
+                    }
+                    None => out.push(Token::Punct(c)),
+                }
+            }
             _ if c.is_ascii_digit() => match parse_number_cluster(rest, lang) {
                 Some((tokens, used)) => {
                     pos += used;
@@ -139,7 +159,9 @@ pub fn normalize(text: &str, lang: Lang) -> Result<Vec<Token>, NormalizeError> {
                     out.push(terminator);
                 }
             }
-            _ if is_word_char(c) => match parse_wordish(rest, lang) {
+            // Apostrophes can occur inside a word, but an apostrophe-only run must not repeatedly
+            // scan the whole remaining script looking for a word.
+            _ if c.is_alphabetic() => match parse_wordish(rest, lang) {
                 Some((tokens, used)) => {
                     pos += used;
                     out.extend(tokens);
@@ -184,7 +206,8 @@ fn peek(s: &str, i: usize) -> Option<char> {
 /// `[pause 1s]`, `[pause 500ms]`, `[pause 1.5s]` → a capped pause. Malformed markers
 /// return `None` and fall through to plain text (never an error).
 fn parse_pause(rest: &str) -> Option<(u32, usize)> {
-    let close = rest.find(']')?;
+    // search bytes: the 64-byte cut may fall inside a multi-byte character that follows the marker
+    let close = rest.as_bytes().iter().take(MAX_PAUSE_MARKER_BYTES).position(|&b| b == b']')?;
     let inner = rest.get(1..close)?.trim();
     let value = inner.strip_prefix("pause")?;
     let value = value.trim_start();
@@ -269,7 +292,7 @@ fn parse_money(rest: &str, lang: Lang) -> Option<(Vec<String>, usize)> {
     let (value, digits, used, minor, had_minor) = parse_amount(rest.get(skip..)?, lang)?;
     if digits > MAX_CARDINAL_DIGITS || has_leading_zero(&value, digits) {
         // Oversized amounts: every digit, unit-free, no overflow.
-        let all = rest.get(skip..skip + used)?.chars().filter(|c| c.is_ascii_digit()).collect::<String>();
+        let all = rest.get(skip..skip + used)?.chars().filter(char::is_ascii_digit).collect::<String>();
         let (words, _) = digit_run_as_words(&all);
         return Some((words, used + skip));
     }
@@ -362,7 +385,7 @@ fn parse_amount(rest: &str, _lang: Lang) -> Option<(u64, usize, usize, u32, bool
 /// A grouping mark is valid only when exactly three digits follow it.
 fn grouping_followed_by_3(rest: &str, sep_index: usize) -> bool {
     let after = rest.get(sep_index + 1..).unwrap_or("");
-    let digits: String = after.chars().take_while(|c| c.is_ascii_digit()).collect();
+    let digits: String = after.chars().take_while(char::is_ascii_digit).collect();
     let boundary = after.get(digits.len()..).and_then(|r| r.chars().next()).is_none_or(|c| !c.is_ascii_digit());
     digits.len() == 3 && boundary
 }
@@ -413,6 +436,8 @@ fn parse_time(rest: &str) -> Option<(Vec<Token>, usize)> {
     for (lit, letter_pair) in [("am", ['a', 'm']), ("pm", ['p', 'm'])] {
         if after.get(..2).is_some_and(|s| s.eq_ignore_ascii_case(lit)) {
             for letter in letter_pair {
+                // Uppercase "A" so it is read as a letter name, not the article.
+                let letter = if letter == 'a' { 'A' } else { letter };
                 tokens.push(Token::Word(letter.into()));
             }
             used += 2;
@@ -433,7 +458,7 @@ fn digit_run(s: &str, start: usize, max: usize) -> Option<usize> {
 fn time_words(h: u32, m: u32) -> Vec<Token> {
     let mut out = vec![Token::Word(english_cardinal(u64::from(h)).join(" "))];
     if m == 0 {
-        out.push(Token::Word("zero".into()));
+        // On the hour: the hour alone ("nine p m"), no minutes spoken.
     } else if m < 10 {
         out.push(Token::Word("oh".into()));
         out.push(Token::Word(english_digit_word(digit_char(m)).into()));
@@ -634,7 +659,7 @@ fn parse_continuation(rest: &str, used: usize, value: u64, digits: &str) -> Opti
     match peek(after, 0) {
         Some('s' | 'S' | 't' | 'T' | 'n' | 'N' | 'd' | 'D' | 'r' | 'R') => {
             let suffix = after.get(..2)?;
-            if is_ordinal_suffix(suffix) && !peek(after, 2).is_some_and(|c| c.is_alphabetic()) {
+            if is_ordinal_suffix(suffix) && !peek(after, 2).is_some_and(char::is_alphabetic) {
                 return Some((vec![Token::Word(english_ordinal(value))], used + 2));
             }
             None
@@ -755,7 +780,7 @@ fn is_ordinal_suffix(suffix: &str) -> bool {
 /// own parser before this check, so a leftover `.`/`,`/`:`/`/` — or a sentence
 /// terminator or closing bracket — is fine.
 fn year_is_standalone(rest: &str, used: usize) -> bool {
-    !peek(rest, used).is_some_and(|c| c.is_alphanumeric())
+    !peek(rest, used).is_some_and(char::is_alphanumeric)
 }
 
 /// A digit run read digit by digit.
@@ -932,19 +957,20 @@ fn year_words(year: u64, _lang: Lang) -> Vec<Token> {
 
 /// Words, abbreviations, months, acronyms, a.m./p.m. and e.g./i.e.
 fn parse_wordish(rest: &str, _lang: Lang) -> Option<(Vec<Token>, usize)> {
-    let collected: String = rest.chars().take_while(|c| is_word_char(*c)).collect();
+    let end = rest.char_indices().find_map(|(i, c)| (!is_word_char(c)).then_some(i)).unwrap_or(rest.len());
+    let collected = rest.get(..end)?;
     let word = collected.trim_matches(|c| c == '\'' || c == '’');
     if word.is_empty() {
         return None;
     }
-    let used = word.len() + leading_apostrophes(rest);
+    let used = word.len();
     let lower = word.to_ascii_lowercase();
 
     // a.m. / p.m. — a single letter, a dot, "m", and a dot or boundary.
     if word.len() == 1 && matches!(lower.as_str(), "a" | "p") && peek(rest, used) == Some('.') && matches!(peek(rest, used + 1), Some('m') | Some('M')) {
         let after_m = used + 2;
         if peek(rest, after_m).is_none_or(|c| !c.is_alphanumeric()) {
-            let mut tokens = vec![Token::Word(word.to_ascii_lowercase())];
+            let mut tokens = vec![Token::Word(if lower == "a" { "A".into() } else { lower.clone() })];
             tokens.push(Token::Word("m".into()));
             let consumed = if peek(rest, after_m) == Some('.') { after_m + 1 } else { after_m };
             return Some((tokens, consumed));
@@ -979,10 +1005,6 @@ fn parse_wordish(rest: &str, _lang: Lang) -> Option<(Vec<Token>, usize)> {
     Some((vec![Token::Word(word.into())], used))
 }
 
-fn leading_apostrophes(rest: &str) -> usize {
-    rest.chars().take_while(|c| *c == '\'' || *c == '’').map(char::len_utf8).sum()
-}
-
 /// Expansions for `Mr.` etc.; the dot is consumed so it never ends a sentence.
 /// `St.` picks "saint" before a capitalised name and "street" otherwise.
 fn dotted_abbreviation(lower: &str, rest: &str, used: usize) -> Option<(Vec<Token>, usize)> {
@@ -996,10 +1018,10 @@ fn dotted_abbreviation(lower: &str, rest: &str, used: usize) -> Option<(Vec<Toke
         "mt" => vec![Token::Word("mount".into())],
         "st" => {
             let mut i = used + 1;
-            while peek(rest, i).is_some_and(|c| c.is_whitespace()) {
+            while peek(rest, i).is_some_and(char::is_whitespace) {
                 i += 1;
             }
-            let capitalised = peek(rest, i).is_some_and(|c| c.is_uppercase());
+            let capitalised = peek(rest, i).is_some_and(char::is_uppercase);
             vec![Token::Word(if capitalised { "saint".into() } else { "street".into() })]
         }
         "vs" => vec![Token::Word("versus".into())],
@@ -1032,7 +1054,7 @@ fn dotted_abbreviation(lower: &str, rest: &str, used: usize) -> Option<(Vec<Toke
 fn is_spellable_acronym(word: &str) -> bool {
     const KEEP_AS_WORDS: [&str; 8] = ["NASA", "UNESCO", "NATO", "UNICEF", "OPEC", "FIFA", "RADAR", "SONAR"];
     let letters: Vec<char> = word.chars().collect();
-    if letters.len() < 2 || letters.len() > 5 || !letters.iter().all(|c| c.is_ascii_uppercase()) {
+    if letters.len() < 2 || letters.len() > 5 || !letters.iter().all(char::is_ascii_uppercase) {
         return false;
     }
     if KEEP_AS_WORDS.contains(&word) {
@@ -1237,6 +1259,24 @@ mod tests {
         assert_eq!(words("$0.50", Lang::EnUs), "zero dollars and fifty cents");
     }
 
+    #[test]
+    fn negative_money_keeps_its_sign() {
+        for lang in [Lang::EnUs, Lang::EnGb] {
+            assert_eq!(words("-$5", lang), "minus five dollars");
+            assert_eq!(words("-€3.50", lang), "minus three euros and fifty cents");
+            assert_eq!(words("-£2", lang), "minus two pounds");
+            assert_eq!(words("a refund of -$1.05", lang), "a refund of minus one dollar and five cents");
+            assert_eq!(words("(-$5)", lang), "( minus five dollars )");
+            // A hyphen between two amounts is a range, not a sign.
+            assert_eq!(words("$10-$20", lang), "ten dollars - twenty dollars");
+            assert_eq!(words("€5-€8", lang), "five euros - eight euros");
+            assert_eq!(words("$10.50-$20", lang), "ten dollars and fifty cents - twenty dollars");
+            // A hyphen after a word or before a non-amount stays punctuation.
+            assert_eq!(words("a-$5", lang), "a - five dollars");
+            assert!(!words("-$x", lang).contains("minus"));
+        }
+    }
+
     #[test]
     fn money_fraction_beyond_two_digits_is_not_hundreds_of_cents() {
         for lang in [Lang::EnUs, Lang::EnGb] {
@@ -1327,7 +1367,9 @@ mod tests {
         assert_eq!(words("23:59", Lang::EnUs), "twenty-three fifty-nine");
         assert_eq!(words("3:30pm", Lang::EnUs), "three thirty p m");
         assert_eq!(words("3:30 p.m.", Lang::EnUs), "three thirty p m");
-        assert_eq!(words("9:00 a.m.", Lang::EnUs), "nine zero a m");
+        assert_eq!(words("9:00 a.m.", Lang::EnUs), "nine A m");
+        assert_eq!(words("9:00 PM", Lang::EnUs), "nine p m");
+        assert_eq!(words("12:00", Lang::EnUs), "twelve");
     }
 
     #[test]
@@ -1455,6 +1497,9 @@ mod tests {
         assert_eq!(words("[pause 0.25s]", Lang::EnUs), "[pause 250]");
         assert_eq!(words("[pause 11s]", Lang::EnUs), "[pause 10000]");
         assert_eq!(words("[pause 999999999999s]", Lang::EnUs), "[pause 10000]");
+        // byte 64 falls inside an `é` after the marker: still a pause
+        let tokens = normalize(&format!("[pause 1s]x{}", "é".repeat(40)), Lang::EnUs).unwrap();
+        assert_eq!(tokens.first(), Some(&Token::Pause { millis: 1000 }));
         // Malformed markers stay plain text.
         assert_eq!(words("[pause", Lang::EnUs), "[ pause");
         assert_eq!(words("[pause x]", Lang::EnUs), "[ pause x ]");
@@ -1507,6 +1552,14 @@ mod tests {
         assert_eq!(words("1,2345", Lang::EnUs), "one , two thousand three hundred forty-five");
     }
 
+    #[test]
+    fn malformed_marker_and_apostrophe_runs_make_linear_progress() {
+        let brackets = "[".repeat(20_000);
+        let apostrophes = "'".repeat(20_000);
+        assert_eq!(normalize(&brackets, Lang::EnUs).unwrap().len(), 20_000);
+        assert_eq!(normalize(&apostrophes, Lang::EnUs).unwrap().len(), 20_000);
+    }
+
     #[test]
     fn hostile_inputs_do_not_panic() {
         let hostile: Vec<String> = vec![
diff --git a/crates/tts-text/src/phonemize.rs b/crates/tts-text/src/phonemize.rs
index 6d6c1f33d..e9b1692c7 100644
--- a/crates/tts-text/src/phonemize.rs
+++ b/crates/tts-text/src/phonemize.rs
@@ -27,6 +27,10 @@ pub const MAX_CHUNK_CHARS: usize = 400;
 const MAX_DICT_BYTES: usize = 16 * 1024 * 1024;
 /// Maximum number of dictionary entries.
 const MAX_DICT_ENTRIES: usize = 500_000;
+/// Most ARPAbet symbols retained for one dictionary pronunciation.
+const MAX_PRONUNCIATION_PHONES: usize = 256;
+/// Long unknown words are not useful narration and can make suffix fallback recurse repeatedly.
+const MAX_LETTER_TO_SOUND_CHARS: usize = 512;
 /// Maximum number of overrides honoured (excess ignored, not an error).
 const MAX_OVERRIDES: usize = 1_000;
 /// Maximum length of one override value (longer ones ignored).
@@ -98,7 +102,7 @@ impl Lexicon {
                 skipped += 1;
                 continue;
             };
-            let phones: Vec<&str> = parts.collect();
+            let phones: Vec<&str> = parts.by_ref().take(MAX_PRONUNCIATION_PHONES + 1).collect();
             if phones.is_empty() {
                 if had_comment {
                     continue;
@@ -106,6 +110,10 @@ impl Lexicon {
                 skipped += 1;
                 continue;
             }
+            if phones.len() > MAX_PRONUNCIATION_PHONES {
+                skipped += 1;
+                continue;
+            }
             // `WORD(2)` alternates fold into the same key.
             let key = match (head.find('('), head.rfind(')')) {
                 (Some(open), Some(close)) if close > open + 1 && head.get(open + 1..close).is_some_and(|d| d.chars().all(|c| c.is_ascii_digit())) => {
@@ -298,19 +306,34 @@ fn flush_sentence(sentence: &mut Vec<Token>, chunks: &mut Vec<Chunk>, lex: &Lexi
 /// Split a phoneme string longer than [`MAX_CHUNK_CHARS`] at the last `,` `;` `:`
 /// before the limit, else at the last space, else hard-split at the limit.
 fn split_long_chunk(s: String) -> Vec<String> {
-    if s.chars().count() <= MAX_CHUNK_CHARS {
-        return vec![s];
+    let mut out = Vec::new();
+    let mut start = 0usize;
+    while start < s.len() {
+        let rest = &s[start..];
+        let Some((limit, _)) = rest.char_indices().nth(MAX_CHUNK_CHARS) else {
+            let piece = rest.trim().to_string();
+            if !piece.is_empty() {
+                out.push(piece);
+            }
+            break;
+        };
+        let head = &rest[..limit];
+        let cut = head
+            .char_indices()
+            .rev()
+            .find(|&(_, c)| matches!(c, ',' | ';' | ':'))
+            .map(|(i, _)| i + 1)
+            .or_else(|| head.rfind(' ').map(|i| i + 1))
+            .unwrap_or(limit);
+        let piece = head[..cut].trim_end();
+        if !piece.is_empty() {
+            out.push(piece.to_string());
+        }
+        start += cut;
+        while s.get(start..).and_then(|rest| rest.chars().next()).is_some_and(char::is_whitespace) {
+            start += s[start..].chars().next().map(char::len_utf8).unwrap_or(0);
+        }
     }
-    let limit = s.char_indices().map(|(i, _)| i).nth(MAX_CHUNK_CHARS).unwrap_or(s.len());
-    let head_boundary = s.get(..limit).and_then(|head| {
-        head.char_indices().rev().find(|&(_, c)| matches!(c, ',' | ';' | ':')).map(|(i, _)| i + 1).or_else(|| head.rfind(' ').map(|i| i + 1)).or(Some(limit))
-    });
-    let Some(cut) = head_boundary else { return vec![s] };
-    let head = s.get(..cut).unwrap_or("").trim_end().to_string();
-    let tail = s.get(cut..).unwrap_or("").trim_start().to_string();
-    let mut out = vec![head];
-    out.extend(split_long_chunk(tail));
-    out.retain(|p| !p.is_empty());
     out
 }
 
@@ -604,7 +627,7 @@ fn morphology(word: &str, lex: &Lexicon) -> Option<String> {
         }
     }
     // -ing (stem may need its silent e back: making → make).
-    let ing_stems: [Option<String>; 2] = [strip_suffix(word, "ing").map(|s| s.to_string()), strip_suffix(word, "ing").map(|s| format!("{s}e"))];
+    let ing_stems: [Option<String>; 2] = [strip_suffix(word, "ing").map(ToString::to_string), strip_suffix(word, "ing").map(|s| format!("{s}e"))];
     for stem in ing_stems.into_iter().flatten() {
         let stem = stem.as_str();
         if let Some(pron) = lex.pronunciations(&stem.to_uppercase())
@@ -697,8 +720,8 @@ fn past_ed(last: &Phone) -> &'static str {
 /// doubled consonants, soft c/g, `y` as vowel; primary stress on the first
 /// syllable (on the vowel before -tion/-sion). Always pronounceable.
 fn letter_to_sound(word: &str) -> Option<String> {
-    let letters: Vec<char> = word.chars().filter(|c| c.is_ascii_alphabetic()).collect();
-    if letters.is_empty() {
+    let letters: Vec<char> = word.chars().filter(char::is_ascii_alphabetic).collect();
+    if letters.is_empty() || letters.len() > MAX_LETTER_TO_SOUND_CHARS {
         return None;
     }
     // -ture / -sure endings (nature, measure): the e belongs to the suffix, so it
@@ -741,10 +764,9 @@ fn letter_to_sound(word: &str) -> Option<String> {
     let mut i = 0usize;
     while i < n {
         let Some(rest) = chars.get(i..) else { break };
-        let rest_str: String = rest.iter().collect();
         let at_start = i == 0;
         // Multi-letter rules first (longest match wins).
-        if rest_str.ends_with("tion") && rest_str.len() == 4 {
+        if rest.len() == 4 && rest.iter().copied().eq("tion".chars()) {
             // The vowel before the suffix takes the primary stress.
             if let Some(&last) = vowel_positions.last()
                 && let Some(v) = out.get_mut(last)
@@ -756,7 +778,7 @@ fn letter_to_sound(word: &str) -> Option<String> {
             out.push("n".into());
             break;
         }
-        if rest_str.ends_with("sion") && rest_str.len() == 4 {
+        if rest.len() == 4 && rest.iter().copied().eq("sion".chars()) {
             if let Some(&last) = vowel_positions.last()
                 && let Some(v) = out.get_mut(last)
             {
@@ -767,35 +789,35 @@ fn letter_to_sound(word: &str) -> Option<String> {
             out.push("n".into());
             break;
         }
-        if rest_str.starts_with("sch") {
+        if rest.starts_with(&['s', 'c', 'h']) {
             out.push("s".into());
             out.push("k".into());
             i += 3;
             continue;
         }
-        if rest_str == "sten" {
+        if rest == ['s', 't', 'e', 'n'] {
             // listen
             out.push("s".into());
             out.push("ə".into());
             out.push("n".into());
             break;
         }
-        if rest_str == "gue" {
+        if rest == ['g', 'u', 'e'] {
             out.push("ɡ".into());
             break;
         }
-        if rest_str == "que" {
+        if rest == ['q', 'u', 'e'] {
             out.push("k".into());
             break;
         }
-        if rest_str.starts_with("ough") {
+        if rest.starts_with(&['o', 'u', 'g', 'h']) {
             // A famously irregular group; pick the "thought" vowel, f when final.
             out.push("ɔ".into());
-            if rest_str == "ough" {
+            if rest == ['o', 'u', 'g', 'h'] {
                 out.push("f".into());
                 break;
             }
-            if rest_str.starts_with("ought") {
+            if rest.starts_with(&['o', 'u', 'g', 'h', 't']) {
                 out.push("t".into());
                 i += 5;
                 continue;
@@ -803,13 +825,13 @@ fn letter_to_sound(word: &str) -> Option<String> {
             i += 3;
             continue;
         }
-        if rest_str.starts_with("gu") && rest_str.len() > 2 {
+        if rest.starts_with(&['g', 'u']) && rest.len() > 2 {
             // The u is silent before a vowel (guard, guess).
             out.push("ɡ".into());
             i += 2;
             continue;
         }
-        if rest_str.starts_with("ps") && at_start {
+        if rest.starts_with(&['p', 's']) && at_start {
             out.push("s".into());
             i += 2;
             continue;
@@ -1170,6 +1192,18 @@ PERCENT  P ER0 S EH1 N T
         assert_eq!(lex.pronunciations("TRAIL").map(|v| v.first().map(String::as_str)), Some(Some("AE1 T")));
     }
 
+    #[test]
+    fn skips_an_unreasonably_long_dictionary_pronunciation() {
+        let mut input = String::from("GOOD  AE1\nTOO_LONG");
+        for _ in 0..=MAX_PRONUNCIATION_PHONES {
+            input.push_str(" AE1");
+        }
+        input.push('\n');
+        let lex = Lexicon::parse_cmudict(input.as_bytes()).unwrap();
+        assert_eq!(lex.len(), 1);
+        assert_eq!(lex.skipped(), 1);
+    }
+
     #[test]
     fn refuses_oversized_dictionaries() {
         let oversized = vec![b'a'; MAX_DICT_BYTES + 1];
@@ -1335,6 +1369,29 @@ PERCENT  P ER0 S EH1 N T
         }
     }
 
+    #[test]
+    fn chunk_splitting_is_iterative_for_many_chunks() {
+        let input = "a".repeat(MAX_CHUNK_CHARS * 2_000);
+        let chunks = split_long_chunk(input);
+        assert_eq!(chunks.len(), 2_000);
+        assert!(chunks.iter().all(|chunk| chunk.len() == MAX_CHUNK_CHARS));
+    }
+
+    #[test]
+    fn letter_to_sound_refuses_an_absurdly_long_unknown_word() {
+        assert!(letter_to_sound(&"ture".repeat(MAX_LETTER_TO_SOUND_CHARS)).is_none());
+    }
+
+    #[test]
+    fn am_reads_the_letter_name_not_the_article() {
+        for text in ["At 9:00 a.m.", "At 9:00am"] {
+            let chunks = phonemize(text, Lang::EnUs, &test_lex(), &Overrides::default()).unwrap();
+            let joined = format!("{chunks:?}");
+            assert!(joined.contains("ˈA"), "{text}: {joined}");
+            assert!(!joined.contains('ə'), "{text}: {joined}");
+        }
+    }
+
     #[test]
     fn every_output_char_is_in_symbols() {
         let inputs = [
diff --git a/crates/tts/Cargo.toml b/crates/tts/Cargo.toml
index 5100d70db..fffdb622d 100644
--- a/crates/tts/Cargo.toml
+++ b/crates/tts/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [features]
 default = []
 # Kokoro-82M neural voices on the CPU via candle (pure Rust). Off by default and in wasm builds.
-kokoro = ["dep:candle-core", "dep:candle-nn", "dep:zip", "dep:serde_json", "dep:filmcraft-tts-text", "dep:filmcraft-audio-dsp"]
+kokoro = ["dep:candle-core", "dep:candle-nn", "dep:zip", "dep:serde_json", "dep:sha2", "dep:filmcraft-tts-text", "dep:filmcraft-audio-dsp"]
 
 [dependencies]
 filmcraft-tts-text = { workspace = true, optional = true }
@@ -23,6 +23,7 @@ candle-core = { version = "0.9", default-features = false, optional = true }
 candle-nn = { version = "0.9", default-features = false, optional = true }
 zip = { version = "7", default-features = false, optional = true }
 serde_json = { workspace = true, optional = true }
+sha2 = { version = "0.10", optional = true }
 
 [[example]]
 name = "kokoro_say"
diff --git a/crates/tts/src/kokoro/model.rs b/crates/tts/src/kokoro/model.rs
index 777c8f771..bb53de88a 100644
--- a/crates/tts/src/kokoro/model.rs
+++ b/crates/tts/src/kokoro/model.rs
@@ -17,7 +17,7 @@
 
 use candle_core::{D, Device, Tensor};
 
-use super::layers::*;
+use super::layers::{AdaLayerNorm, AdaResBlock, BiLstm, Conv, ConvT, LayerNorm, Linear, R, SnakeResBlock, leaky};
 use super::weights::{Weights, err};
 
 const HEADS: usize = 12;
diff --git a/crates/tts/src/kokoro/weights.rs b/crates/tts/src/kokoro/weights.rs
index b65e8de49..12c759c6a 100644
--- a/crates/tts/src/kokoro/weights.rs
+++ b/crates/tts/src/kokoro/weights.rs
@@ -12,6 +12,7 @@ use std::io::Read;
 use std::path::Path;
 
 use candle_core::{DType, Device, Tensor};
+use sha2::{Digest, Sha256};
 
 use crate::TtsError;
 
@@ -83,6 +84,7 @@ const PARTS: [&str; 5] = ["bert", "bert_encoder", "predictor", "text_encoder", "
 
 impl Weights {
     pub(crate) fn load(path: &Path) -> Result<Weights, TtsError> {
+        verify_checkpoint(path)?;
         let mut raw: HashMap<String, Tensor> = HashMap::new();
         for part in PARTS {
             let tensors = candle_core::pickle::read_all_with_key(path, Some(part)).map_err(|e| err(format!("{}: {e}", path.display())))?;
@@ -126,6 +128,34 @@ impl Weights {
     }
 }
 
+/// Candle's pickle reader is used only for the fixed, catalogued checkpoint.
+/// Verify its immutable size and digest before any pickle object is expanded.
+fn verify_checkpoint(path: &Path) -> Result<(), TtsError> {
+    let file = crate::catalog::FILES
+        .iter()
+        .find(|file| file.name == "kokoro-v1_0.pth")
+        .ok_or_else(|| err("Kokoro checkpoint is missing from the package catalogue"))?;
+    let metadata = std::fs::metadata(path).map_err(|e| err(format!("{}: {e}", path.display())))?;
+    if metadata.len() != file.size {
+        return Err(err(format!("{}: checkpoint size does not match the official package", path.display())));
+    }
+    let mut reader = std::fs::File::open(path).map_err(|e| err(format!("{}: {e}", path.display())))?;
+    let mut hasher = Sha256::new();
+    let mut buf = [0u8; 64 * 1024];
+    loop {
+        let n = reader.read(&mut buf).map_err(|e| err(format!("{}: {e}", path.display())))?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+    }
+    let actual = format!("{:x}", hasher.finalize());
+    if actual != file.sha256 {
+        return Err(err(format!("{}: checkpoint digest does not match the official package", path.display())));
+    }
+    Ok(())
+}
+
 /// Number of style vectors in a voice pack (one per input length 1..=510).
 pub(crate) const PACK_LEN: usize = 510;
 pub(crate) const STYLE: usize = 256;
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index b63880d4e..3fefeb8b5 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -27,7 +27,7 @@ filmcraft-export = { workspace = true }
 filmcraft-gpu = { workspace = true }
 filmcraft-scopes = { workspace = true }
 egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
@@ -46,15 +46,22 @@ rustix = { version = "1", default-features = false, features = ["std", "time"] }
 cpu-time = "1"
 
 [dev-dependencies]
-pollster = "0.4"
+pollster = "1"
 filmcraft-codecs = { workspace = true }
 # the bench registers OS hardware decoders as the desktop app does (dev-dependency only: ui-egui
 # itself stays OS-independent and web-portable)
 filmcraft-platform = { workspace = true }
 filmcraft-interchange = { workspace = true }
+# A dependency's dev-dependencies do not propagate through egui_kittest: name the fonts this
+# test root needs explicitly so glyph and accessibility assertions run against the bundled faces.
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 egui_kittest = { workspace = true, features = ["eframe", "wgpu"] }
+tempfile = "3"
 
 # build.rs bakes contributors/contributors.json into the binary (About ▸ Contributors).
 [build-dependencies]
 serde_json = { workspace = true }
 toml = "1"
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-update = { workspace = true }
diff --git a/crates/ui-egui/README.md b/crates/ui-egui/README.md
index 49b4e70f4..cb6c7d770 100644
--- a/crates/ui-egui/README.md
+++ b/crates/ui-egui/README.md
@@ -3,6 +3,16 @@
 The egui frontend draws panels and dialogs, and dispatches project changes through the engine.
 Interactive controls keep stable automation ids regardless of the interface language.
 
+## Control input limits
+
+The control channel bounds `ui.click` to 10 clicks and `ui.drag` to 1024 movement steps (#2784).
+The MCP bridge sends null for omitted counts/steps, so the validator treats null like an absent
+field: one click or 12 drag steps. Negative, fractional, non-numeric and over-limit values still
+return errors before queuing any input. Zero clicks emit no button events; 0–1 drag steps use 2.
+`control::input_bounds_tests` covers defaults, rejection, unchanged pending input and valid
+gestures; `keyboard_ui` verifies that rejected requests leave the UI usable. See the
+[control protocol](../../docs/control-protocol.md).
+
 ## Transition drop previews
 
 Dragging a video or audio transition over a compatible clip shows its actual time span, the
@@ -18,7 +28,8 @@ the committed span and undo. Set `FILMCRAFT_UI_SNAPSHOT_DIR` to render screensho
 ## Localisation
 
 Edit > Language offers English, Japanese, Spanish, Brazilian Portuguese, Ukrainian, Simplified
-Chinese, German, Russian, French, Indonesian, Korean, Italian and Swedish (which cover the whole interface). The language is stored in the engine's `general.interfaceLanguage` preference,
+Chinese, German, Russian, French, Indonesian, Korean, Italian and Swedish (all but Ukrainian and Russian cover
+the whole interface; those two cover the core menus). The language is stored in the engine's `general.interfaceLanguage` preference,
 restored on startup, and also available in Settings > General.
 Its default, System Language (`system`), follows the operating system: the first of the user's
 preferred languages that the interface has (the host supplies them through
@@ -32,15 +43,20 @@ fills translated templates, and `i18n::t` translates names from registries. Plac
 (including user filenames containing braces) are inserted literally. Catalog translations are
 original work using ordinary language, without proprietary localisation resources.
 
-Spanish, Japanese, Simplified Chinese, French and Brazilian Portuguese cover menus, panels, dialogs, settings and registry labels. Searches accept both the
+Spanish, Japanese, Simplified Chinese, French, Brazilian Portuguese and German cover menus, panels, dialogs, settings and registry labels. Searches accept both the
 translated label and its English source, including Unicode capitals. Project content, command ids
 and preference values retain their original values. Engine errors, CLI and MCP messages remain
-English. Ukrainian and Russian currently cover the core menus, German every menu; they fall back
-to English elsewhere.
+English. Ukrainian and Russian currently cover the core menus; they fall back to English elsewhere.
 
-Verification: `cargo test -p filmcraft-ui-egui` checks catalog syntax, duplicate keys, placeholders,
-literal/menu/registry coverage and UI behaviour; `cargo xtask ci` runs the workspace gates. Visual
-checks use the control channel to switch language and capture the resulting panels.
+A string a catalog lacks shows in English, so a missing translation never fails a test or a
+build. `cargo xtask i18n-report` prints each language's missing strings (menus, `tl!` literals and
+registry names) and its entries whose source the interface no longer has; `cargo xtask ci` prints
+the same report in its log.
+
+Verification: `cargo test -p filmcraft-ui-egui` checks catalog syntax, duplicate keys, placeholders
+and UI behaviour in other languages (switching, search, font coverage); `cargo xtask ci` runs the
+workspace gates. Visual checks use the control channel to switch language and capture the resulting
+panels.
 
 ## Source playback
 
@@ -62,15 +78,33 @@ keeps Source navigation, markers and marked-range playback separate from Program
 
 ## Pane layout controls
 
-Dock transactions and pointer targets use `craft-ui::docking`; bounded split geometry and
-keyboard-accessible resize handles use `craft-ui::layout`. FilmCraft adapts its existing saved
-dock tree and panel identities to the shared model. Panel tabs or their header grip can move
-between tab groups, split at an edge, reorder, or float when released with Cmd/Ctrl. Floating
-panels move by their empty header and resize from the bottom-right corner. Timeline sequence
-tabs retain their sequence-opening, closing and horizontal reorder behavior; the header grip
-moves the Timeline panel. Workspace saves retain floating groups alongside the legacy layout
-JSON, and workspaces without floating data still load. Automation IDs and workspace commands
-remain the integration boundary.
+The panels use `craft-ui::docking` with its split-tree settings: craft-ui draws the frames, tab
+strips, floating windows and drag previews and owns the gestures; `dock_ui.rs` draws the panel
+bodies, the ≡ panel menu and the Timeline's sequence tabs. Bounded split geometry and
+keyboard-accessible resize handles use `craft-ui::layout`. Panel tabs or their group's drag bar
+move between tab groups, split at a group's or the window's edge, reorder, or float when released
+with Cmd/Ctrl; a release over no target cancels. Tools and the Audio Meters keep their widths
+as the window resizes (fixed split sizes, which a divider drag keeps fixed); the other groups
+resize with the window. Every group resizes down to the same minimum and has no maximum.
+Timeline sequence tabs retain their sequence-opening, closing and horizontal reorder behavior.
+
+On desktop each floating panel opens in its own OS window. Tool panels are palettes: they stay
+above other windows and hide while another application is active. The video viewers (Program,
+Source, Reference Monitor, Lumetri Scopes) are normal windows, say on a second display: they
+stack with the main window and stay shown in the background. A floating window moves by its
+title bar, resizes from every edge and splits like the main window. While a modal dialog is open
+(Settings, Recovery, Revert, a file dialog), the native windows are dimmed and take no input.
+The main window's input rewrite (macOS Control+Click as a secondary click,
+`--control-input-only`) also runs in each native window, and files dropped on one are imported
+like files dropped on the main window; on the Timeline they land at the drop point. A drag from
+a panel (a clip from the Source Monitor or the Project panel, an effect, a template) drops on a
+panel in any of the app's windows. On Wayland
+floating windows stay inside the main window. Where egui embeds viewports (tests), floating
+windows stay inside the main window too.
+
+Named workspaces save the layout, floating windows included; workspaces saved in the earlier
+layout format still load. While every floating window is one tab group, a save also writes the
+earlier format, so earlier versions still open the workspace. Automation IDs and workspace commands remain the integration boundary.
 
 Tools and dock tabs expose their actual egui widget IDs, paint keyboard focus, and support
 Tab/Shift-Tab traversal and Space/Enter activation. Control-injected keys can reach focused
diff --git a/crates/ui-egui/examples/bench/sections.rs b/crates/ui-egui/examples/bench/sections.rs
index 27231b732..3f5192bef 100644
--- a/crates/ui-egui/examples/bench/sections.rs
+++ b/crates/ui-egui/examples/bench/sections.rs
@@ -454,8 +454,7 @@ pub fn export(o: &Opts) -> Vec<Value> {
         return Vec::new();
     };
     let secs = if o.quick { 3.0 } else { 8.0 };
-    let dir = std::env::temp_dir().join(format!("filmcraft-bench-export-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).expect("tmp dir");
+    let dir = tempfile::Builder::new().prefix("filmcraft-bench-export-").tempdir().expect("tmp dir");
     let mut rows = Vec::new();
     // Scenes: (id, format, label, extension, effects-heavy). `--only` matches the id exactly here,
     // so `--only h264` runs the plain scene and `--only h264_fx` only the layered one.
@@ -497,7 +496,7 @@ pub fn export(o: &Opts) -> Vec<Value> {
             })
             .expect("audio");
             frames = s.project.sequence(seq).map(|q| q.settings.frame_rate.frame_at(q.duration())).unwrap_or(0);
-            let out = dir.join(format!("out.{ext}"));
+            let out = dir.path().join(format!("out.{ext}"));
             filmcraft_export::reset_export_lock_wait();
             filmcraft_gpu::export_renderer::timing::reset();
             let (t0, c0) = (Instant::now(), cpu_now());
@@ -549,7 +548,6 @@ pub fn export(o: &Opts) -> Vec<Value> {
             "gpu_fallbacks": filmcraft_engine::export::gpu_render_stats().fallbacks.saturating_sub(gpu0.fallbacks),
         }));
     }
-    let _ = std::fs::remove_dir_all(&dir);
     rows
 }
 
@@ -567,9 +565,8 @@ pub fn project(o: &Opts) -> Vec<Value> {
     for k in 0..5 {
         clips += big_sequence(&mut s, item, &format!("Sequence {}", k + 1), 11 + k as u64).1;
     }
-    let dir = std::env::temp_dir().join(format!("filmcraft-bench-project-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).expect("tmp dir");
-    let file = dir.join("big.fcproj");
+    let dir = tempfile::Builder::new().prefix("filmcraft-bench-project-").tempdir().expect("tmp dir");
+    let file = dir.path().join("big.fcproj");
     let n = o.repeat.max(3);
     let (mut save, mut open) = (Vec::new(), Vec::new());
     for _ in 0..n {
@@ -583,7 +580,6 @@ pub fn project(o: &Opts) -> Vec<Value> {
         assert_eq!(s2.project.items.len(), s.project.items.len());
     }
     let mbytes = std::fs::metadata(&file).map(|m| m.len()).unwrap_or(0) as f64 / 1e6;
-    let _ = std::fs::remove_dir_all(&dir);
     eprintln!("project: save {:.0} ms, open {:.0} ms ({clips} clips, {mbytes:.1} MB)", median(&save), median(&open));
     let row = |what: &str, v: &[f64]| json!({"what": what, "clips": clips, "mbytes": mbytes, "p50_ms": median(v), "min_ms": v.iter().cloned().fold(f64::MAX, f64::min), "runs_ms": v, "load": load_avg()});
     vec![row("save (file.saveAs)", &save), row("open (file.open)", &open)]
diff --git a/crates/ui-egui/src/automation.rs b/crates/ui-egui/src/automation.rs
index 850fcb8dd..70adc7637 100644
--- a/crates/ui-egui/src/automation.rs
+++ b/crates/ui-egui/src/automation.rs
@@ -2,6 +2,8 @@
 //! frame, so agents can click/drag by id (`ui.click {id:"timeline.track.V1.lock"}`) and
 //! `ui.inspect` can report the full on-screen widget tree.
 
+use std::collections::HashMap;
+
 use egui::Rect;
 use serde::Serialize;
 
@@ -17,8 +19,14 @@ pub struct Element {
     pub enabled: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub focusable: Option<bool>,
+    /// The floating window (`n` in `panel.float.<n>`) when the element is drawn in that window's
+    /// own OS window; `rect` is then in that window's coordinates, not the main window's.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub window: Option<usize>,
     #[serde(skip)]
     pub(crate) response_id: Option<egui::Id>,
+    #[serde(skip)]
+    pub(crate) viewport: egui::ViewportId,
 }
 
 #[derive(Default)]
@@ -26,10 +34,19 @@ pub struct Registry {
     pub elements: Vec<Element>,
     /// Last frame's elements (for lookups from control handlers between frames).
     pub previous: Vec<Element>,
+    /// The viewport `add` registers into: a native floating window's while its panel draws.
+    pub(crate) viewport: egui::ViewportId,
+    /// The floating window index drawn in each native viewport.
+    pub(crate) windows: HashMap<egui::ViewportId, usize>,
 }
 
 impl Registry {
     pub fn add(&mut self, id: &str, rect: Rect, label: &str) {
+        self.add_in(self.viewport, id, rect, label);
+    }
+    /// Register an element drawn in `viewport`.
+    pub(crate) fn add_in(&mut self, viewport: egui::ViewportId, id: &str, rect: Rect, label: &str) {
+        let window = if viewport == egui::ViewportId::ROOT { None } else { self.windows.get(&viewport).copied() };
         self.elements.push(Element {
             id: id.to_string(),
             label: label.to_string(),
@@ -37,12 +54,17 @@ impl Registry {
             widget_id: None,
             enabled: None,
             focusable: None,
+            window,
             response_id: None,
+            viewport,
         });
     }
     /// Observe the widget without changing its accessibility role or input behavior.
     pub fn add_response(&mut self, id: &str, response: &egui::Response, label: &str) {
-        self.add(id, response.rect, label);
+        // The automation label is also the name a screen reader and kittest use. Keep an
+        // existing visible label/placeholder; this only fills a missing name.
+        crate::widgets::accessible_name(response.clone(), label);
+        self.add_in(response.ctx.viewport_id(), id, response.rect, label);
         if let Some(element) = self.elements.last_mut() {
             element.widget_id = Some(format!("{:016x}", response.id.value()));
             element.enabled = Some(response.enabled());
@@ -53,11 +75,78 @@ impl Registry {
     pub fn begin_frame(&mut self) {
         self.previous = std::mem::take(&mut self.elements);
     }
-    pub fn find(&self, id: &str) -> Option<&Element> {
-        self.previous.iter().chain(self.elements.iter()).find(|e| e.id == id)
+    /// The entries of the last accepted UI pass, or the pass before it while the current pass is
+    /// still being laid out (pass 0 clears `elements`; `drain_ui_requests` runs after the layout).
+    pub fn all(&self) -> &[Element] {
+        if self.elements.is_empty() { &self.previous } else { &self.elements }
     }
-    /// Elements whose id starts with a prefix.
+    /// A widget drawn in the current accepted pass. Unlike [`Self::find`] this never falls back to
+    /// the previous pass, for callers that need fresh geometry (e.g. a screenshot crop).
+    pub fn find_current(&self, id: &str) -> Option<&Element> {
+        self.elements.iter().find(|e| e.id == id)
+    }
+    /// Look up a widget, preferring the layout just drawn. The previous pass is only used before
+    /// this pass has registered anything (input handling runs before the panels draw).
+    pub fn find(&self, id: &str) -> Option<&Element> {
+        self.all().iter().find(|e| e.id == id)
+    }
+    /// Elements whose id starts with a prefix, from the current accepted pass when there is one.
     pub fn query(&self, prefix: &str) -> Vec<&Element> {
-        self.previous.iter().filter(|e| e.id.starts_with(prefix)).collect()
+        self.all().iter().filter(|e| e.id.starts_with(prefix)).collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use egui::{Rect, pos2, vec2};
+
+    use super::Registry;
+
+    /// Test helper: a 10×10 rect at `x` for pass-order fixtures.
+    fn rect(x: f32) -> Rect {
+        Rect::from_min_size(pos2(x, 0.0), vec2(10.0, 10.0))
+    }
+
+    /// Lookups and prefix queries must resolve the pass just drawn, not stale geometry.
+    #[test]
+    fn lookups_prefer_the_current_accepted_pass() {
+        let mut registry = Registry::default();
+        registry.add("panel.project", rect(1.0), "old");
+        registry.begin_frame();
+        registry.add("panel.project", rect(200.0), "new");
+        assert_eq!(registry.find("panel.project").map(|e| e.rect[0]), Some(200.0));
+        assert_eq!(registry.query("panel.").iter().map(|e| e.rect[0]).collect::<Vec<_>>(), vec![200.0]);
+        assert_eq!(registry.find_current("panel.project").map(|e| e.rect[0]), Some(200.0));
+    }
+
+    /// Once the current pass registers an element, a removed id must not resolve from the previous pass.
+    #[test]
+    fn removed_elements_do_not_resolve_from_a_populated_current_pass() {
+        let mut registry = Registry::default();
+        registry.add("dialog.closed", rect(1.0), "old control");
+        registry.begin_frame();
+        assert!(registry.find("dialog.closed").is_some(), "before drawing, the previous pass remains usable");
+        registry.add("panel.current", rect(200.0), "current control");
+        assert!(registry.find("dialog.closed").is_none(), "a closed control cannot target stale coordinates");
+        assert_eq!(registry.find("panel.current").map(|e| e.rect[0]), Some(200.0));
+        assert!(registry.query("dialog.").is_empty());
+    }
+
+    /// The previous pass is usable only before the current pass draws; a discarded pass leaves exactly one entry.
+    #[test]
+    fn the_previous_pass_is_only_a_fallback_before_this_pass_draws() {
+        let mut registry = Registry::default();
+        registry.add("panel.project", rect(1.0), "old");
+        registry.begin_frame();
+        assert_eq!(registry.find("panel.project").map(|e| e.rect[0]), Some(1.0));
+        assert_eq!(registry.query("panel.").len(), 1);
+        assert!(registry.find_current("panel.project").is_none());
+
+        // A discarded pass is cleared and redrawn, so exactly one entry per widget remains.
+        registry.add("panel.project", rect(2.0), "discarded");
+        registry.elements.clear();
+        registry.add("panel.project", rect(3.0), "accepted");
+        assert_eq!(registry.elements.len(), 1);
+        assert_eq!(registry.find("panel.project").map(|e| e.rect[0]), Some(3.0));
     }
 }
diff --git a/crates/ui-egui/src/brand.rs b/crates/ui-egui/src/brand.rs
index 4c41d080e..3bab46e2d 100644
--- a/crates/ui-egui/src/brand.rs
+++ b/crates/ui-egui/src/brand.rs
@@ -7,7 +7,7 @@ const LOGO_DARK_INK: &[u8] = include_bytes!("../../../docs/brand/artcraft-logo.p
 /// The wordmark for a dark (`dark = true`) or light UI: light ink on dark themes. Its aspect
 /// ratio is width / height of the returned texture.
 pub fn wordmark(ctx: &egui::Context, dark: bool) -> Option<egui::TextureHandle> {
-    let id = egui::Id::new(("artcraft-wordmark", dark));
+    let id = egui::Id::unique(("artcraft-wordmark", dark));
     if let Some(t) = ctx.data(|d| d.get_temp::<egui::TextureHandle>(id)) {
         return Some(t);
     }
diff --git a/crates/ui-egui/src/capture.rs b/crates/ui-egui/src/capture.rs
new file mode 100644
index 000000000..617845643
--- /dev/null
+++ b/crates/ui-egui/src/capture.rs
@@ -0,0 +1,1113 @@
+//! Bounded, one-shot window screenshots for `ui.screenshot`.
+//!
+//! A request record owns the output path, crop, reply, deadline, document/focus identity and the
+//! surface geometry it was admitted against. `craft_ui::capture::CaptureSlot` owns the strong
+//! `egui::Context`; its callback holds only a weak reference and never writes a file. Files are
+//! encoded and written only from the logic drain, after the deadline and every identity/geometry
+//! check has passed.
+//!
+//! Web qualification note: the pinned eframe web runner does not implement
+//! `ViewportCommand::RequestPaintWhileHidden` (the native runner does). A hidden web capture that
+//! is still settling therefore reaches its timeout. That fork gap is recorded as a prerequisite;
+//! this module does not claim a hidden web capture works.
+
+use std::sync::Arc;
+use std::sync::mpsc::Sender;
+
+use craft_ui::capture::{CaptureError, CaptureSlot};
+use egui::{ColorImage, ViewportCommand};
+use serde_json::{Value, json};
+use web_time::{Duration, Instant};
+
+use crate::FilmcraftApp;
+
+/// At most this many queued, in-flight or completed-but-not-yet-drained requests.
+pub(crate) const MAX_REQUESTS: usize = 4;
+/// Per-image bound from the suite contract.
+pub(crate) const MAX_IMAGE_BYTES: usize = 128 * 1024 * 1024;
+/// Aggregate bound, counting completed images that have not been drained yet.
+pub(crate) const MAX_TOTAL_BYTES: usize = 256 * 1024 * 1024;
+/// The raw RGBA image is not the only copy alive while a capture is drained: the callback's
+/// `ColorImage`, the cropped RGBA copy and the encoded PNG exist together, and on the web the PNG
+/// is base64-encoded into the reply while all of those are still retained. Reserve this multiple
+/// of the raw pixel bytes so admission actually bounds peak memory, not just the first buffer.
+pub(crate) const CAPTURE_BUFFER_FACTOR: usize = 5;
+
+/// Bytes reserved for one `width`×`height` RGBA capture, including the transient encode copies.
+pub(crate) fn admitted_bytes(expected: [usize; 2]) -> Option<usize> {
+    expected[0].checked_mul(expected[1])?.checked_mul(std::mem::size_of::<egui::Color32>())?.checked_mul(CAPTURE_BUFFER_FACTOR)
+}
+
+const READY_DELAY: Duration = Duration::from_millis(250);
+/// Accepted first UI passes (never discarded passes or hidden logic ticks).
+const SETTLE_PASSES: u32 = 3;
+const DEADLINE: Duration = Duration::from_secs(10);
+/// Give up waiting for the exact monitor frame/timeline rest and capture what is shown (5 s).
+const SETTLE_MAX: Duration = Duration::from_secs(5);
+/// Accepted passes to wait for a named crop target that is not drawn yet (e.g. a panel shown by
+/// the preceding control request). After this the request fails instead of capturing the window.
+const CROP_SETTLE_PASSES: u32 = 3;
+const REPAINT_INTERVAL: Duration = Duration::from_millis(16);
+
+/// The host surface as reported by one `RawInput`. Raw input is fresh on hidden logic-only ticks;
+/// `Context::input`/`viewport_rect` describe the last UI pass and are stale there.
+///
+/// Equality covers only what changes the captured pixels (viewport size, pixels per point and the
+/// GPU texture limit). Minimized, occluded and native window focus are presentation flags: a
+/// hidden or unfocused window still captures the forced paint that was already issued, so they
+/// must neither invalidate an in-flight screenshot nor bump `capture_epoch`.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct SurfaceGeometry {
+    /// Logical viewport size in points. A minimized window keeps its last known size so a forced
+    /// hidden paint can still be requested; `None` only before any size was ever reported.
+    viewport: Option<egui::Vec2>,
+    /// Native pixels per point times egui's interface zoom.
+    pixels_per_point: f32,
+    max_texture_side: usize,
+    minimized: bool,
+    occluded: bool,
+}
+
+impl PartialEq for SurfaceGeometry {
+    /// Compares only the fields that change captured pixels: viewport size, pixels per point and
+    /// the GPU texture limit. The presentation-only minimized/occluded flags are deliberately
+    /// ignored, so minimizing, occluding or losing window focus does not invalidate an issued
+    /// capture.
+    fn eq(&self, other: &Self) -> bool {
+        self.viewport == other.viewport && self.pixels_per_point == other.pixels_per_point && self.max_texture_side == other.max_texture_side
+    }
+}
+
+impl SurfaceGeometry {
+    /// Snapshot the surface from a raw-input callback, reading the fresh `viewports`/`screen_rect`
+    /// geometry rather than the stale `InputState`. Missing or hostile fields fall back to
+    /// `previous` where possible; `None` means no usable zoom and pixels-per-point pair could be
+    /// established.
+    fn from_raw(raw: &egui::RawInput, ctx: &egui::Context, previous: Option<Self>) -> Option<Self> {
+        let info = raw.viewports.get(&raw.viewport_id).cloned().unwrap_or_default();
+        let rect = info.inner_rect.or(raw.screen_rect);
+        let size = rect.map(|rect| rect.size()).filter(|size| size.x.is_finite() && size.y.is_finite() && size.x > 0.0 && size.y > 0.0);
+        let viewport = size.or(previous.and_then(|previous| previous.viewport));
+        let zoom = ctx.zoom_factor();
+        if !zoom.is_finite() || zoom <= 0.0 {
+            return None;
+        }
+        let pixels_per_point = info
+            .native_pixels_per_point
+            .map(|native| native * zoom)
+            .filter(|pixels| pixels.is_finite() && *pixels > 0.0)
+            .or_else(|| previous.map(|previous| previous.pixels_per_point))
+            .unwrap_or_else(|| ctx.pixels_per_point());
+        if !pixels_per_point.is_finite() || pixels_per_point <= 0.0 {
+            return None;
+        }
+        let max_texture_side = raw.max_texture_side.filter(|side| *side > 0).unwrap_or_else(|| ctx.input(|input| input.max_texture_side));
+        let minimized = info.minimized.unwrap_or_else(|| previous.is_some_and(|previous| previous.minimized));
+        let occluded = info.occluded.unwrap_or_else(|| previous.is_some_and(|previous| previous.occluded));
+        Some(Self { viewport, pixels_per_point, max_texture_side, minimized, occluded })
+    }
+
+    /// Pixel size the backend will present: viewport points scaled by pixels per point and
+    /// rounded. If either axis exceeds the texture limit, both axes shrink by the same factor to
+    /// a positive limit, matching wgpu's `surface_fit`; per-axis clamping would predict the wrong
+    /// image. A zero/unknown texture limit disables shrinking.
+    /// `None` when the viewport is missing, non-finite, empty or the size overflows `usize`.
+    fn expected_size(self) -> Option<[usize; 2]> {
+        let viewport = self.viewport?;
+        if !viewport.x.is_finite() || !viewport.y.is_finite() || viewport.x <= 0.0 || viewport.y <= 0.0 {
+            return None;
+        }
+        let axis = |points: f32| -> Option<usize> {
+            let pixels = (f64::from(points) * f64::from(self.pixels_per_point)).round();
+            if !pixels.is_finite() || pixels <= 0.0 || pixels > usize::MAX as f64 {
+                return None;
+            }
+            Some(pixels as usize)
+        };
+        let [width, height] = [axis(viewport.x)?, axis(viewport.y)?];
+        // Match the wgpu backend's `surface_fit`: when either axis exceeds the device limit, both
+        // axes shrink by the same factor and the longer side becomes exactly the limit. Clamping
+        // each axis independently predicted a wider/taller image than the surface actually has.
+        let max = if self.max_texture_side == 0 { usize::MAX } else { self.max_texture_side };
+        if width <= max && height <= max {
+            return Some([width, height]);
+        }
+        let longest = width.max(height);
+        let scale = max as f64 / longest as f64;
+        let fit = |side: usize| -> usize { if side == longest { max } else { ((side as f64 * scale).floor() as usize).clamp(1, max) } };
+        Some([fit(width), fit(height)])
+    }
+
+    /// Pixels per point of the delivered screenshot texture.
+    ///
+    /// egui-wgpu's `surface_fit` shrinks an oversized window's surface by one factor and draws it
+    /// at `pixels_per_point * render_scale`; a crop expressed in points must use that rendered
+    /// scale, not the native one. A window within the limit keeps the native factor exactly, so a
+    /// one-pixel rounding difference between `viewport * ppp` and the integer window size never
+    /// becomes a bogus sub-1 scale.
+    fn captured_pixels_per_point(self) -> f32 {
+        let native = self.pixels_per_point;
+        if !native.is_finite() || native <= 0.0 {
+            return 1.0;
+        }
+        let Some(viewport) = self.viewport else { return native };
+        if !viewport.x.is_finite() || !viewport.y.is_finite() || viewport.x <= 0.0 || viewport.y <= 0.0 || self.max_texture_side == 0 {
+            return native;
+        }
+        let axis = |points: f32| (f64::from(points) * f64::from(native)).round();
+        let (width, height) = (axis(viewport.x), axis(viewport.y));
+        if !width.is_finite() || !height.is_finite() || width <= 0.0 || height <= 0.0 {
+            return native;
+        }
+        let longest = width.max(height);
+        let limit = self.max_texture_side as f64;
+        if longest <= limit {
+            return native;
+        }
+        // Match egui-wgpu exactly: it casts `surface_fit`'s scale to f32 and then multiplies the
+        // f32 pixels-per-point by it.
+        let render_scale = (limit / longest) as f32;
+        let effective = native * render_scale;
+        if effective.is_finite() && effective > 0.0 { effective } else { native }
+    }
+
+    /// Raw RGBA bytes of [`Self::expected_size`], checked for multiplication overflow; `None`
+    /// when the surface has no capturable size.
+    fn expected_bytes(self) -> Option<usize> {
+        let [width, height] = self.expected_size()?;
+        width.checked_mul(height)?.checked_mul(std::mem::size_of::<egui::Color32>())
+    }
+}
+
+/// Which sequence and project revision the request belongs to.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct DocumentId {
+    sequence: Option<u64>,
+    revision: u64,
+}
+
+/// Viewport geometry plus the immutable document and widget-focus identity a capture is bound to.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct CaptureGeometry {
+    surface: SurfaceGeometry,
+    document: DocumentId,
+    focus: Option<egui::Id>,
+}
+
+impl CaptureGeometry {
+    /// Pixel size implied by the bound surface geometry; `None` when it is not capturable.
+    fn expected_size(self) -> Option<[usize; 2]> {
+        self.surface.expected_size()
+    }
+
+    /// Raw RGBA byte count implied by the bound surface, with the same overflow rule as
+    /// [`SurfaceGeometry::expected_bytes`].
+    fn expected_bytes(self) -> Option<usize> {
+        self.surface.expected_bytes()
+    }
+}
+
+/// A screenshot crop named by a widget id. Resolved at issue time from the pass that is actually
+/// captured, never from the control callback that admitted the request (that pass may be two
+/// layouts old or may not have drawn the panel at all).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CropTarget {
+    Element(String),
+}
+
+impl CropTarget {
+    /// Resolve the named element against the accepted pass's automation registry. Only an element
+    /// drawn in the current pass with a finite, non-empty rectangle is accepted; a stale
+    /// previous-pass rectangle or an unknown id is an error, never a fallback to the whole window.
+    fn resolve(&self, registry: &crate::automation::Registry) -> Result<[f32; 4], String> {
+        let Self::Element(id) = self;
+        let element = registry
+            .find_current(id)
+            .ok_or_else(|| format!("screenshot failed: `{id}` was not drawn in the captured pass (the panel may be closed or hidden; see ui.elements)"))?;
+        let [x, y, width, height] = element.rect;
+        if ![x, y, width, height].iter().all(|value| value.is_finite()) || width <= 0.0 || height <= 0.0 {
+            return Err(format!("screenshot failed: `{id}` has an empty or non-finite rectangle"));
+        }
+        Ok(element.rect)
+    }
+}
+
+struct Shot {
+    token: u64,
+    path: Option<String>,
+    crop_target: Option<CropTarget>,
+    /// The crop resolved from the accepted pass that was captured (set at issue time).
+    crop: Option<[f32; 4]>,
+    /// Accepted passes the named crop target was missing, while a just-shown panel lays out.
+    crop_misses: u32,
+    reply: Sender<Value>,
+    deadline: Instant,
+    ready_at: Instant,
+    frames: u32,
+    issued: bool,
+    document: DocumentId,
+    focus: Option<egui::Id>,
+    geometry: CaptureGeometry,
+    geometry_epoch: u64,
+    expected: [usize; 2],
+    reserved: usize,
+    slot: Option<CaptureSlot>,
+    callback: Option<egui::ScreenshotCallback>,
+}
+
+/// All admitted screenshots. `requests` includes queued, issued and completed-but-undrained
+/// captures; nothing is removed before it has been replied to or timed out.
+#[derive(Default)]
+pub(crate) struct Shots {
+    token: u64,
+    requests: Vec<Shot>,
+}
+
+impl Shots {
+    /// True when no request is queued, in flight or completed-but-not-yet-drained.
+    pub(crate) fn is_empty(&self) -> bool {
+        self.requests.is_empty()
+    }
+
+    /// True while at least one admitted request has not been handed to a `Screenshot` callback.
+    fn has_unissued(&self) -> bool {
+        self.requests.iter().any(|shot| !shot.issued)
+    }
+
+    /// Sum of every request's byte reservation, including completed-but-undrained captures;
+    /// saturates instead of overflowing.
+    fn reserved(&self) -> usize {
+        self.requests.iter().fold(0usize, |sum, shot| sum.saturating_add(shot.reserved))
+    }
+}
+
+/// Allocate the next request token, wrapping after `u64::MAX` and skipping zero so a token is
+/// always usable as a presence marker.
+fn next_token(shots: &mut Shots) -> u64 {
+    let mut token = shots.token.wrapping_add(1);
+    if token == 0 {
+        token = 1;
+    }
+    shots.token = token;
+    token
+}
+
+/// Build the JSON error reply carrying `token`, so the client can match a rejection to the
+/// request it sent.
+fn error_reply(token: u64, message: impl std::fmt::Display) -> Value {
+    json!({"ok": false, "error": message.to_string(), "request": token})
+}
+
+/// Send an error reply for `token`, ignoring a client that has already disconnected.
+fn reject(reply: Sender<Value>, token: u64, message: impl std::fmt::Display) {
+    let _ = reply.send(error_reply(token, message));
+}
+
+/// The active sequence id (none when no sequence is open) and project revision that a capture
+/// is bound to.
+fn active_document(app: &FilmcraftApp) -> DocumentId {
+    DocumentId { sequence: app.session.state.active_sequence.map(|id| id.0), revision: app.session.revision }
+}
+
+/// The widget currently holding keyboard focus, part of the capture identity.
+fn current_focus(ctx: &egui::Context) -> Option<egui::Id> {
+    ctx.memory(|memory| memory.focused())
+}
+
+/// Refresh the fresh raw-input surface/identity snapshot. Called from `raw_input_hook`, so it runs
+/// on both UI and hidden logic-only callbacks and never reads the stale `InputState` rectangle.
+pub(crate) fn note_raw_geometry(app: &mut FilmcraftApp, ctx: &egui::Context, raw: &egui::RawInput) {
+    let previous = app.capture_geometry;
+    let Some(surface) = SurfaceGeometry::from_raw(raw, ctx, previous.map(|geometry| geometry.surface)) else {
+        app.capture_geometry = None;
+        app.capture_epoch = app.capture_epoch.wrapping_add(1);
+        return;
+    };
+    let geometry = CaptureGeometry { surface, document: active_document(app), focus: current_focus(ctx) };
+    let changed = app.capture_geometry != Some(geometry);
+    // Keep the presentation flags fresh even when they did not change the capture geometry.
+    app.capture_geometry = Some(geometry);
+    if changed {
+        app.capture_epoch = app.capture_epoch.wrapping_add(1);
+    }
+}
+
+/// Pick up document/revision and keyboard-focus changes made since the raw-input snapshot (a
+/// control request, or the UI pass that admitted a `ui.screenshot` at its end).
+fn refresh_identity(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    let Some(geometry) = app.capture_geometry else { return };
+    let refreshed = CaptureGeometry { document: active_document(app), focus: current_focus(ctx), ..geometry };
+    let changed = refreshed != geometry;
+    app.capture_geometry = Some(refreshed);
+    if changed {
+        app.capture_epoch = app.capture_epoch.wrapping_add(1);
+    }
+}
+
+/// Admit one `ui.screenshot` request without issuing it. Counts queued, in-flight and
+/// completed-but-undrained requests and reserves the raw image plus its encode/encode-reply buffers
+/// before capture.
+pub(crate) fn admit(app: &mut FilmcraftApp, ctx: &egui::Context, path: Option<String>, crop: Option<CropTarget>, reply: Sender<Value>) {
+    refresh_identity(app, ctx);
+    let token = next_token(&mut app.shots);
+    let Some(geometry) = app.capture_geometry else {
+        return reject(reply, token, "screenshot failed: the window geometry is not known yet");
+    };
+    let Some(expected) = geometry.expected_size() else {
+        return reject(reply, token, "screenshot failed: the window has no capturable size yet");
+    };
+    let Some(raw) = geometry.expected_bytes() else {
+        return reject(reply, token, "screenshot failed: the window size overflows the screenshot budget");
+    };
+    if raw > MAX_IMAGE_BYTES {
+        return reject(
+            reply,
+            token,
+            format!(
+                "screenshot budget exceeded: {raw} raw bytes for one {}×{} image, over the {MAX_IMAGE_BYTES}-byte per-image limit",
+                expected[0], expected[1]
+            ),
+        );
+    }
+    let Some(reserved) = admitted_bytes(expected) else {
+        return reject(reply, token, "screenshot failed: the window size overflows the screenshot budget");
+    };
+    if reserved > MAX_TOTAL_BYTES {
+        return reject(
+            reply,
+            token,
+            format!(
+                "screenshot budget exceeded: one {}×{} capture needs up to {reserved} bytes including the crop/encode reply buffers, over the {MAX_TOTAL_BYTES}-byte limit",
+                expected[0], expected[1]
+            ),
+        );
+    }
+    if app.shots.requests.len() >= MAX_REQUESTS {
+        return reject(reply, token, format!("screenshot budget exceeded: {MAX_REQUESTS} requests are already outstanding"));
+    }
+    let total = app.shots.reserved().saturating_add(reserved);
+    if total > MAX_TOTAL_BYTES {
+        return reject(
+            reply,
+            token,
+            format!("screenshot budget exceeded: {total} bytes reserved by outstanding requests, over the {MAX_TOTAL_BYTES}-byte limit"),
+        );
+    }
+    let (slot, callback) = CaptureSlot::new(ctx, ctx.viewport_id(), MAX_IMAGE_BYTES);
+    let now = Instant::now();
+    app.shots.requests.push(Shot {
+        token,
+        path,
+        crop_target: crop,
+        crop: None,
+        crop_misses: 0,
+        reply,
+        deadline: now + DEADLINE,
+        ready_at: now + READY_DELAY,
+        frames: 0,
+        issued: false,
+        document: geometry.document,
+        focus: geometry.focus,
+        geometry,
+        geometry_epoch: app.capture_epoch,
+        expected,
+        reserved,
+        slot: Some(slot),
+        callback: Some(callback),
+    });
+    ctx.request_repaint();
+}
+
+/// Why the request's bound document/revision or keyboard focus no longer matches. `None`
+/// means identity is unchanged; a mismatch must reject rather than save pixels from another
+/// document or focus.
+fn identity_reason(app: &FilmcraftApp, ctx: &egui::Context, shot: &Shot) -> Option<&'static str> {
+    if active_document(app) != shot.document {
+        Some("the document or project revision changed while the capture was queued")
+    } else if current_focus(ctx) != shot.focus {
+        Some("the keyboard focus changed while the capture was queued")
+    } else {
+        None
+    }
+}
+
+/// Why the live surface snapshot or capture epoch differs from the one this request was
+/// admitted or issued against. `None` means the geometry is still the one it reserved for.
+fn geometry_reason(app: &FilmcraftApp, shot: &Shot) -> Option<&'static str> {
+    if app.capture_geometry != Some(shot.geometry) || app.capture_epoch != shot.geometry_epoch {
+        Some("the window geometry changed while the capture was queued")
+    } else {
+        None
+    }
+}
+
+/// Re-admit an unissued request against the current geometry: cancel its old slot, check the
+/// per-image and aggregate budgets including every other request, and reset its settled
+/// frames, crop misses and ready time. On failure nothing is changed and the caller rejects
+/// it; on success the request is unissued again and must collect fresh settling passes.
+fn retry_geometry(app: &mut FilmcraftApp, ctx: &egui::Context, index: usize) -> Result<(), String> {
+    let now = Instant::now();
+    let current = app.capture_geometry.ok_or_else(|| "the window geometry is no longer known".to_string())?;
+    let expected = current.expected_size().ok_or_else(|| "the window has no capturable size".to_string())?;
+    let raw = current.expected_bytes().ok_or_else(|| "the window size overflows the screenshot budget".to_string())?;
+    if raw > MAX_IMAGE_BYTES {
+        return Err(format!("the window now needs {raw} raw bytes, over the {MAX_IMAGE_BYTES}-byte per-image limit"));
+    }
+    let reserved = admitted_bytes(expected).ok_or_else(|| "the window size overflows the screenshot budget".to_string())?;
+    let others = app.shots.requests.iter().enumerate().filter(|(i, _)| *i != index).fold(0usize, |sum, (_, shot)| sum.saturating_add(shot.reserved));
+    if others.saturating_add(reserved) > MAX_TOTAL_BYTES {
+        return Err(format!("the window now needs {reserved} bytes, over the {MAX_TOTAL_BYTES}-byte aggregate limit"));
+    }
+    let Some(current_geometry) = app.capture_geometry else { return Err("the window geometry changed repeatedly".into()) };
+    let (slot, callback) = CaptureSlot::new(ctx, ctx.viewport_id(), MAX_IMAGE_BYTES);
+    let shot = app.shots.requests.get_mut(index).ok_or_else(|| "the screenshot request disappeared".to_string())?;
+    if let Some(old) = shot.slot.take() {
+        old.cancel();
+    }
+    shot.callback = Some(callback);
+    shot.slot = Some(slot);
+    shot.geometry = current_geometry;
+    shot.geometry_epoch = app.capture_epoch;
+    shot.expected = expected;
+    shot.reserved = reserved;
+    shot.frames = 0;
+    shot.crop_misses = 0;
+    shot.ready_at = now + READY_DELAY;
+    shot.issued = false;
+    Ok(())
+}
+
+/// Whether an unissued request has waited for enough accepted passes, including the bounded
+/// maximum when the monitor is still showing an inexact frame or the timeline is animating.
+fn shot_is_settled(now: Instant, monitor_inexact: bool, timeline_still: u32, shot: &Shot) -> bool {
+    if now < shot.ready_at || shot.frames < SETTLE_PASSES {
+        return false;
+    }
+    !((monitor_inexact || timeline_still < 2) && now < shot.ready_at + SETTLE_MAX)
+}
+
+/// The result of trying to issue one settled request. Every variant keeps the original admission
+/// order: identity failures reject, geometry changes retry, a missing crop target waits a bounded
+/// number of passes, and everything else issues in the current accepted UI pass.
+enum IssueOutcome {
+    Identity(String),
+    GeometryRetry,
+    CropDeferred,
+    Failed(String),
+    Issued,
+}
+
+/// Decide one settled request: reject on identity change, ask for a geometry retry, defer a
+/// not-yet-drawn crop target for a bounded number of accepted passes, or issue the screenshot
+/// with the crop resolved from this pass. The callback is taken at most once and `issued` is
+/// set only when the viewport command was sent.
+fn try_issue_shot(app: &mut FilmcraftApp, ctx: &egui::Context, index: usize) -> IssueOutcome {
+    let shot = &app.shots.requests[index];
+    if let Some(reason) = identity_reason(app, ctx, shot) {
+        return IssueOutcome::Identity(reason.to_string());
+    }
+    if geometry_reason(app, shot).is_some() {
+        return IssueOutcome::GeometryRetry;
+    }
+    let crop_result = match shot.crop_target.as_ref() {
+        Some(target) => target.resolve(&app.auto).map(Some),
+        None => Ok(None),
+    };
+    let resolved_crop = match crop_result {
+        Ok(crop) => crop,
+        Err(message) => {
+            let shot = &mut app.shots.requests[index];
+            if shot.crop_misses < CROP_SETTLE_PASSES {
+                // The panel may be shown by a request processed just before this admission;
+                // let the next accepted pass draw it before giving up.
+                shot.crop_misses = shot.crop_misses.saturating_add(1);
+                return IssueOutcome::CropDeferred;
+            }
+            return IssueOutcome::Failed(message);
+        }
+    };
+    let shot = &mut app.shots.requests[index];
+    let Some(callback) = shot.callback.take() else {
+        return IssueOutcome::Failed("screenshot failed: the capture callback was already consumed".into());
+    };
+    shot.crop = resolved_crop;
+    ctx.send_viewport_cmd_to(ctx.viewport_id(), ViewportCommand::Screenshot(callback));
+    shot.issued = true;
+    IssueOutcome::Issued
+}
+
+/// Reject failed requests from the highest index down, so an earlier removal cannot shift a later
+/// index and remove the wrong shot.
+fn reject_failures(app: &mut FilmcraftApp, mut failures: Vec<(usize, String)>) {
+    failures.sort_unstable_by_key(|(i, _)| std::cmp::Reverse(*i));
+    for (i, message) in failures {
+        if i >= app.shots.requests.len() {
+            continue;
+        }
+        let shot = app.shots.requests.remove(i);
+        if let Some(slot) = shot.slot {
+            slot.cancel();
+        }
+        reject(shot.reply, shot.token, message);
+    }
+}
+
+/// Issue settled requests. Called from every real `App::ui` pass (never from a hidden
+/// `run_logic` tick), including the accepted final pass of a multipass layout. `monitor_inexact`
+/// describes the pass that just drew the monitor, so consume it here: it must not stay sticky and
+/// delay every later screenshot until the 5 s settle maximum.
+pub(crate) fn issue(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    let monitor_inexact = std::mem::take(&mut app.monitor_inexact);
+    if ctx.will_discard() {
+        return;
+    }
+    let now = Instant::now();
+    let mut failures: Vec<(usize, String)> = Vec::new();
+    let mut retries: Vec<usize> = Vec::new();
+    for i in 0..app.shots.requests.len() {
+        if app.shots.requests[i].issued {
+            continue;
+        }
+        app.shots.requests[i].frames = app.shots.requests[i].frames.saturating_add(1);
+        let shot = &app.shots.requests[i];
+        if !shot_is_settled(now, monitor_inexact, app.timeline_still, shot) {
+            continue;
+        }
+        match try_issue_shot(app, ctx, i) {
+            IssueOutcome::Identity(reason) => failures.push((i, reason)),
+            IssueOutcome::GeometryRetry => retries.push(i),
+            IssueOutcome::CropDeferred => ctx.request_repaint(),
+            IssueOutcome::Failed(message) => failures.push((i, message)),
+            IssueOutcome::Issued => {}
+        }
+    }
+    for i in retries.into_iter().rev() {
+        if let Err(message) = retry_geometry(app, ctx, i) {
+            failures.push((i, message));
+        }
+    }
+    reject_failures(app, failures);
+    if !app.shots.is_empty() {
+        ctx.request_repaint_after(REPAINT_INTERVAL);
+    }
+}
+
+/// The next step for one drain scan position. `Keep` advances to the next request; every removal
+/// variant leaves the index unchanged so it sees the shot shifted into place.
+enum DrainStep {
+    Keep,
+    Timeout,
+    Identity(String),
+    Geometry,
+    Complete(Result<Arc<ColorImage>, CaptureError>),
+}
+
+/// Classify one drain position before removing anything: check the deadline first, then
+/// identity, then geometry (an unissued request keeps waiting for a retry, while in-flight
+/// stale pixels are rejected), and finally take a completed slot. `Keep` leaves the request
+/// in place and advances the scan.
+fn drain_step(app: &FilmcraftApp, ctx: &egui::Context, index: usize, now: Instant) -> DrainStep {
+    let shot = &app.shots.requests[index];
+    if now >= shot.deadline {
+        return DrainStep::Timeout;
+    }
+    if let Some(reason) = identity_reason(app, ctx, shot) {
+        return DrainStep::Identity(reason.to_string());
+    }
+    if geometry_reason(app, shot).is_some() {
+        if !shot.issued {
+            // The next accepted UI pass re-creates the slot against the fresh geometry.
+            return DrainStep::Keep;
+        }
+        // Geometry changed while the callback was already issued: reject stale pixels rather
+        // than pairing them with the new surface.
+        return DrainStep::Geometry;
+    }
+    if !shot.issued {
+        return DrainStep::Keep;
+    }
+    let Some(result) = shot.slot.as_ref().and_then(CaptureSlot::take) else {
+        return DrainStep::Keep;
+    };
+    DrainStep::Complete(result)
+}
+
+/// Remove one request, cancel its slot and send its error reply; later requests shift down by
+/// one index.
+fn remove_and_reject(app: &mut FilmcraftApp, index: usize, message: impl std::fmt::Display) {
+    let shot = app.shots.requests.remove(index);
+    if let Some(slot) = shot.slot {
+        slot.cancel();
+    }
+    reject(shot.reply, shot.token, message);
+}
+
+/// Build the saved-image reply, using the rendered scale of the delivered texture for crops.
+fn image_reply(shot: &Shot, image: &ColorImage) -> Value {
+    if image.size != shot.expected {
+        return error_reply(
+            shot.token,
+            format!(
+                "screenshot is {}×{} pixels, expected {}×{}: the window changed size while it was captured",
+                image.size[0], image.size[1], shot.expected[0], shot.expected[1]
+            ),
+        );
+    }
+    let captured_ppp = shot.geometry.surface.captured_pixels_per_point();
+    let mut reply = crate::control::save_screenshot_with_ppp(image, shot.path.as_deref(), shot.crop, captured_ppp);
+    if let Some(object) = reply.as_object_mut() {
+        object.insert("request".into(), json!(shot.token));
+    }
+    reply
+}
+
+/// Cancel any remaining callback, turn the captured image or error into the reply and send it
+/// exactly once. A pixel size that differs from the reserved size becomes an error reply
+/// instead of writing an image for the wrong surface.
+fn complete_shot(mut shot: Shot, result: Result<Arc<ColorImage>, CaptureError>) {
+    if let Some(slot) = shot.slot.take() {
+        slot.cancel();
+    }
+    let reply = match result {
+        Ok(image) => image_reply(&shot, &image),
+        Err(error) => error_reply(shot.token, error),
+    };
+    let _ = shot.reply.send(reply);
+}
+
+/// Drain completed slots and expire timed-out requests. Call from every logic callback (including
+/// hidden ones). The deadline is checked before taking or writing an image.
+pub(crate) fn drain(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    let mut i = 0;
+    while i < app.shots.requests.len() {
+        let now = Instant::now();
+        match drain_step(app, ctx, i, now) {
+            DrainStep::Keep => i += 1,
+            DrainStep::Timeout => remove_and_reject(app, i, "no frame was presented before the screenshot timeout"),
+            DrainStep::Identity(reason) => remove_and_reject(app, i, format!("screenshot failed: {reason}")),
+            DrainStep::Geometry => remove_and_reject(app, i, "screenshot failed: the window geometry changed while the capture was in flight"),
+            DrainStep::Complete(result) => {
+                let shot = app.shots.requests.remove(i);
+                complete_shot(shot, result);
+            }
+        }
+    }
+    if !app.shots.is_empty() {
+        ctx.request_repaint_after(REPAINT_INTERVAL);
+    }
+}
+
+/// Cancel every queued/in-flight capture (app exit). Late callbacks see a dropped slot and write
+/// nothing; clients receive one error reply instead of hanging past the transport timeout.
+pub(crate) fn cancel_all(app: &mut FilmcraftApp) {
+    for shot in app.shots.requests.drain(..) {
+        if let Some(slot) = shot.slot {
+            slot.cancel();
+        }
+        let _ = shot.reply.send(error_reply(shot.token, "screenshot cancelled: the app is closing"));
+    }
+}
+
+/// Ask for a painted frame while a request is still queued, and on hidden logic ticks when a
+/// capture is waiting for settlement. The screenshot command itself forces one paint once issued.
+pub(crate) fn request_hidden_paint(app: &FilmcraftApp, ctx: &egui::Context) {
+    if app.shots.has_unissued() {
+        ctx.send_viewport_cmd(ViewportCommand::RequestPaintWhileHidden);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+    use std::sync::mpsc::{Receiver, channel};
+
+    use egui::{Color32, ColorImage, Rect, ViewportId, ViewportInfo, pos2, vec2};
+
+    use super::*;
+    use crate::automation::Registry;
+    use filmcraft_engine::Session;
+
+    /// App with a default session, for capture-state unit tests.
+    fn app() -> FilmcraftApp {
+        FilmcraftApp::new(Session::default())
+    }
+
+    /// A fixed 800×600, 1 px/pt capture identity for the app's current document with no focus.
+    fn geometry(app: &FilmcraftApp) -> CaptureGeometry {
+        CaptureGeometry {
+            surface: SurfaceGeometry {
+                viewport: Some(egui::vec2(800.0, 600.0)),
+                pixels_per_point: 1.0,
+                max_texture_side: 8192,
+                minimized: false,
+                occluded: false,
+            },
+            document: active_document(app),
+            focus: None,
+        }
+    }
+
+    /// Raw input reporting an 800×600 root viewport.
+    fn raw() -> egui::RawInput {
+        egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 600.0))), ..Default::default() }
+    }
+
+    /// Admit one uncropped in-memory capture at the default test surface; return its reply
+    /// receiver and token.
+    fn admit_one(app: &mut FilmcraftApp, ctx: &egui::Context) -> (Receiver<Value>, u64) {
+        admit_with_surface(app, ctx, geometry(app).surface)
+    }
+
+    /// Bind `surface` as the current capture geometry, admit one uncropped in-memory capture and
+    /// return its reply receiver and token.
+    fn admit_with_surface(app: &mut FilmcraftApp, ctx: &egui::Context, surface: SurfaceGeometry) -> (Receiver<Value>, u64) {
+        app.capture_geometry = Some(CaptureGeometry { surface, document: active_document(app), focus: None });
+        let (tx, rx) = channel();
+        admit(app, ctx, None, None, tx);
+        let token = app.shots.requests.last().map(|shot| shot.token).unwrap_or_default();
+        (rx, token)
+    }
+
+    /// `note_raw_geometry` uses the fresh raw 2x viewport (1600×1200) rather than the previous
+    /// pass's input and bumps the capture epoch.
+    #[test]
+    fn raw_geometry_uses_the_fresh_surface_not_the_previous_pass() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let mut raw = raw();
+        let _ = raw.viewports.insert(ViewportId::ROOT, ViewportInfo { native_pixels_per_point: Some(2.0), ..Default::default() });
+        note_raw_geometry(&mut app, &ctx, &raw);
+        let geometry = app.capture_geometry.expect("geometry from raw input");
+        assert_eq!(geometry.surface.expected_size(), Some([1600, 1200]));
+        assert!(app.capture_epoch > 0);
+    }
+
+    /// Oversized surfaces shrink both axes by one factor to the texture limit and crop at the
+    /// matching rendered scale; a surface within the limit keeps the exact native scale.
+    #[test]
+    fn oversized_windows_predict_the_backends_uniformly_scaled_surface() {
+        let app = app();
+        let mut surface = geometry(&app).surface;
+        surface.viewport = Some(vec2(16_384.0, 4_000.0));
+        surface.max_texture_side = 8192;
+        assert_eq!(surface.expected_size(), Some([8192, 2000]), "both axes scale by the same factor, like egui-wgpu's surface_fit");
+        assert_eq!(surface.captured_pixels_per_point(), 0.5, "the fitted texture is drawn at the same factor");
+        surface.viewport = Some(vec2(4_000.0, 16_384.0));
+        assert_eq!(surface.expected_size(), Some([2000, 8192]));
+        assert_eq!(surface.captured_pixels_per_point(), 0.5);
+        surface.viewport = Some(vec2(1920.0, 1080.0));
+        assert_eq!(surface.expected_size(), Some([1920, 1080]), "within the limit nothing shrinks");
+        assert_eq!(surface.captured_pixels_per_point(), 1.0, "an uncapped surface keeps the native scale exactly");
+    }
+
+    /// Unusable viewport data preserves a valid native scale, while an invalid native scale falls
+    /// back to 1.0 so a crop can never divide by zero.
+    #[test]
+    fn captured_scale_falls_back_when_geometry_is_unusable() {
+        let app = app();
+        let mut surface = geometry(&app).surface;
+        surface.pixels_per_point = 2.0;
+        surface.viewport = None;
+        assert_eq!(surface.captured_pixels_per_point(), 2.0, "no viewport preserves the native scale");
+        surface.viewport = Some(vec2(0.0, 600.0));
+        assert_eq!(surface.captured_pixels_per_point(), 2.0);
+        surface.viewport = Some(vec2(f32::NAN, 600.0));
+        assert_eq!(surface.captured_pixels_per_point(), 2.0);
+        surface.viewport = Some(vec2(800.0, 600.0));
+        surface.pixels_per_point = f32::INFINITY;
+        assert_eq!(surface.captured_pixels_per_point(), 1.0, "an invalid native scale falls back to 1, like save_screenshot_with_ppp");
+        surface.pixels_per_point = 0.0;
+        assert_eq!(surface.captured_pixels_per_point(), 1.0);
+    }
+
+    /// A crop in points selects the region where a uniformly downscaled surface actually drew it,
+    /// using the rendered rather than the native scale.
+    #[test]
+    fn downscaled_capture_crops_with_the_rendered_scale() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let surface = SurfaceGeometry {
+            viewport: Some(vec2(16_384.0, 2_000.0)),
+            // A 2x native surface fits at 0.25 render scale: crop at 0.5 pixels per point.
+            // This also catches accidentally returning render_scale without the native factor.
+            pixels_per_point: 2.0,
+            max_texture_side: 8192,
+            minimized: false,
+            occluded: false,
+        };
+        assert_eq!(surface.expected_size(), Some([8192, 1_000]));
+        assert_eq!(surface.captured_pixels_per_point(), 0.5);
+        let (rx, token) = admit_with_surface(&mut app, &ctx, surface);
+        let dir = tempfile::tempdir().expect("a temporary screenshot directory");
+        let path = dir.path().join("downscaled-crop.png");
+        // The crop is 400x200 points, which the fitted surface draws as 200x100 pixels. Paint a
+        // red rectangle at exactly that rendered position so a wrong (native) scale would crop
+        // black pixels or the wrong dimensions instead of this region.
+        let mut image = ColorImage::filled([8192, 1_000], Color32::BLACK);
+        for y in 25..125 {
+            for x in 50..250 {
+                image.pixels[y * 8192 + x] = Color32::RED;
+            }
+        }
+        let shot = &mut app.shots.requests[0];
+        shot.path = Some(path.to_string_lossy().into_owned());
+        shot.crop = Some([100.0, 50.0, 400.0, 200.0]);
+        shot.issued = true;
+        let callback = shot.callback.take().expect("a callback");
+        callback.complete(Arc::new(image));
+        drain(&mut app, &ctx);
+        let reply = rx.try_recv().expect("a screenshot reply");
+        assert_eq!(reply["request"], token);
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert_eq!([reply["result"]["width"].as_u64(), reply["result"]["height"].as_u64()], [Some(200), Some(100)]);
+        let decoded = image::load_from_memory(&std::fs::read(&path).expect("the saved crop")).expect("decode the saved crop").to_rgba8();
+        assert_eq!(decoded.dimensions(), (200, 100));
+        assert!(
+            decoded.pixels().all(|pixel| *pixel == image::Rgba([255, 0, 0, 255])),
+            "the crop must select the red region where the downscaled surface drew it"
+        );
+    }
+
+    /// A 1.5x surface whose point size rounds up by one window pixel is still uncapped, so its
+    /// crop keeps the exact 1.5 scale instead of a slightly shrunk one.
+    #[test]
+    fn uncapped_hidpi_capture_keeps_the_native_scale() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let surface = SurfaceGeometry {
+            // 801 points at 1.5x is 1201.5 window pixels, which rounds to 1202. The fitted scale
+            // must still be exactly 1.0 rather than 1202/1201.5 from that one-pixel difference.
+            viewport: Some(vec2(801.0, 600.0)),
+            pixels_per_point: 1.5,
+            max_texture_side: 8192,
+            minimized: false,
+            occluded: false,
+        };
+        assert_eq!(surface.expected_size(), Some([1202, 900]));
+        assert_eq!(surface.captured_pixels_per_point(), 1.5);
+        let (rx, token) = admit_with_surface(&mut app, &ctx, surface);
+        let dir = tempfile::tempdir().expect("a temporary screenshot directory");
+        let path = dir.path().join("hidpi-crop.png");
+        let mut image = ColorImage::filled([1202, 900], Color32::BLACK);
+        for y in 75..375 {
+            for x in 150..750 {
+                image.pixels[y * 1202 + x] = Color32::GREEN;
+            }
+        }
+        let shot = &mut app.shots.requests[0];
+        shot.path = Some(path.to_string_lossy().into_owned());
+        shot.crop = Some([100.0, 50.0, 400.0, 200.0]);
+        shot.issued = true;
+        let callback = shot.callback.take().expect("a callback");
+        callback.complete(Arc::new(image));
+        drain(&mut app, &ctx);
+        let reply = rx.try_recv().expect("a screenshot reply");
+        assert_eq!(reply["request"], token);
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert_eq!([reply["result"]["width"].as_u64(), reply["result"]["height"].as_u64()], [Some(600), Some(300)]);
+        let decoded = image::load_from_memory(&std::fs::read(&path).expect("the saved crop")).expect("decode the saved crop").to_rgba8();
+        assert_eq!(decoded.dimensions(), (600, 300));
+        assert!(decoded.pixels().all(|pixel| *pixel == image::Rgba([0, 255, 0, 255])), "the HiDPI crop must select the green region at the native scale");
+    }
+
+    /// Minimized, occluded and window-focus flags do not bump the epoch or reject an already
+    /// issued capture; its pixels are still delivered once.
+    #[test]
+    fn presentation_flags_do_not_invalidate_an_issued_capture() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let (rx, token) = admit_one(&mut app, &ctx);
+        let callback = app.shots.requests[0].callback.take().expect("a callback");
+        app.shots.requests[0].issued = true;
+        // The window is minimized or another application took focus while the callback was in
+        // flight. Those flags do not change captured pixels and must not reject the image.
+        let epoch = app.capture_epoch;
+        let mut raw = egui::RawInput {
+            screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))),
+            max_texture_side: Some(8192),
+            focused: false,
+            ..Default::default()
+        };
+        let viewport = raw.viewports.entry(ViewportId::ROOT).or_default();
+        viewport.native_pixels_per_point = Some(1.0);
+        viewport.minimized = Some(true);
+        viewport.occluded = Some(true);
+        note_raw_geometry(&mut app, &ctx, &raw);
+        assert_eq!(app.capture_epoch, epoch, "presentation-only raw input retains the issued capture");
+        callback.complete(Arc::new(ColorImage::filled([800, 600], Color32::RED)));
+        drain(&mut app, &ctx);
+        let reply = rx.try_recv().expect("the issued capture completes instead of being rejected");
+        assert_eq!(reply["request"], token);
+        assert_eq!(reply["ok"], true, "{reply}");
+    }
+
+    /// Admission counts completed-but-undrained requests, so a new request over `MAX_REQUESTS`
+    /// is rejected instead of replacing a slot that still owes a reply.
+    #[test]
+    fn admission_counts_outstanding_and_completed_but_undrained_requests() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let _receivers: Vec<_> = (0..MAX_REQUESTS).map(|_| admit_one(&mut app, &ctx)).collect();
+        assert_eq!(app.shots.requests.len(), MAX_REQUESTS);
+        let image = Arc::new(ColorImage::filled([800, 600], Color32::RED));
+        app.shots.requests[0].callback.take().expect("a callback").complete(image);
+        let (tx, rx) = channel();
+        admit(&mut app, &ctx, None, None, tx);
+        assert_eq!(app.shots.requests.len(), MAX_REQUESTS, "the fifth request is rejected, not admitted");
+        let reply = rx.recv().expect("a rejection reply");
+        assert_eq!(reply["ok"], false);
+        assert!(reply["error"].as_str().unwrap_or_default().contains("outstanding"), "{reply}");
+    }
+
+    /// A timed-out request replies once; its late callback cannot produce a second reply.
+    #[test]
+    fn a_late_completion_after_timeout_does_not_write_or_reply_twice() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let (rx, token) = admit_one(&mut app, &ctx);
+        let callback = app.shots.requests[0].callback.take().expect("a callback");
+        app.shots.requests[0].issued = true;
+        app.shots.requests[0].deadline = Instant::now() - Duration::from_millis(1);
+        drain(&mut app, &ctx);
+        let reply = rx.recv().expect("timeout reply");
+        assert_eq!(reply["request"], token);
+        assert_eq!(reply["ok"], false);
+        callback.complete(Arc::new(ColorImage::filled([800, 600], Color32::RED)));
+        assert!(rx.try_recv().is_err(), "a late image must not produce another reply");
+    }
+
+    /// A near-per-image-limit surface is rejected before any slot exists because its crop/encode
+    /// reservation alone exceeds the aggregate bound.
+    #[test]
+    fn near_limit_images_are_rejected_for_encode_buffer_memory() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        // 8000×4000 RGBA is exactly 128,000,000 raw bytes, under the per-image bound, but the
+        // crop/PNG/base64 copies make its real peak several times larger than the aggregate bound.
+        app.capture_geometry = Some(CaptureGeometry {
+            surface: SurfaceGeometry {
+                viewport: Some(vec2(8000.0, 4000.0)),
+                pixels_per_point: 1.0,
+                max_texture_side: 16384,
+                minimized: false,
+                occluded: false,
+            },
+            document: active_document(&app),
+            focus: None,
+        });
+        let (tx, rx) = channel();
+        admit(&mut app, &ctx, None, None, tx);
+        assert!(app.shots.requests.is_empty(), "the image is rejected before a slot or buffer is created");
+        let reply = rx.recv().expect("a rejection reply");
+        assert_eq!(reply["ok"], false);
+        assert!(reply["error"].as_str().unwrap_or_default().contains("budget"), "{reply}");
+        assert!(admitted_bytes([8000, 4000]).is_some_and(|bytes| bytes > MAX_TOTAL_BYTES));
+    }
+
+    /// A crop resolves only from the current pass's registry; a stale rect and a missing id both
+    /// error rather than using old coordinates.
+    #[test]
+    fn a_crop_is_resolved_from_the_current_pass_not_the_previous_one() {
+        let mut registry = Registry::default();
+        let old = Rect::from_min_size(pos2(0.0, 0.0), vec2(100.0, 50.0));
+        let fresh = Rect::from_min_size(pos2(300.0, 200.0), vec2(400.0, 250.0));
+        registry.add("panel.project", old, "Project");
+        registry.begin_frame(); // the previous pass keeps the old rect; this pass has not drawn yet
+        let target = CropTarget::Element("panel.project".into());
+        assert!(target.resolve(&registry).is_err(), "a stale rect must not be used");
+        registry.add("panel.project", fresh, "Project");
+        assert_eq!(target.resolve(&registry).expect("fresh rect"), [300.0, 200.0, 400.0, 250.0]);
+        assert!(CropTarget::Element("panel.missing".into()).resolve(&registry).is_err());
+    }
+
+    /// Issuing waits for the accepted final pass of a multipass layout, not the discarded first
+    /// pass.
+    #[test]
+    fn issue_runs_on_the_accepted_final_pass_of_a_multipass_layout() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let (_rx, _token) = admit_one(&mut app, &ctx);
+        app.shots.requests[0].ready_at = Instant::now() - Duration::from_millis(1);
+        app.shots.requests[0].frames = SETTLE_PASSES;
+        app.timeline_still = 2;
+        let mut passes = 0;
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            passes += 1;
+            if ui.ctx().current_pass_index() == 0 {
+                ui.ctx().request_discard("capture pass test");
+            }
+            issue(&mut app, ui.ctx());
+        });
+        output.textures_delta.clear();
+        assert_eq!(passes, 2, "the first pass was discarded and the second accepted");
+        assert!(app.shots.requests[0].issued, "the accepted pass must issue the capture");
+    }
+
+    /// `issue` consumes `monitor_inexact`, so the signal cannot stay sticky and delay later
+    /// screenshots until the five-second settle maximum.
+    #[test]
+    fn monitor_inexact_is_consumed_by_each_issue_attempt() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        app.monitor_inexact = true;
+        issue(&mut app, &ctx);
+        assert!(!app.monitor_inexact, "a sticky flag would delay every later screenshot by up to five seconds");
+    }
+
+    /// An unissued request follows a geometry change: its expected size and budget are recomputed
+    /// and it waits for fresh settling passes before issuing.
+    #[test]
+    fn a_geometry_change_retries_an_unissued_capture_with_new_budget() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let (_rx, _) = admit_one(&mut app, &ctx);
+        app.shots.requests[0].ready_at = Instant::now() - Duration::from_millis(1);
+        app.shots.requests[0].frames = SETTLE_PASSES;
+        app.timeline_still = 2;
+        let mut changed = geometry(&app).surface;
+        changed.viewport = Some(egui::vec2(1024.0, 768.0));
+        app.capture_geometry = Some(CaptureGeometry { surface: changed, ..geometry(&app) });
+        app.capture_epoch += 1;
+        issue(&mut app, &ctx);
+        assert_eq!(app.shots.requests.len(), 1);
+        assert_eq!(app.shots.requests[0].expected, [1024, 768]);
+        assert!(!app.shots.requests[0].issued, "the retry waits for its own settling passes");
+    }
+
+    /// When a resize pushes both queued shots over the aggregate budget, each is rejected with
+    /// its own token and removal of the first cannot shift the second's index.
+    #[test]
+    fn mixed_order_geometry_failures_reject_every_shot_without_shifting_indices() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let (rx0, token0) = admit_one(&mut app, &ctx);
+        let (rx1, token1) = admit_one(&mut app, &ctx);
+        for shot in &mut app.shots.requests {
+            shot.ready_at = Instant::now() - Duration::from_millis(1);
+            shot.frames = SETTLE_PASSES;
+        }
+        app.timeline_still = 2;
+        // A resize makes both queued shots need more crop/encode buffers than the aggregate
+        // budget, so the geometry retry fails for the last shot first.
+        app.capture_geometry = Some(CaptureGeometry {
+            surface: SurfaceGeometry {
+                viewport: Some(vec2(8000.0, 4000.0)),
+                pixels_per_point: 1.0,
+                max_texture_side: 16384,
+                minimized: false,
+                occluded: false,
+            },
+            document: active_document(&app),
+            focus: None,
+        });
+        app.capture_epoch += 1;
+        issue(&mut app, &ctx);
+        assert!(app.shots.requests.is_empty(), "both failed shots were removed");
+        for (rx, token) in [(rx0, token0), (rx1, token1)] {
+            let reply = rx.try_recv().expect("each failed shot gets its own reply");
+            assert_eq!(reply["request"], token);
+            assert_eq!(reply["ok"], false, "{reply}");
+            assert!(reply["error"].as_str().unwrap_or_default().contains("aggregate"), "{reply}");
+        }
+    }
+}
diff --git a/crates/ui-egui/src/cjk.rs b/crates/ui-egui/src/cjk.rs
index bf089a2f6..0ead0b072 100644
--- a/crates/ui-egui/src/cjk.rs
+++ b/crates/ui-egui/src/cjk.rs
@@ -33,6 +33,9 @@ fn system_font() -> Option<Arc<FontData>> {
     FONT.get_or_init(|| find_system_font(SAMPLE, PREFERRED)).clone()
 }
 
+/// The font-data name of the installed Hangul face [`install`] appends to every family.
+pub(crate) const KOREAN_FACE: &str = "system-korean";
+
 fn korean_font() -> Option<Arc<FontData>> {
     static FONT: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
     FONT.get_or_init(|| find_system_font(KOREAN_SAMPLE, KOREAN_PREFERRED)).clone()
@@ -50,7 +53,7 @@ fn find_system_font(sample: &str, preferred: &[&str]) -> Option<Arc<FontData>> {
     let by_weight = |f: &&Arc<filmcraft_text::fonts::Face>| f.info.weight.abs_diff(400);
     let found = preferred.iter().find_map(|name| faces.iter().filter(|f| f.info.family.eq_ignore_ascii_case(name) && covers(f)).min_by_key(by_weight));
     let face = found.or_else(|| faces.iter().filter(|f| covers(f)).min_by_key(by_weight))?;
-    Some(Arc::new(FontData { font: std::borrow::Cow::Owned(face.data()?), index: face.info.index, tweak: Default::default() }))
+    Some(Arc::new(FontData::from_blob(Arc::new(face.data()?), face.info.index)))
 }
 
 /// Whether [`install`] has a Hangul face to add (an installed system face; none is bundled).
@@ -71,9 +74,9 @@ pub(crate) fn available() -> bool {
 pub(crate) fn install(fonts: &mut FontDefinitions) {
     install_chinese(fonts);
     if let Some(font) = korean_font() {
-        fonts.font_data.insert("system-korean".into(), font);
+        fonts.font_data.insert(KOREAN_FACE.into(), font);
         for stack in fonts.families.values_mut() {
-            stack.push("system-korean".into());
+            stack.push(KOREAN_FACE.into());
         }
     }
 }
@@ -100,3 +103,15 @@ fn install_chinese(fonts: &mut FontDefinitions) {
         stack.extend(order.iter().map(|f| name(f)));
     }
 }
+
+#[cfg(test)]
+mod font_blob_tests {
+    use super::*;
+
+    /// `FontData::from_blob` retains the TTC face index when constructed from a shared blob.
+    #[test]
+    fn a_ttc_face_index_survives_font_data_construction() {
+        let font = FontData::from_blob(Arc::new(vec![0u8; 4]), 7);
+        assert_eq!(font.index, 7, "the face index must travel with the shared blob");
+    }
+}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 3b5391125..f8bfc3944 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -25,6 +25,26 @@ use std::sync::mpsc::Sender;
 
 use serde_json::{Value, json};
 
+const MAX_CLICK_COUNT: u64 = 10;
+const MAX_DRAG_STEPS: u64 = 1_024;
+/// Synthetic input is consumed a step per frame; bound what a client can queue ahead of that.
+const MAX_SYNTHETIC_EVENTS: usize = 16_384;
+
+/// Read a pointer repetition count, using `default` when `key` is absent or null.
+///
+/// Reject non-integer, negative and above-`maximum` values; raise accepted counts to `minimum`.
+fn bounded_repetitions(params: &Value, key: &str, default: u64, minimum: u64, maximum: u64) -> Result<u64, String> {
+    // The MCP bridge serializes omitted optional counts as null.
+    let value = match params.get(key) {
+        None | Some(Value::Null) => default,
+        Some(value) => value.as_u64().ok_or_else(|| format!("`{key}` must be a non-negative integer"))?,
+    };
+    if value > maximum {
+        return Err(format!("`{key}` must not exceed {maximum}"));
+    }
+    Ok(value.max(minimum))
+}
+
 use crate::FilmcraftApp;
 use crate::dock::PanelKind;
 use crate::state::{Mode, PlaybackRes, ThumbnailMode, Tool};
@@ -53,7 +73,8 @@ pub enum Outcome {
     AfterInput,
     Screenshot {
         path: Option<String>,
-        crop: Option<[f32; 4]>,
+        /// Resolved to fresh geometry at issue time, not here.
+        crop: Option<crate::capture::CropTarget>,
     },
 }
 
@@ -96,9 +117,14 @@ fn point(app: &FilmcraftApp, p: &Value) -> Result<egui::Pos2, String> {
     Ok(egui::pos2(x as f32, y as f32))
 }
 
+/// Execute one control request. Synthetic input is capped by `MAX_SYNTHETIC_EVENTS` before queueing, screenshot crops stay symbolic until capture, and
+/// `gfxEdit` layer identity is resolved from the document.
 pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
     let p = &req.params;
     let s = |k: &str| p.get(k).and_then(Value::as_str);
+    if matches!(req.method.as_str(), "ui.click" | "ui.move" | "ui.drag" | "ui.scroll" | "ui.key" | "ui.type") && app.synthetic.len() >= MAX_SYNTHETIC_EVENTS {
+        return err("too many synthetic input events are queued; wait for the current input to be processed");
+    }
     match req.method.as_str() {
         "engine.execute" | "ui.menu.invoke" => {
             let Some(id) = s("command").or(s("id")) else { return err("missing `command`") };
@@ -114,6 +140,11 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
         },
         "ui.menu.list" => ok(serde_json::to_value(crate::menus::menu_items(app)).unwrap_or_default()),
         "ui.inspect" => ok(inspect(app, ctx)),
+        "ui.docking" => {
+            let hits = craft_ui::docking::DockArea::<PanelKind>::hit_rects(ctx, crate::dock_ui::area_id());
+            let hits: Vec<Value> = hits.iter().map(|(hit, r)| json!({"hit": hit, "rect": [r.left(), r.top(), r.width(), r.height()]})).collect();
+            ok(json!({"layout": app.ui.dock, "focused": app.ui.focused, "maximized": app.ui.keys.maximized, "hitRects": hits}))
+        }
         "perf.stats" => ok(crate::perf::stats(app)),
         "ui.elements" => {
             if app.timeline_still < 2 {
@@ -282,8 +313,48 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
             }
             // the Type tool's text editing state: {"clip", "layer", "caret", "anchor"} (byte offsets) or null
             if let Some(v) = p.get("gfxEdit") {
-                match serde_json::from_value(v.clone()) {
-                    Ok(e) => app.ui.gfx_edit = e,
+                match serde_json::from_value::<Option<crate::state::GfxEdit>>(v.clone()) {
+                    Ok(mut e) => {
+                        // An explicit `ui.set.gfxEdit {clip, layer}` names the layer currently at
+                        // that index. Resolve its identity from the document instead of inheriting
+                        // a stale uid/fingerprint from a previous edit session: after a reorder,
+                        // delete or undo the requested index may now hold a different layer.
+                        if let Some(new) = e.as_mut() {
+                            match crate::panels::graphics::current_layer_identity(&app.session, new.clip, new.layer) {
+                                Some((uid, fingerprint)) => {
+                                    new.uid = uid;
+                                    new.fingerprint = fingerprint;
+                                }
+                                None => {
+                                    new.uid = 0;
+                                    new.fingerprint = 0;
+                                }
+                            }
+                        }
+                        let changed = match (&app.ui.gfx_edit, &e) {
+                            (None, None) => false,
+                            (Some(old), Some(new)) => {
+                                // A stable uid is the owner key. The compact fingerprint only
+                                // decides identity for a uid-less layer, and zero there means
+                                // "the requested index" rather than a different owner.
+                                old.clip != new.clip
+                                    || old.layer != new.layer
+                                    || old.uid != new.uid
+                                    || (new.uid == 0 && old.fingerprint != 0 && old.fingerprint != new.fingerprint)
+                            }
+                            _ => true,
+                        };
+                        if changed {
+                            app.restart_ime_target();
+                        } else if let (Some(old), Some(new)) = (&app.ui.gfx_edit, &e)
+                            && (old.caret, old.anchor) != (new.caret, new.anchor)
+                        {
+                            // Caret is not part of the stable owner. Only a known composition
+                            // becomes stale; commit-only input without one remains eligible.
+                            app.invalidate_ime_composition();
+                        }
+                        app.ui.gfx_edit = e;
+                    }
                     Err(e) => return err(format!("`gfxEdit`: {e}")),
                 }
             }
@@ -320,6 +391,15 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
                 Err(e) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
                 Err(e) => return err(e),
             };
+            // validate before queuing anything, so a refused count leaves no modifier held
+            let count = if req.method == "ui.click" {
+                match bounded_repetitions(p, "count", 1, 0, MAX_CLICK_COUNT) {
+                    Ok(count) => count,
+                    Err(error) => return err(error),
+                }
+            } else {
+                0
+            };
             let m = modifiers(p);
             app.synthetic.push(egui::Event::ModifiersChanged(m));
             app.synthetic.push(egui::Event::PointerMoved(pos));
@@ -329,7 +409,6 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
                     Some("middle") => egui::PointerButton::Middle,
                     _ => egui::PointerButton::Primary,
                 };
-                let count = p.get("count").and_then(Value::as_u64).unwrap_or(1);
                 for _ in 0..count {
                     app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: true, modifiers: m });
                     app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: m });
@@ -345,7 +424,10 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
                 (Err(e), _) | (_, Err(e)) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
                 (Err(e), _) | (_, Err(e)) => return err(e),
             };
-            let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(12).max(2);
+            let steps = match bounded_repetitions(p, "steps", 12, 2, MAX_DRAG_STEPS) {
+                Ok(steps) => steps,
+                Err(error) => return err(error),
+            };
             let m = modifiers(p);
             app.synthetic.push(egui::Event::ModifiersChanged(m));
             app.synthetic.push(egui::Event::PointerMoved(a));
@@ -369,6 +451,7 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
             app.synthetic.push(egui::Event::PointerMoved(pos));
             app.synthetic.push(egui::Event::MouseWheel {
                 unit: egui::MouseWheelUnit::Point,
+                source: egui::MouseWheelSource::Wheel,
                 delta: egui::vec2(dx, dy),
                 modifiers: modifiers(p),
                 phase: egui::TouchPhase::Move,
@@ -422,8 +505,14 @@ pub fn handle(app: &mut FilmcraftApp, ctx: &egui::Context, req: &ControlRequest)
             ok(json!({"playing": app.playback.playing, "playhead": app.session.playhead().0}))
         }
         "ui.screenshot" => {
-            let crop = s("panel").and_then(PanelKind::from_name).and_then(|pk| app.auto.find(&format!("panel.{}", pk.id())).map(|e| e.rect));
-            let crop = crop.or_else(|| s("id").and_then(|id| app.auto.find(id).map(|e| e.rect)));
+            // Keep the target symbolic: the crop must come from the layout that is actually
+            // captured, not from whatever the registry held when this control request arrived.
+            let crop = if let Some(panel) = s("panel") {
+                let Some(pk) = PanelKind::from_name(panel) else { return err(format!("unknown panel `{panel}`")) };
+                Some(crate::capture::CropTarget::Element(format!("panel.{}", pk.id())))
+            } else {
+                s("id").map(|id| crate::capture::CropTarget::Element(id.to_string()))
+            };
             // Bring the window on screen so a frame is presented, without taking keyboard focus.
             app.raise_for_control(ctx);
             Outcome::Screenshot { path: s("path").map(str::to_string), crop }
@@ -487,10 +576,11 @@ fn merge(v: &mut Value, patch: &Value) {
     }
 }
 
+/// Read-only JSON snapshot; focus and element counts come from the current accepted registry pass.
 pub fn inspect(app: &FilmcraftApp, ctx: &egui::Context) -> Value {
     let size = ctx.content_rect().size();
     let keyboard_focus = ctx.memory(|memory| memory.focused()).map(|id| {
-        let elements: Vec<_> = app.auto.previous.iter().filter(|element| element.response_id == Some(id)).collect();
+        let elements: Vec<_> = app.auto.all().iter().filter(|element| element.response_id == Some(id)).collect();
         json!({
             "widgetId": format!("{:016x}", id.value()),
             "elementIds": elements.iter().map(|element| element.id.as_str()).collect::<Vec<_>>(),
@@ -511,24 +601,53 @@ pub fn inspect(app: &FilmcraftApp, ctx: &egui::Context) -> Value {
         "playhead": app.session.playhead().0,
         "activeSequence": app.session.state.active_sequence.map(|i| i.0),
         "selection": app.session.state.selection.iter().map(|c| c.0).collect::<Vec<_>>(),
-        "elements": app.auto.previous.len(),
+        "elements": app.auto.all().len(),
         "dialog": app.dialog.map(|d| format!("{d:?}")),
     })
 }
 
 /// Save a screenshot (optionally cropped to a rect in points) as PNG; returns the reply JSON.
 pub fn save_screenshot(ctx: &egui::Context, image: &egui::ColorImage, path: Option<&str>, crop: Option<[f32; 4]>) -> Value {
-    let ppp = ctx.pixels_per_point();
-    let [w, h] = image.size;
-    let (x0, y0, cw, ch) = match crop {
-        Some([x, y, cw, ch]) => {
-            let x0 = ((x * ppp) as usize).min(w);
-            let y0 = ((y * ppp) as usize).min(h);
-            (x0, y0, ((cw * ppp) as usize).min(w - x0), ((ch * ppp) as usize).min(h - y0))
-        }
-        None => (0, 0, w, h),
+    save_screenshot_with_ppp(image, path, crop, ctx.pixels_per_point())
+}
+
+/// Intersect a crop rectangle in points with the captured image, converting through `ppp`.
+///
+/// Negative origins are clipped to the image rather than saturated while keeping the requested
+/// width, which would shift the captured region. A crop that does not overlap the image (or has a
+/// non-finite or non-positive size) is refused instead of returning a zero-sized or wrong image.
+fn crop_pixels(size: [usize; 2], crop: Option<[f32; 4]>, ppp: f32) -> Result<(usize, usize, usize, usize), String> {
+    let [w, h] = size;
+    let Some([x, y, cw, ch]) = crop else { return Ok((0, 0, w, h)) };
+    if !(x.is_finite() && y.is_finite() && cw.is_finite() && ch.is_finite()) || cw <= 0.0 || ch <= 0.0 {
+        return Err("screenshot crop must be a finite rectangle with positive width and height".into());
+    }
+    let ppp = f64::from(ppp);
+    let clamp = |v: f64, max: usize| v.max(0.0).min(max as f64);
+    let x0 = clamp(f64::from(x) * ppp, w).floor() as usize;
+    let y0 = clamp(f64::from(y) * ppp, h).floor() as usize;
+    let x1 = clamp((f64::from(x) + f64::from(cw)) * ppp, w).ceil() as usize;
+    let y1 = clamp((f64::from(y) + f64::from(ch)) * ppp, h).ceil() as usize;
+    let (cw, ch) = (x1.saturating_sub(x0), y1.saturating_sub(y0));
+    if cw == 0 || ch == 0 {
+        return Err("screenshot crop does not intersect the image".into());
+    }
+    Ok((x0, y0, cw, ch))
+}
+
+/// Save a screenshot whose scale was captured with the request. Hidden logic ticks must not read
+/// `Context::pixels_per_point()` for an image produced from a different UI pass.
+pub fn save_screenshot_with_ppp(image: &egui::ColorImage, path: Option<&str>, crop: Option<[f32; 4]>, ppp: f32) -> Value {
+    let ppp = if ppp.is_finite() && ppp > 0.0 { ppp } else { 1.0 };
+    let (x0, y0, cw, ch) = match crop_pixels(image.size, crop, ppp) {
+        Ok(rect) => rect,
+        Err(e) => return json!({"ok": false, "error": e}),
     };
-    let mut rgba = Vec::with_capacity(cw * ch * 4);
+    let [w, _] = image.size;
+    let Some(capacity) = cw.checked_mul(ch).and_then(|pixels| pixels.checked_mul(std::mem::size_of::<egui::Color32>())) else {
+        return json!({"ok": false, "error": "screenshot crop size overflows the image buffer"});
+    };
+    let mut rgba = Vec::with_capacity(capacity);
     for y in y0..y0 + ch {
         for x in x0..x0 + cw {
             let c = image.pixels[y * w + x];
@@ -589,7 +708,12 @@ pub fn encode_png(rgba: &[u8], w: u32, h: u32) -> Result<Vec<u8>, String> {
         }
         !c
     }
-    let mut raw = Vec::with_capacity((w as usize * 4 + 1) * h as usize);
+    let row = (w as usize)
+        .checked_mul(4)
+        .and_then(|bytes| bytes.checked_add(1))
+        .and_then(|bytes| bytes.checked_mul(h as usize))
+        .ok_or_else(|| "PNG size overflows the image buffer".to_string())?;
+    let mut raw = Vec::with_capacity(row);
     for y in 0..h as usize {
         raw.push(0);
         raw.extend_from_slice(&rgba[y * w as usize * 4..(y + 1) * w as usize * 4]);
@@ -620,12 +744,154 @@ pub fn encode_png(rgba: &[u8], w: u32, h: u32) -> Result<Vec<u8>, String> {
     Ok(out)
 }
 
+#[cfg(test)]
+mod input_bounds_tests {
+    use super::*;
+
+    /// Create an empty editor session for inspecting queued synthetic input without a window.
+    fn app() -> FilmcraftApp {
+        FilmcraftApp::new(filmcraft_engine::Session::default())
+    }
+
+    /// Dispatch a control request and fail the test if hostile parameters cause a panic.
+    fn request(app: &mut FilmcraftApp, method: &str, params: Value) -> Outcome {
+        let (req, _) = ControlRequest::new(method, params);
+        std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| handle(app, &egui::Context::default(), &req)))
+            .expect("hostile control parameters must not panic")
+    }
+
+    /// Require an immediate error naming `field`, with all previously queued input unchanged.
+    fn assert_rejected(app: &mut FilmcraftApp, method: &str, params: Value, field: &str) {
+        let before = app.synthetic.clone();
+        let Outcome::Done(reply) = request(app, method, params) else { panic!("invalid input must return an error immediately") };
+        assert_eq!(reply["ok"], false);
+        assert!(reply["error"].as_str().unwrap().contains(field), "{reply}");
+        assert_eq!(app.synthetic, before, "rejection must not queue partial input or change existing input");
+    }
+
+    /// Check the first rejected click count without allocating an enormous event queue.
+    #[test]
+    fn click_count_above_limit_is_rejected() {
+        // A small boundary value reproduces the missing guard without exhausting memory.
+        assert_rejected(&mut app(), "ui.click", json!({"x": 10, "y": 20, "count": 11}), "count");
+    }
+
+    /// Check that one step above the drag limit returns an error before queuing input.
+    #[test]
+    fn drag_steps_above_limit_are_rejected() {
+        assert_rejected(&mut app(), "ui.drag", json!({"from": {"x": 0, "y": 0}, "to": {"x": 10, "y": 20}, "steps": 1025}), "steps");
+    }
+
+    /// Reject extreme counts and malformed types while preserving pending and subsequent input.
+    #[test]
+    fn hostile_counts_and_steps_leave_pending_input_unchanged() {
+        let mut app = app();
+        app.synthetic.push(egui::Event::PointerGone);
+        for value in [json!(u32::MAX), json!(u64::MAX), json!(-1), json!(1.5), json!("2"), json!(true), json!([]), json!({})] {
+            assert_rejected(&mut app, "ui.click", json!({"x": 10, "y": 20, "count": value}), "count");
+            assert_rejected(&mut app, "ui.drag", json!({"from": {"x": 0, "y": 0}, "to": {"x": 10, "y": 20}, "steps": value}), "steps");
+        }
+        // A rejected request must not prevent subsequent valid input.
+        assert!(matches!(request(&mut app, "ui.click", json!({"x": 10, "y": 20})), Outcome::AfterInput));
+    }
+
+    /// Verify missing/null defaults, accepted click bounds, button pairs and modifier resets.
+    #[test]
+    fn valid_click_counts_preserve_button_pairs_and_modifiers() {
+        let mut app = app();
+        let pos = egui::pos2(10.0, 20.0);
+        let modifiers = egui::Modifiers { shift: true, ..Default::default() };
+        for (value, count) in [(None, 1), (Some(Value::Null), 1), (Some(json!(0)), 0), (Some(json!(1)), 1), (Some(json!(2)), 2), (Some(json!(10)), 10)] {
+            app.synthetic.clear();
+            let mut params = json!({"x": 10, "y": 20, "button": "right", "modifiers": {"shift": true}});
+            if let Some(v) = value {
+                params["count"] = v;
+            }
+            assert!(matches!(request(&mut app, "ui.click", params), Outcome::AfterInput));
+            let mut expected = vec![egui::Event::ModifiersChanged(modifiers), egui::Event::PointerMoved(pos)];
+            for _ in 0..count {
+                for pressed in [true, false] {
+                    expected.push(egui::Event::PointerButton { pos, button: egui::PointerButton::Secondary, pressed, modifiers });
+                }
+            }
+            expected.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+            assert_eq!(app.synthetic, expected);
+        }
+        app.synthetic.clear();
+        assert!(matches!(request(&mut app, "ui.move", json!({"x": 10, "y": 20, "count": u64::MAX})), Outcome::AfterInput));
+        assert_eq!(app.synthetic.len(), 3, "ui.move does not use count");
+    }
+
+    /// Verify missing/null defaults and accepted drag bounds retain endpoints and button release.
+    #[test]
+    fn valid_drag_steps_preserve_defaults_endpoints_and_release() {
+        let mut app = app();
+        for (value, steps) in [(None, 12), (Some(Value::Null), 12), (Some(json!(0)), 2), (Some(json!(1)), 2), (Some(json!(2)), 2), (Some(json!(1024)), 1024)] {
+            app.synthetic.clear();
+            let mut params = json!({"from": {"x": 0, "y": 0}, "to": {"x": 10, "y": 20}, "modifiers": {"shift": true}});
+            if let Some(v) = value {
+                params["steps"] = v;
+            }
+            assert!(matches!(request(&mut app, "ui.drag", params), Outcome::AfterInput));
+            assert_eq!(app.synthetic.len(), steps + 5);
+            let modifiers = egui::Modifiers { shift: true, ..Default::default() };
+            assert_eq!(app.synthetic[0], egui::Event::ModifiersChanged(modifiers));
+            assert_eq!(app.synthetic[1], egui::Event::PointerMoved(egui::pos2(0.0, 0.0)));
+            assert_eq!(
+                app.synthetic[2],
+                egui::Event::PointerButton { pos: egui::pos2(0.0, 0.0), button: egui::PointerButton::Primary, pressed: true, modifiers }
+            );
+            assert_eq!(app.synthetic[steps + 2], egui::Event::PointerMoved(egui::pos2(10.0, 20.0)));
+            assert_eq!(
+                app.synthetic[steps + 3],
+                egui::Event::PointerButton { pos: egui::pos2(10.0, 20.0), button: egui::PointerButton::Primary, pressed: false, modifiers }
+            );
+            assert_eq!(app.synthetic[steps + 4], egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+        }
+    }
+}
+
 #[cfg(test)]
 mod base64_tests {
+    use serde_json::json;
+
     #[test]
     fn rfc4648_vectors() {
         for (i, o) in [("", ""), ("f", "Zg=="), ("fo", "Zm8="), ("foo", "Zm9v"), ("foob", "Zm9vYg=="), ("fooba", "Zm9vYmE="), ("foobar", "Zm9vYmFy")] {
             assert_eq!(super::base64(i.as_bytes()), o);
         }
     }
+
+    /// Negative and overhanging panel origins clip to the visible image without shifting the requested region, at any scale.
+    #[test]
+    fn screenshot_crop_clips_negative_panel_origin() {
+        // A panel starting two points left of / one point above the window: only the visible
+        // 2×3 pixels are captured, not the requested 4×4 starting at (0, 0).
+        assert_eq!(super::crop_pixels([8, 8], Some([-2.0, -1.0, 4.0, 4.0]), 1.0).unwrap(), (0, 0, 2, 3));
+        // The same crop at 2× scale clips the same logical region to the pixel grid.
+        assert_eq!(super::crop_pixels([16, 16], Some([-2.0, -1.0, 4.0, 4.0]), 2.0).unwrap(), (0, 0, 4, 6));
+        // Partly outside on the right/bottom uses the visible remainder.
+        assert_eq!(super::crop_pixels([8, 8], Some([6.0, 5.0, 4.0, 4.0]), 1.0).unwrap(), (6, 5, 2, 3));
+    }
+
+    /// Crops with no overlap or a non-finite/non-positive size are refused, never rendered as a zero-sized image.
+    #[test]
+    fn screenshot_crop_outside_the_image_is_refused() {
+        for crop in [[-8.0, -8.0, 4.0, 4.0], [8.0, 0.0, 4.0, 4.0], [0.0, 9.0, 4.0, 4.0]] {
+            let err = super::crop_pixels([8, 8], Some(crop), 1.0).expect_err("a crop outside the image must be refused");
+            assert!(err.contains("does not intersect"), "{err}");
+        }
+        for crop in [[0.0, 0.0, 0.0, 4.0], [0.0, 0.0, -4.0, 4.0], [f32::NAN, 0.0, 4.0, 4.0], [0.0, 0.0, f32::INFINITY, 4.0]] {
+            let err = super::crop_pixels([8, 8], Some(crop), 1.0).expect_err("an invalid crop must be refused");
+            assert!(err.contains("finite rectangle"), "{err}");
+        }
+    }
+
+    #[test]
+    fn synthetic_event_repetition_is_bounded() {
+        assert_eq!(super::bounded_repetitions(&json!({}), "count", 1, 0, super::MAX_CLICK_COUNT).unwrap(), 1);
+        assert_eq!(super::bounded_repetitions(&json!({"steps": 1}), "steps", 12, 2, super::MAX_DRAG_STEPS).unwrap(), 2);
+        assert!(super::bounded_repetitions(&json!({"count": u64::MAX}), "count", 1, 0, super::MAX_CLICK_COUNT).is_err());
+        assert!(super::bounded_repetitions(&json!({"steps": "many"}), "steps", 12, 2, super::MAX_DRAG_STEPS).is_err());
+    }
 }
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/credits.rs
index c1976eb80..0fcc36cfe 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/credits.rs
@@ -231,7 +231,7 @@ const LIST_HEIGHT: f32 = 360.0;
 /// `about.credits.reverse`, `about.credits.grabBag`, `about.credits.table`,
 /// `about.credits.header.<n>` (table headers, by column).
 pub fn contributors_ui(ui: &mut egui::Ui, t: &Tokens, auto: &mut Registry) {
-    let id = egui::Id::new("credits_view");
+    let id = egui::Id::unique("credits_view");
     let mut v = ui.data_mut(|d| d.get_temp::<View>(id)).unwrap_or_default();
     ui.horizontal_wrapped(|ui| {
         ui.label(tl!("Show"));
diff --git a/crates/ui-egui/src/dock.rs b/crates/ui-egui/src/dock.rs
index d144bd57e..5c94516fd 100644
--- a/crates/ui-egui/src/dock.rs
+++ b/crates/ui-egui/src/dock.rs
@@ -1,11 +1,12 @@
-//! Premiere-style docking: a tree of splits and tab groups. Panels are rounded frames separated by
-//! thin gutters; each group has a tab strip (active tab bright, with a panel menu "≡"); the focused
-//! panel gets a blue outline. Gutters drag to resize; workspaces are serialized trees.
+//! FilmCraft's panels and workspaces. craft-ui's docking owns the frame tree, the tab strips,
+//! floating windows and gestures (`dock_ui.rs` draws it); this module names the
+//! panels, builds the built-in workspaces and draws the Timeline's sequence tabs.
 
 use egui::{Align2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
 use serde::{Deserialize, Serialize};
 
-use craft_ui::layout::{ResizeHandle, ResizeHandleStyle, SplitAxis, SplitSize as SharedSplitSize, split_rect};
+use craft_ui::docking::{Action, Floating, Node};
+use craft_ui::layout::{SplitAxis, SplitSize};
 
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
@@ -127,54 +128,21 @@ impl PanelKind {
             _ => None,
         }
     }
-    /// Narrow chrome-less panels (no tab strip; a slim grip instead).
-    pub fn compact(self) -> bool {
-        matches!(self, PanelKind::Tools | PanelKind::AudioMeters)
-    }
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
-pub enum SplitSize {
-    Ratio(f32),
-    /// First child has a fixed size in points.
-    FixedA(f32),
-    /// Second child has a fixed size in points.
-    FixedB(f32),
-}
+/// A FilmCraft panel arrangement: craft-ui's frame tree and floating windows.
+pub type Layout = craft_ui::docking::Layout<PanelKind>;
+/// What a saved workspace stores: its layout, closed panels and lock.
+pub type Workspace = craft_ui::docking::Workspace<PanelKind>;
 
-impl SplitSize {
-    fn shared(self) -> SharedSplitSize {
-        match self {
-            Self::Ratio(value) => SharedSplitSize::Ratio(value),
-            Self::FixedA(value) => SharedSplitSize::FixedFirst(value),
-            Self::FixedB(value) => SharedSplitSize::FixedSecond(value),
-        }
-    }
+fn tabs(p: &[PanelKind], active: usize) -> Node<PanelKind> {
+    Node::Tabs { panels: p.to_vec(), active }
 }
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub enum DockNode {
-    /// `vertical`: children stacked top/bottom; else side by side.
-    Split {
-        vertical: bool,
-        size: SplitSize,
-        a: Box<DockNode>,
-        b: Box<DockNode>,
-    },
-    Tabs {
-        panels: Vec<PanelKind>,
-        active: usize,
-    },
+fn hsplit(size: SplitSize, a: Node<PanelKind>, b: Node<PanelKind>) -> Node<PanelKind> {
+    Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(a), second: Box::new(b) }
 }
-
-fn tabs(p: &[PanelKind], active: usize) -> DockNode {
-    DockNode::Tabs { panels: p.to_vec(), active }
-}
-fn hsplit(size: SplitSize, a: DockNode, b: DockNode) -> DockNode {
-    DockNode::Split { vertical: false, size, a: Box::new(a), b: Box::new(b) }
-}
-fn vsplit(size: SplitSize, a: DockNode, b: DockNode) -> DockNode {
-    DockNode::Split { vertical: true, size, a: Box::new(a), b: Box::new(b) }
+fn vsplit(size: SplitSize, a: Node<PanelKind>, b: Node<PanelKind>) -> Node<PanelKind> {
+    Node::Split { axis: SplitAxis::Vertical, size, first: Box::new(a), second: Box::new(b) }
 }
 
 pub const WORKSPACES: [&str; 9] = ["Editing", "Assembly", "Color", "Effects", "Audio", "Captions and Graphics", "Learning", "Review", "All Panels"];
@@ -191,18 +159,34 @@ pub struct WorkspacePrefs {
     pub current: String,
 }
 
-/// A named layout. `layout` is a [`DockNode`] kept as JSON, so one unreadable entry (a panel a
-/// newer version added) doesn't lose the others.
+/// A named workspace. `workspace` is a craft-ui [`Workspace`] kept as JSON, so one unreadable
+/// entry (a panel a newer version added) doesn't lose the others. Files written before
+/// FilmCraft used craft-ui workspaces hold a frame tree in `layout` and floating groups in
+/// `floating` instead; [`saved_workspace`] reads them. [`SavedWorkspace::new`] writes
+/// `workspace`, and also `layout` and `floating` while every floating window is one tab
+/// group, so that earlier versions still open the workspace.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase", default)]
 pub struct SavedWorkspace {
     pub name: String,
+    #[serde(skip_serializing_if = "serde_json::Value::is_null")]
+    pub workspace: serde_json::Value,
+    #[serde(skip_serializing_if = "serde_json::Value::is_null")]
     pub layout: serde_json::Value,
-    /// Kept raw for the same per-workspace failure isolation as the dock tree.
-    #[serde(default, skip_serializing_if = "serde_json::Value::is_null")]
+    #[serde(skip_serializing_if = "serde_json::Value::is_null")]
     pub floating: serde_json::Value,
 }
 
+impl SavedWorkspace {
+    pub fn new(name: &str, layout: &Layout) -> Result<Self, String> {
+        let workspace = Workspace::new(layout.clone());
+        workspace.validate().map_err(|e| e.to_string())?;
+        let workspace = serde_json::to_value(&workspace).map_err(|e| e.to_string())?;
+        let (layout, floating) = legacy::write(layout).unwrap_or_default();
+        Ok(SavedWorkspace { name: name.to_string(), workspace, layout, floating })
+    }
+}
+
 impl WorkspacePrefs {
     pub fn load(path: &std::path::Path) -> Self {
         use std::io::Read as _;
@@ -254,64 +238,199 @@ pub fn find(prefs: &WorkspacePrefs, query: &str) -> Option<String> {
     names(prefs).into_iter().find(|n| slug(n) == slug(query))
 }
 
-/// The saved layout of a workspace: the user's saved version, else the built-in default.
-pub fn saved_layout(prefs: &WorkspacePrefs, name: &str) -> DockNode {
-    saved_docking(prefs, name).root
-}
-
-pub fn saved_docking(prefs: &WorkspacePrefs, name: &str) -> Layout {
+/// A workspace as saved: the user's saved version, else the built-in default. An entry that
+/// does not read or validate falls back to the default and stays in the file untouched.
+pub fn saved_workspace(prefs: &WorkspacePrefs, name: &str) -> Workspace {
     let saved = prefs.saved.iter().find(|saved| saved.name == name).and_then(|saved| {
-        let mut layout = Layout {
-            root: serde_json::from_value(saved.layout.clone()).ok()?,
-            floating: if saved.floating.is_null() { vec![] } else { serde_json::from_value(saved.floating.clone()).ok()? },
+        let workspace = if saved.workspace.is_null() {
+            Workspace::new(legacy::layout(&saved.layout, &saved.floating)?)
+        } else {
+            serde_json::from_value::<Workspace>(saved.workspace.clone()).ok()?
         };
-        if layout.floating.is_empty() {
-            migrate_legacy_effects(&mut layout.root);
-        }
-        layout.validate().ok().map(|()| layout)
+        workspace.validate().ok()?;
+        Some(workspace)
     });
-    saved.unwrap_or_else(|| Layout { root: workspace(name), floating: vec![] })
+    saved.unwrap_or_else(|| Workspace::new(workspace(name)))
 }
 
-/// Older Effects workspaces stored the same Effect Controls panel twice: selected beside
-/// Source, and an inactive duplicate beside Essential Graphics. Remove only that known
-/// duplicate shape; unrelated malformed or ambiguous saved layouts still fail validation.
-fn migrate_legacy_effects(root: &mut DockNode) {
-    let Ok(shared) = crate::dock_shared::encode(root, &[]) else { return };
-    if shared.panels().iter().filter(|panel| ***panel == PanelKind::EffectControls).count() != 2 {
-        return;
+/// The saved layout of a workspace (see [`saved_workspace`]).
+pub fn saved_docking(prefs: &WorkspacePrefs, name: &str) -> Layout {
+    saved_workspace(prefs, name).layout
+}
+
+/// The frame tree and floating groups FilmCraft wrote before its workspaces were craft-ui
+/// [`Workspace`]s.
+mod legacy {
+    use super::{Floating, Layout, Node, PanelKind, SplitAxis, SplitSize};
+    use serde::{Deserialize, Serialize};
+
+    const MAX_DEPTH: usize = 32;
+
+    #[derive(Deserialize, Serialize)]
+    enum Tree {
+        /// `vertical`: children stacked top/bottom; else side by side.
+        Split {
+            vertical: bool,
+            size: Size,
+            a: Box<Tree>,
+            b: Box<Tree>,
+        },
+        Tabs {
+            panels: Vec<PanelKind>,
+            active: usize,
+        },
     }
-    fn selected_source(node: &DockNode) -> bool {
-        match node {
-            DockNode::Tabs { panels, active } => {
-                panels.contains(&PanelKind::Source) && panels.contains(&PanelKind::AudioClipMixer) && panels.get(*active) == Some(&PanelKind::EffectControls)
-            }
-            DockNode::Split { a, b, .. } => selected_source(a) || selected_source(b),
+
+    #[derive(Deserialize, Serialize)]
+    enum Size {
+        Ratio(f32),
+        FixedA(f32),
+        FixedB(f32),
+    }
+
+    #[derive(Deserialize, Serialize)]
+    struct Group {
+        panels: Vec<PanelKind>,
+        active: usize,
+        rect: [f32; 4],
+    }
+
+    fn node(tree: Tree, depth: usize) -> Option<Node<PanelKind>> {
+        if depth > MAX_DEPTH {
+            return None;
         }
+        Some(match tree {
+            Tree::Tabs { panels, active } => Node::Tabs { panels, active },
+            Tree::Split { vertical, size, a, b } => Node::Split {
+                axis: if vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal },
+                size: match size {
+                    Size::Ratio(value) => SplitSize::Ratio(value),
+                    Size::FixedA(value) => SplitSize::FixedFirst(value),
+                    Size::FixedB(value) => SplitSize::FixedSecond(value),
+                },
+                first: Box::new(node(*a, depth + 1)?),
+                second: Box::new(node(*b, depth + 1)?),
+            },
+        })
     }
-    fn remove_inactive(node: &mut DockNode) {
-        match node {
-            DockNode::Tabs { panels, active } if panels.as_slice() == [PanelKind::EffectControls, PanelKind::EssentialGraphics] && *active == 1 => {
-                panels.remove(0);
-                *active = 0;
-            }
-            DockNode::Split { a, b, .. } => {
-                remove_inactive(a);
-                remove_inactive(b);
-            }
-            DockNode::Tabs { .. } => {}
+
+    fn tree(node: &Node<PanelKind>, depth: usize) -> Option<Tree> {
+        if depth > MAX_DEPTH {
+            return None;
         }
+        Some(match node {
+            Node::Tabs { panels, active } => Tree::Tabs { panels: panels.clone(), active: *active },
+            Node::Split { axis, size, first, second } => Tree::Split {
+                vertical: *axis == SplitAxis::Vertical,
+                size: match *size {
+                    SplitSize::Ratio(value) => Size::Ratio(value),
+                    SplitSize::FixedFirst(value) => Size::FixedA(value),
+                    SplitSize::FixedSecond(value) => Size::FixedB(value),
+                },
+                a: Box::new(tree(first, depth + 1)?),
+                b: Box::new(tree(second, depth + 1)?),
+            },
+            _ => return None,
+        })
     }
-    if selected_source(root) {
-        remove_inactive(root);
+
+    /// `layout` as the `layout` and `floating` fields earlier versions read; `None` when a
+    /// floating window holds more than one tab group, which they can't represent.
+    pub(super) fn write(layout: &Layout) -> Option<(serde_json::Value, serde_json::Value)> {
+        let root = match &layout.root {
+            Some(root) => tree(root, 0)?,
+            None => Tree::Tabs { panels: Vec::new(), active: 0 },
+        };
+        let floating = layout
+            .floating
+            .iter()
+            .map(|window| match &window.root {
+                Node::Tabs { panels, active } => Some(Group { panels: panels.clone(), active: *active, rect: window.rect }),
+                _ => None,
+            })
+            .collect::<Option<Vec<_>>>()?;
+        let floating = if floating.is_empty() { serde_json::Value::Null } else { serde_json::to_value(floating).ok()? };
+        Some((serde_json::to_value(root).ok()?, floating))
+    }
+
+    pub(super) fn layout(root: &serde_json::Value, floating: &serde_json::Value) -> Option<Layout> {
+        let tree: Tree = serde_json::from_value(root.clone()).ok()?;
+        let floating: Vec<Group> = if floating.is_null() { vec![] } else { serde_json::from_value(floating.clone()).ok()? };
+        let mut root = match node(tree, 0)? {
+            Node::Tabs { panels, .. } if panels.is_empty() => None,
+            root => Some(root),
+        };
+        if floating.is_empty()
+            && let Some(root) = root.as_mut()
+        {
+            migrate_effects(root);
+        }
+        Some(Layout { root, floating: floating.into_iter().map(|group| Floating::single(group.panels, group.active, group.rect)).collect() })
+    }
+
+    /// Effects workspaces saved by early versions held the Effect Controls panel twice: selected
+    /// beside Source, and an inactive duplicate beside Essential Graphics. Remove only that known
+    /// duplicate shape; other malformed saved layouts still fail validation.
+    fn migrate_effects(root: &mut Node<PanelKind>) {
+        fn count(node: &Node<PanelKind>) -> usize {
+            match node {
+                Node::Tabs { panels, .. } => panels.iter().filter(|panel| **panel == PanelKind::EffectControls).count(),
+                Node::Split { first, second, .. } => count(first) + count(second),
+                _ => 0,
+            }
+        }
+        fn selected_source(node: &Node<PanelKind>) -> bool {
+            match node {
+                Node::Tabs { panels, active } => {
+                    panels.contains(&PanelKind::Source)
+                        && panels.contains(&PanelKind::AudioClipMixer)
+                        && panels.get(*active) == Some(&PanelKind::EffectControls)
+                }
+                Node::Split { first, second, .. } => selected_source(first) || selected_source(second),
+                _ => false,
+            }
+        }
+        fn remove_inactive(node: &mut Node<PanelKind>) {
+            match node {
+                Node::Tabs { panels, active } if panels.as_slice() == [PanelKind::EffectControls, PanelKind::EssentialGraphics] && *active == 1 => {
+                    panels.remove(0);
+                    *active = 0;
+                }
+                Node::Split { first, second, .. } => {
+                    remove_inactive(first);
+                    remove_inactive(second);
+                }
+                _ => {}
+            }
+        }
+        if count(root) == 2 && selected_source(root) {
+            remove_inactive(root);
+        }
     }
 }
 
+/// The width of the Tools panel in the built-in workspaces, in points.
+const TOOLS_WIDTH: f32 = 64.0;
+/// The width of the Audio Meters in the built-in workspaces, in points.
+const METERS_WIDTH: f32 = 116.0;
+
 /// The default layout of a named workspace.
-pub fn workspace(name: &str) -> DockNode {
+pub fn workspace(name: &str) -> Layout {
+    Layout { root: Some(workspace_root(name)), floating: vec![] }
+}
+
+fn workspace_root(name: &str) -> Node<PanelKind> {
     use PanelKind::*;
-    use SplitSize::*;
-    let bottom_editing = || hsplit(FixedA(64.0), tabs(&[Tools], 0), hsplit(FixedB(116.0), tabs(&[Timeline], 0), tabs(&[AudioMeters], 0)));
+    use SplitSize::Ratio;
+    // Tools | Timeline | Audio Meters. Tools and the meters keep their widths as the window
+    // resizes; the Timeline takes the rest.
+    let bottom_editing = || {
+        hsplit(
+            SplitSize::FixedFirst(TOOLS_WIDTH),
+            tabs(&[Tools], 0),
+            hsplit(SplitSize::FixedSecond(METERS_WIDTH), tabs(&[Timeline], 0), tabs(&[AudioMeters], 0)),
+        )
+    };
     match name {
         "Assembly" => vsplit(
             Ratio(0.52),
@@ -323,7 +442,7 @@ pub fn workspace(name: &str) -> DockNode {
             bottom_editing(),
         ),
         "Color" => hsplit(
-            FixedB(340.0),
+            Ratio(0.79),
             vsplit(
                 Ratio(0.58),
                 hsplit(Ratio(0.42), tabs(&[LumetriScopes, Source, EffectControls], 0), tabs(&[Program], 0)),
@@ -332,7 +451,7 @@ pub fn workspace(name: &str) -> DockNode {
             tabs(&[LumetriColor, Effects], 0),
         ),
         "Effects" => hsplit(
-            FixedB(320.0),
+            Ratio(0.8),
             vsplit(
                 Ratio(0.5),
                 hsplit(Ratio(0.5), tabs(&[Source, EffectControls, AudioClipMixer], 1), tabs(&[Program], 0)),
@@ -341,7 +460,7 @@ pub fn workspace(name: &str) -> DockNode {
             vsplit(Ratio(0.5), tabs(&[Effects], 0), tabs(&[EssentialGraphics], 0)),
         ),
         "Audio" => hsplit(
-            FixedB(320.0),
+            Ratio(0.8),
             vsplit(
                 Ratio(0.5),
                 hsplit(Ratio(0.5), tabs(&[AudioTrackMixer, Source, AudioClipMixer, EffectControls], 0), tabs(&[Program], 0)),
@@ -350,7 +469,7 @@ pub fn workspace(name: &str) -> DockNode {
             tabs(&[EssentialSound, TextToSpeech], 0),
         ),
         "Captions and Graphics" => hsplit(
-            FixedB(330.0),
+            Ratio(0.79),
             vsplit(
                 Ratio(0.5),
                 hsplit(Ratio(0.4), tabs(&[Text, Source, EffectControls], 0), tabs(&[Program], 0)),
@@ -372,200 +491,89 @@ pub fn workspace(name: &str) -> DockNode {
         _ => vsplit(
             Ratio(0.57),
             hsplit(
-                FixedB(450.0),
+                Ratio(0.72),
                 hsplit(Ratio(0.5), tabs(&[Source, EffectControls, AudioClipMixer, Metadata], 0), tabs(&[Program], 0)),
                 tabs(&[Properties, EssentialGraphics, Text], 0),
             ),
-            hsplit(
-                Ratio(0.29),
-                tabs(&[Project, MediaBrowser, Libraries, Info, Effects, Markers, History], 0),
-                hsplit(FixedA(64.0), tabs(&[Tools], 0), hsplit(FixedB(116.0), tabs(&[Timeline], 0), tabs(&[AudioMeters], 0))),
-            ),
+            hsplit(Ratio(0.29), tabs(&[Project, MediaBrowser, Libraries, Info, Effects, Markers, History], 0), bottom_editing()),
         ),
     }
 }
 
-impl DockNode {
-    /// Every panel in the tree.
-    pub fn panels(&self, out: &mut Vec<PanelKind>) {
-        match self {
-            DockNode::Split { a, b, .. } => {
-                a.panels(out);
-                b.panels(out);
-            }
-            DockNode::Tabs { panels, .. } => out.extend(panels.iter().copied()),
-        }
-    }
-    pub fn contains(&self, p: PanelKind) -> bool {
-        let mut v = Vec::new();
-        self.panels(&mut v);
-        v.contains(&p)
-    }
-    /// Make `p` the active tab of its group. Returns false if not present.
-    pub fn activate(&mut self, p: PanelKind) -> bool {
-        crate::dock_shared::apply_tree(self, craft_ui::docking::Action::Activate { panel: p })
-    }
-    pub fn is_visible(&self, p: PanelKind) -> bool {
-        match self {
-            DockNode::Split { a, b, .. } => a.is_visible(p) || b.is_visible(p),
-            DockNode::Tabs { panels, active } => panels.get(*active) == Some(&p),
-        }
-    }
-    /// Close a panel (remove its tab; empty groups collapse their split).
-    pub fn close(&mut self, p: PanelKind) {
-        crate::dock_shared::apply_tree(self, craft_ui::docking::Action::Close { panel: p });
-    }
+/// FilmCraft's queries and changes on a [`Layout`] beyond craft-ui's actions.
+pub trait LayoutExt {
+    /// Whether `panel` is the shown tab of its frame or floating window.
+    fn is_visible(&self, panel: PanelKind) -> bool;
+    /// Whether `panel` is in the frame tree, not a floating window.
+    fn is_docked(&self, panel: PanelKind) -> bool;
+    /// The shown panel of each frame in layout order, then of each floating window.
+    fn visible_panels(&self) -> Vec<PanelKind>;
     /// Put the Timeline panel back where the workspaces keep it (left of the audio meters) after
     /// it was closed, so opening a sequence always has somewhere to show it.
-    pub fn restore_timeline(&mut self) {
-        if self.contains(PanelKind::Timeline) {
-            return;
-        }
-        fn beside_meters(n: &mut DockNode) -> bool {
-            match n {
-                DockNode::Split { a, b, .. } => beside_meters(a) || beside_meters(b),
-                DockNode::Tabs { panels, .. } if panels.as_slice() == [PanelKind::AudioMeters] => {
-                    *n = hsplit(SplitSize::FixedB(116.0), tabs(&[PanelKind::Timeline], 0), tabs(&[PanelKind::AudioMeters], 0));
-                    true
+    fn restore_timeline(&mut self);
+    /// Add a panel as a tab next to `near` (else Project, Program or the first docked panel).
+    fn open_near(&mut self, panel: PanelKind, near: PanelKind);
+}
+
+impl LayoutExt for Layout {
+    fn is_visible(&self, panel: PanelKind) -> bool {
+        self.panel_state(&panel) == craft_ui::docking::PanelState::Front
+    }
+
+    fn is_docked(&self, panel: PanelKind) -> bool {
+        Layout { root: self.root.clone(), floating: vec![] }.contains(&panel)
+    }
+
+    fn visible_panels(&self) -> Vec<PanelKind> {
+        fn walk(node: &Node<PanelKind>, out: &mut Vec<PanelKind>) {
+            match node {
+                Node::Tabs { panels, active } => out.extend(panels.get(*active).copied()),
+                Node::Split { first, second, .. } => {
+                    walk(first, out);
+                    walk(second, out);
                 }
-                DockNode::Tabs { .. } => false,
+                _ => {}
             }
         }
-        if !beside_meters(self) {
+        let mut out = Vec::new();
+        if let Some(root) = &self.root {
+            walk(root, &mut out);
+        }
+        for window in &self.floating {
+            walk(&window.root, &mut out);
+        }
+        out
+    }
+
+    fn restore_timeline(&mut self) {
+        if self.contains(&PanelKind::Timeline) {
+            return;
+        }
+        fn beside_meters(n: &mut Node<PanelKind>) -> bool {
+            match n {
+                Node::Split { first, second, .. } => beside_meters(first) || beside_meters(second),
+                Node::Tabs { panels, .. } if panels.as_slice() == [PanelKind::AudioMeters] => {
+                    *n = hsplit(SplitSize::FixedSecond(METERS_WIDTH), tabs(&[PanelKind::Timeline], 0), tabs(&[PanelKind::AudioMeters], 0));
+                    true
+                }
+                _ => false,
+            }
+        }
+        if !self.root.as_mut().is_some_and(beside_meters) {
             self.open_near(PanelKind::Timeline, PanelKind::Project);
         }
     }
-    /// Add a panel as a tab next to `near` (or into the first group).
-    pub fn open_near(&mut self, p: PanelKind, near: PanelKind) {
-        if crate::dock_shared::encode(self, &[]).is_err() {
-            return;
-        }
-        let anchor = [near, PanelKind::Project, PanelKind::Program].into_iter().find(|panel| self.contains(*panel)).or_else(|| {
-            let mut panels = Vec::new();
-            self.panels(&mut panels);
-            panels.first().copied()
-        });
-        crate::dock_shared::apply_tree(self, craft_ui::docking::Action::Open { panel: p, anchor });
+
+    fn open_near(&mut self, panel: PanelKind, near: PanelKind) {
+        let docked = Layout { root: self.root.clone(), floating: vec![] };
+        let anchor = [near, PanelKind::Project, PanelKind::Program]
+            .into_iter()
+            .find(|candidate| docked.contains(candidate))
+            .or_else(|| docked.panels().first().map(|first| **first));
+        let _ = self.apply(Action::Open { panel, anchor });
     }
 }
 
-/// A floating group retains the same panel identities as docked tabs.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Floating {
-    pub panels: Vec<PanelKind>,
-    pub active: usize,
-    /// [x, y, width, height] in logical points.
-    pub rect: [f32; 4],
-}
-
-/// App persistence shape; all mutations pass through the shared docking model.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Layout {
-    pub root: DockNode,
-    #[serde(default)]
-    pub floating: Vec<Floating>,
-}
-
-impl Layout {
-    pub fn apply(&mut self, action: craft_ui::docking::Action<PanelKind>) -> Result<(), String> {
-        crate::dock_shared::apply(self, action)
-    }
-    pub fn validate(&self) -> Result<(), String> {
-        crate::dock_shared::encode(&self.root, &self.floating)?.validate().map_err(|error| error.to_string())
-    }
-    pub fn contains(&self, panel: PanelKind) -> bool {
-        self.root.contains(panel) || self.floating.iter().any(|group| group.panels.contains(&panel))
-    }
-}
-
-/// One laid-out tab group.
-pub struct Group {
-    pub path: String,
-    pub rect: Rect,
-    pub content: Rect,
-    pub panels: Vec<PanelKind>,
-    pub active: usize,
-}
-
-/// Actions produced by interacting with the dock chrome.
-#[derive(Debug, Clone, PartialEq)]
-pub enum DockAction {
-    Activate(PanelKind),
-    BeginDrag(PanelKind),
-    Focus(PanelKind),
-    Close(PanelKind),
-    PanelMenu(PanelKind, egui::Pos2),
-    /// A sequence tab of the Timeline panel was clicked / closed (project item id).
-    OpenSequence(u64),
-    CloseSequence(u64),
-    /// A sequence tab was dragged past a neighbour: its new place among the sequence tabs.
-    MoveSequence(u64, usize),
-}
-
-/// Lay out the tree into group rects (with `gap` gutters) and handle gutter dragging.
-pub fn layout(ui: &mut egui::Ui, node: &mut DockNode, rect: Rect, t: &Tokens, path: &str, out: &mut Vec<Group>, reg: &mut crate::automation::Registry) {
-    let mut actions = Vec::new();
-    layout_with_actions(ui, node, rect, t, path, out, reg, &mut actions);
-    for action in actions {
-        crate::dock_shared::apply_tree(node, action);
-    }
-}
-
-/// Lay out chrome while returning mutations for the application's UI command route.
-pub fn layout_with_actions(
-    ui: &mut egui::Ui,
-    node: &mut DockNode,
-    rect: Rect,
-    t: &Tokens,
-    path: &str,
-    out: &mut Vec<Group>,
-    reg: &mut crate::automation::Registry,
-    actions: &mut Vec<craft_ui::docking::Action<PanelKind>>,
-) {
-    layout_inner(ui, node, rect, t, path, &[], out, reg, actions);
-}
-
-fn layout_inner(
-    ui: &mut egui::Ui,
-    node: &mut DockNode,
-    rect: Rect,
-    t: &Tokens,
-    path: &str,
-    tree_path: &[bool],
-    out: &mut Vec<Group>,
-    reg: &mut crate::automation::Registry,
-    actions: &mut Vec<craft_ui::docking::Action<PanelKind>>,
-) {
-    match node {
-        DockNode::Tabs { panels, active } => {
-            let tab_h = if panels.len() == 1 && panels[0].compact() { 8.0 } else { t.tab_h };
-            let content = Rect::from_min_max(pos2(rect.min.x, rect.min.y + tab_h), rect.max);
-            out.push(Group { path: path.to_string(), rect, content, panels: panels.clone(), active: *active });
-        }
-        DockNode::Split { vertical, size, a, b } => {
-            let axis = if *vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal };
-            let Some(split) = split_rect(rect, axis, size.shared(), t.gap, 20.0) else { return };
-            let id = egui::Id::new(("dock-gutter", path.to_string()));
-            let handle_style = ResizeHandleStyle { hovered: t.focus.gamma_multiply(0.4), dragged: t.focus.gamma_multiply(0.9), focused: t.focus };
-            let label = if *vertical { tl!("Height:") } else { tl!("Width:") };
-            let response = ResizeHandle::new(id, axis, split.divider, label, handle_style).value(split.first_size(), 0.0..=split.available()).show(ui);
-            reg.add_response(&format!("dock.gutter.{path}"), &response.response, "gutter");
-            if response.delta != 0.0
-                && let Some(resized) = split.resized(size.shared(), response.delta, 40.0)
-            {
-                actions.push(craft_ui::docking::Action::ResizeSplit { path: tree_path.to_vec(), size: resized });
-            }
-            let mut first_path = tree_path.to_vec();
-            first_path.push(false);
-            let mut second_path = tree_path.to_vec();
-            second_path.push(true);
-            layout_inner(ui, a, split.first, t, &format!("{path}a"), &first_path, out, reg, actions);
-            layout_inner(ui, b, split.second, t, &format!("{path}b"), &second_path, out, reg, actions);
-        }
-    }
-}
-
-/// Draw a group's frame + tab strip. Returns actions (tab clicks, panel menu, focus).
 /// The sequences open in the Timeline panel, in tab order: `(project item id, name)`.
 #[derive(Debug, Clone, Default)]
 pub struct SeqTabs {
@@ -573,317 +581,210 @@ pub struct SeqTabs {
     pub active: Option<u64>,
 }
 
-pub fn draw_group_chrome(
-    ui: &mut egui::Ui,
-    g: &Group,
-    focused: PanelKind,
-    seqs: &SeqTabs,
-    t: &Tokens,
-    reg: &mut crate::automation::Registry,
-) -> Vec<DockAction> {
-    let chrome = draw_group_chrome_details(ui, g, seqs, t, reg);
-    paint_group_focus(ui, g, focused, t);
-    chrome.actions
+impl SeqTabs {
+    /// The Timeline panel's tab label: its active sequence.
+    pub fn label(&self) -> String {
+        let name = self.open.iter().find(|(id, _)| self.active == Some(*id)).map(|(_, n)| n.clone());
+        name.unwrap_or_else(|| tl!("Timeline: (no sequences)").into())
+    }
 }
 
-#[derive(Default)]
-pub struct Chrome {
-    pub actions: Vec<DockAction>,
-    pub tabs: Vec<(PanelKind, Rect)>,
+/// What the sequence tabs ask for.
+#[derive(Debug, Clone, PartialEq)]
+pub enum SeqAction {
+    Open(u64),
+    Close(u64),
+    /// A sequence tab was dragged past a neighbour: its new place among the sequence tabs.
+    Move(u64, usize),
+    /// A right click: show that sequence and open the Timeline's panel menu there.
+    Menu(u64, egui::Pos2),
 }
 
-pub fn draw_group_chrome_details(ui: &mut egui::Ui, g: &Group, seqs: &SeqTabs, t: &Tokens, reg: &mut crate::automation::Registry) -> Chrome {
+fn sequence_widths(ui: &egui::Ui, seqs: &SeqTabs) -> Vec<f32> {
+    seqs.open
+        .iter()
+        .map(|(id, name)| {
+            let label = ui.painter().layout_no_wrap(name.clone(), Tokens::ui(12.0), egui::Color32::WHITE).size().x;
+            label + 16.0 + if seqs.active == Some(*id) { 16.0 } else { 0.0 }
+        })
+        .collect()
+}
+
+/// The width [`sequence_tabs`] needs to show every open sequence.
+pub fn sequence_tabs_width(ui: &egui::Ui, seqs: &SeqTabs) -> f32 {
+    sequence_widths(ui, seqs).iter().map(|w| w + 8.0).sum::<f32>() + 12.0
+}
+
+/// Draw the Timeline panel's sequence tabs in `strip`: one tab per open sequence, × on the active
+/// one, drag to reorder, middle-click to close, the wheel to step through them, and a » list
+/// when they don't fit.
+pub fn sequence_tabs(ui: &mut egui::Ui, strip: Rect, seqs: &SeqTabs, t: &Tokens, reg: &mut crate::automation::Registry) -> Vec<SeqAction> {
     let mut actions = Vec::new();
-    let mut tab_rects: Vec<(PanelKind, Rect)> = Vec::new();
-    let painter = ui.painter().clone();
-    painter.rect_filled(g.rect, t.radius, t.panel_bg);
-    let active_panel = g.panels.get(g.active).copied();
-    let compact = g.panels.len() == 1 && g.panels[0].compact();
-    // A narrow header grip moves the entire panel, including Timeline panels whose tabs
-    // separately reorder open sequences.
-    if let Some(panel) = active_panel {
-        let grip = Rect::from_min_size(g.rect.min, vec2(if compact { g.rect.width() } else { 10.0 }, if compact { 8.0 } else { t.tab_h }));
-        let response = ui.interact(grip, egui::Id::new(("panel-drag", g.path.clone())), Sense::drag());
-        reg.add_response(&format!("panel.drag.{}", panel.id()), &response, "Move panel");
-        if response.drag_started() {
-            actions.push(DockAction::BeginDrag(panel));
+    let painter = ui.painter_at(strip);
+    let active_at = seqs.open.iter().position(|(id, _)| seqs.active == Some(*id)).unwrap_or(0);
+    let text_y = strip.center().y;
+    // Which tabs fit. The active tab is always shown: tabs before it are left out until it
+    // fits, then as many after it as there is room for. The » list reaches the rest.
+    let widths = sequence_widths(ui, seqs);
+    let span = |from: usize, to: usize| widths.get(from..=to).map_or(0.0, |w| w.iter().sum::<f32>() + 8.0 * w.len() as f32);
+    let room = strip.width() - 12.0;
+    let all_fit = span(0, seqs.open.len().saturating_sub(1)) <= room;
+    let room = if all_fit { room } else { room - 24.0 };
+    let mut first = 0;
+    while first < active_at && span(first, active_at) > room {
+        first += 1;
+    }
+    let mut last = active_at.max(first);
+    while last + 1 < seqs.open.len() && span(first, last + 1) <= room {
+        last += 1;
+    }
+    let list_id = egui::Id::unique("timeline-tab-list");
+    let more = (!all_fit).then(|| Rect::from_min_size(pos2(strip.max.x - 22.0, strip.center().y - 10.0), vec2(18.0, 20.0)));
+    let mut list_opened = false;
+    if let Some(r) = more {
+        let resp = ui.interact(r, egui::Id::unique("timeline-tab-overflow"), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, resp.enabled(), "more tabs"));
+        reg.add_response("timeline.tabs.more", &resp, "more tabs");
+        let c = if resp.hovered() { t.tab_text_active } else { t.tab_text };
+        icons::paint(&painter, r.shrink(4.0).translate(vec2(-2.0, 0.0)), Icon::ChevronRight, c);
+        icons::paint(&painter, r.shrink(4.0).translate(vec2(2.0, 0.0)), Icon::ChevronRight, c);
+        paint_widget_focus(&painter, &resp, t);
+        if resp.clicked() {
+            let open = ui.ctx().data(|d| d.get_temp::<bool>(list_id)).unwrap_or(false);
+            ui.ctx().data_mut(|d| d.insert_temp(list_id, !open));
+            list_opened = !open;
         }
     }
-    if compact {
-        // grip dots
-        let c = pos2(g.rect.center().x, g.rect.min.y + 4.0);
-        for dx in [-4.0, 0.0, 4.0] {
-            painter.circle_filled(c + vec2(dx, 0.0), 1.0, t.text_faint);
+    // The wheel over the strip steps through the tabs: down = next, up = previous, one tab per
+    // notch (trackpad scrolling adds up to a notch first), stopping at the ends.
+    let wheel_id = egui::Id::unique("timeline-tab-wheel");
+    if ui.rect_contains_pointer(strip) && !seqs.open.is_empty() {
+        const NOTCH: f32 = 40.0;
+        let total = ui.ctx().data(|d| d.get_temp::<f32>(wheel_id)).unwrap_or(0.0) + crate::panels::timeline::wheel_input(ui.ctx()).delta.y;
+        let steps = (total / NOTCH).trunc();
+        ui.ctx().data_mut(|d| d.insert_temp(wheel_id, total - steps * NOTCH));
+        let to = (active_at as i64).saturating_sub(steps as i64).clamp(0, seqs.open.len() as i64 - 1) as usize;
+        if let Some((id, _)) = seqs.open.get(to).filter(|_| to != active_at) {
+            actions.push(SeqAction::Open(*id));
         }
     } else {
-        let strip = Rect::from_min_size(g.rect.min, vec2(g.rect.width(), t.tab_h));
-        // the Timeline panel shows one tab per open sequence (its own tab names the sequence)
-        struct Tab {
-            panel: PanelKind,
-            seq: Option<u64>,
-            title: String,
-            active: bool,
+        ui.ctx().data_mut(|d| d.remove::<f32>(wheel_id));
+    }
+    let mut x = strip.min.x + 12.0;
+    let mut seq_rects: Vec<(u64, Rect)> = Vec::new();
+    let mut dragged: Option<u64> = None;
+    for (i, (id, name)) in seqs.open.iter().enumerate().take(last + 1).skip(first) {
+        let is_active = seqs.active == Some(*id);
+        let galley = painter.layout_no_wrap(name.clone(), Tokens::ui(12.0), if is_active { t.tab_text_active } else { t.tab_text });
+        let close_w = if is_active { 16.0 } else { 0.0 };
+        let w = widths.get(i).copied().unwrap_or(0.0);
+        let tab_rect = Rect::from_min_size(pos2(x, strip.min.y), vec2(w, strip.height()));
+        // a sequence tab keeps its identity when the tabs are reordered under the pointer
+        let resp = ui.interact(tab_rect, egui::Id::unique(("tab-seq", *id)), Sense::click_and_drag());
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Tab, resp.enabled(), is_active, name));
+        ui.ctx().accesskit_node_builder(resp.id, |node| {
+            node.set_role(egui::accesskit::Role::Tab);
+            node.set_selected(is_active);
+        });
+        paint_widget_focus(&painter, &resp, t);
+        seq_rects.push((*id, tab_rect));
+        if resp.dragged() {
+            dragged = Some(*id);
         }
-        let mut tabs: Vec<Tab> = Vec::new();
-        for (i, p) in g.panels.iter().enumerate() {
-            let active = i == g.active;
-            if *p == PanelKind::Timeline && active && !seqs.open.is_empty() {
-                tabs.extend(seqs.open.iter().map(|(id, name)| Tab { panel: *p, seq: Some(*id), title: name.clone(), active: seqs.active == Some(*id) }));
-            } else if *p == PanelKind::Timeline {
-                let name = seqs.open.iter().find(|(id, _)| seqs.active == Some(*id)).map(|(_, n)| n.clone());
-                tabs.push(Tab { panel: *p, seq: None, title: name.unwrap_or_else(|| tl!("Timeline: (no sequences)").into()), active });
-            } else {
-                tabs.push(Tab { panel: *p, seq: None, title: crate::i18n::t(p.title()).to_string(), active });
-            }
+        // Escape puts a dragged tab back where it was (egui ends the drag on Escape, #580)
+        let home = egui::Id::unique(("tab-seq-home", *id));
+        if resp.drag_started() {
+            ui.data_mut(|d| d.insert_temp(home, i));
         }
-        let activate = |tab: &Tab, actions: &mut Vec<DockAction>| match tab.seq {
-            Some(id) => actions.push(DockAction::OpenSequence(id)),
-            None => actions.push(DockAction::Activate(tab.panel)),
-        };
-        let active_at = tabs.iter().position(|tab| tab.active).unwrap_or(0);
-        let text_y = strip.min.y + 16.0;
-        // Which tabs fit. The active tab is always shown: tabs before it are left out until it
-        // fits, then as many after it as there is room for. Tabs that are left out are reached
-        // through the » list at the right end of the strip.
-        let widths: Vec<f32> = tabs
-            .iter()
-            .map(|tab| {
-                let label = painter.layout_no_wrap(tab.title.clone(), Tokens::ui(12.0), t.tab_text).size().x;
-                label + 16.0 + if tab.active { 20.0 } else { 0.0 } + if tab.active && tab.seq.is_some() { 16.0 } else { 0.0 }
-            })
-            .collect();
-        let span = |from: usize, to: usize| widths.get(from..=to).map_or(0.0, |w| w.iter().sum::<f32>() + 8.0 * w.len() as f32);
-        let room = strip.width() - 12.0;
-        let all_fit = span(0, tabs.len().saturating_sub(1)) <= room;
-        let room = if all_fit { room } else { room - 24.0 };
-        let mut first = 0;
-        while first < active_at && span(first, active_at) > room {
-            first += 1;
-        }
-        let mut last = active_at.max(first);
-        while last + 1 < tabs.len() && span(first, last + 1) <= room {
-            last += 1;
-        }
-        let list_id = egui::Id::new(("tab-list", g.path.clone()));
-        let more = (!all_fit).then(|| Rect::from_min_size(pos2(strip.max.x - 22.0, strip.min.y + 6.0), vec2(18.0, 20.0)));
-        let mut list_opened = false;
-        if let Some(r) = more {
-            let resp = ui.interact(r, egui::Id::new(("tab-overflow", g.path.clone())), Sense::click());
-            let name = if g.panels.contains(&PanelKind::Timeline) { "timeline.tabs.more".to_string() } else { format!("panel.tabs.more.{}", g.path) };
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, resp.enabled(), "more tabs"));
-            reg.add_response(&name, &resp, "more tabs");
-            let c = if resp.hovered() { t.tab_text_active } else { t.tab_text };
-            icons::paint(&painter, r.shrink(4.0).translate(vec2(-2.0, 0.0)), Icon::ChevronRight, c);
-            icons::paint(&painter, r.shrink(4.0).translate(vec2(2.0, 0.0)), Icon::ChevronRight, c);
-            paint_widget_focus(&painter, &resp, t);
-            if resp.clicked() {
-                let open = ui.ctx().data(|d| d.get_temp::<bool>(list_id)).unwrap_or(false);
-                ui.ctx().data_mut(|d| d.insert_temp(list_id, !open));
-                list_opened = !open;
-            }
-        }
-        // The wheel over the strip steps through the tabs: down = next, up = previous, one tab
-        // per wheel notch (trackpad scrolling adds up to a notch first), stopping at the ends.
-        let wheel_id = egui::Id::new(("tab-wheel", g.path.clone()));
-        if ui.rect_contains_pointer(strip) && !tabs.is_empty() {
-            const NOTCH: f32 = 40.0;
-            let total = ui.ctx().data(|d| d.get_temp::<f32>(wheel_id)).unwrap_or(0.0) + crate::panels::timeline::wheel_input(ui.ctx()).delta.y;
-            let steps = (total / NOTCH).trunc();
-            ui.ctx().data_mut(|d| d.insert_temp(wheel_id, total - steps * NOTCH));
-            let to = (active_at as i64).saturating_sub(steps as i64).clamp(0, tabs.len() as i64 - 1) as usize;
-            if let Some(tab) = tabs.get(to).filter(|_| to != active_at) {
-                activate(tab, &mut actions);
-                actions.push(DockAction::Focus(tab.panel));
-            }
-        } else {
-            ui.ctx().data_mut(|d| d.remove::<f32>(wheel_id));
-        }
-        let mut x = strip.min.x + 12.0;
-        // sequence tabs as drawn (for dragging one past its neighbours), and the one being dragged
-        let mut seq_rects: Vec<(u64, Rect)> = Vec::new();
-        let mut dragged: Option<u64> = None;
-        for (i, tab) in tabs.iter().enumerate().take(last + 1).skip(first) {
-            let p = &tab.panel;
-            let is_active = tab.active;
-            let galley = painter.layout_no_wrap(tab.title.clone(), Tokens::ui(12.0), if is_active { t.tab_text_active } else { t.tab_text });
-            let close_w = if is_active && tab.seq.is_some() { 16.0 } else { 0.0 };
-            let w = widths.get(i).copied().unwrap_or(0.0);
-            let tab_rect = Rect::from_min_size(pos2(x, strip.min.y), vec2(w, t.tab_h));
-            // a sequence tab keeps its identity when the tabs are reordered under the pointer
-            let resp = match tab.seq {
-                Some(id) => ui.interact(tab_rect, egui::Id::new(("tab-seq", g.path.clone(), id)), Sense::click_and_drag()),
-                None => ui.interact(tab_rect, egui::Id::new(("tab", g.path.clone(), i)), Sense::click_and_drag()),
-            };
-            if tab.seq.is_none() && resp.drag_started() {
-                actions.push(DockAction::BeginDrag(*p));
-            }
-            if let Some((_, rect)) = tab_rects.iter_mut().find(|(panel, _)| panel == p) {
-                *rect = rect.union(tab_rect);
-            } else {
-                tab_rects.push((*p, tab_rect));
-            }
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, resp.enabled(), is_active, &tab.title));
-            ui.ctx().accesskit_node_builder(resp.id, |node| {
-                node.set_role(egui::accesskit::Role::Tab);
-                node.set_selected(is_active);
-            });
-            paint_widget_focus(&painter, &resp, t);
-            if let Some(id) = tab.seq {
-                seq_rects.push((id, tab_rect));
-                if resp.dragged() {
-                    dragged = Some(id);
-                }
-                // Escape puts a dragged tab back where it was (egui ends the drag on Escape, #580)
-                let home = egui::Id::new(("tab-seq-home", id));
-                if resp.drag_started()
-                    && let Some(at) = seqs.open.iter().position(|(s, _)| *s == id)
-                {
-                    ui.data_mut(|d| d.insert_temp(home, at));
-                }
-                if resp.drag_stopped()
-                    && let Some(at) = ui.data_mut(|d| d.remove_temp::<usize>(home))
-                    && ui.input(|i| i.key_pressed(egui::Key::Escape))
-                {
-                    actions.push(DockAction::MoveSequence(id, at));
-                }
-            }
-            if let Some(id) = tab.seq {
-                reg.add_response(&format!("timeline.tab.{id}"), &resp, &tab.title);
-            }
-            if tab.seq.is_none() || is_active {
-                reg.add_response(&format!("panel.tab.{}", p.id()), &resp, p.title());
-            }
-            let label_x = tab_rect.min.x + 8.0 + close_w;
-            let label_w = galley.size().x;
-            let col = if is_active || resp.hovered() { t.tab_text_active } else { t.tab_text };
-            painter.galley_with_override_text_color(pos2(label_x, text_y - galley.size().y / 2.0), galley, col);
-            let mut closed = false;
-            if let Some(id) = tab.seq.filter(|_| is_active) {
-                // × closes the sequence's tab (the sequence stays in the project)
-                let cr = Rect::from_center_size(pos2(tab_rect.min.x + 10.0, text_y), vec2(8.0, 8.0));
-                let cresp = ui.interact(cr.expand(4.0), egui::Id::new(("tab-close", g.path.clone(), id)), Sense::click());
-                cresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, cresp.enabled(), "close sequence"));
-                reg.add_response(&format!("timeline.tab.{id}.close"), &cresp, "close sequence");
-                let cc = if cresp.hovered() { t.tab_text_active } else { t.tab_text };
-                painter.line_segment([cr.left_top(), cr.right_bottom()], Stroke::new(1.2, cc));
-                painter.line_segment([cr.right_top(), cr.left_bottom()], Stroke::new(1.2, cc));
-                paint_widget_focus(&painter, &cresp, t);
-                if cresp.clicked() {
-                    actions.push(DockAction::CloseSequence(id));
-                    closed = true;
-                }
-            }
-            if is_active {
-                let mr = Rect::from_center_size(pos2(label_x + label_w + 12.0, text_y), vec2(12.0, 10.0));
-                let mresp = ui.interact(mr.expand(3.0), egui::Id::new(("tab-menu", g.path.clone())), Sense::click());
-                mresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, mresp.enabled(), "panel menu"));
-                reg.add_response(&format!("panel.menu.{}", p.id()), &mresp, "panel menu");
-                let mc = if mresp.hovered() { t.tab_text_active } else { t.tab_text };
-                icons::paint(&painter, Rect::from_center_size(mr.center(), vec2(16.0, 16.0)), Icon::Hamburger, mc);
-                // 1 pt underline spanning label + ≡, 23 pt below the frame top
-                let uy = strip.min.y + 23.0;
-                painter.line_segment([pos2(label_x, uy), pos2(mr.max.x, uy)], Stroke::new(1.0, t.tab_text_active));
-                paint_widget_focus(&painter, &mresp, t);
-                if mresp.clicked() {
-                    actions.push(DockAction::PanelMenu(*p, mr.left_bottom()));
-                }
-            }
-            if (resp.clicked() || resp.drag_started()) && !closed {
-                activate(tab, &mut actions);
-                actions.push(DockAction::Focus(*p));
-            }
-            // a right-click shows the tab and opens its panel menu (as in Premiere)
-            if resp.secondary_clicked() {
-                activate(tab, &mut actions);
-                actions.push(DockAction::Focus(*p));
-                let at = resp.interact_pointer_pos().unwrap_or(tab_rect.left_bottom());
-                actions.push(DockAction::PanelMenu(*p, at));
-            }
-            if resp.middle_clicked() {
-                // a sequence tab closes its sequence; the Timeline panel itself stays
-                match tab.seq.or(seqs.active.filter(|_| *p == PanelKind::Timeline)) {
-                    Some(id) => actions.push(DockAction::CloseSequence(id)),
-                    None => actions.push(DockAction::Close(*p)),
-                }
-            }
-            x += w + 8.0;
-        }
-        // Dragging a sequence tab sideways: it changes places with a neighbour when the pointer
-        // passes that neighbour's middle.
-        if let Some(id) = dragged
-            && let Some(px) = ui.input(|i| i.pointer.latest_pos()).map(|p| p.x)
-            && let Some(at) = seq_rects.iter().position(|(s, _)| *s == id)
-            && let Some(index) = seqs.open.iter().position(|(s, _)| *s == id)
+        if resp.drag_stopped()
+            && let Some(at) = ui.data_mut(|d| d.remove_temp::<usize>(home))
+            && ui.input(|input| input.key_pressed(egui::Key::Escape))
         {
-            let before = at.checked_sub(1).and_then(|k| seq_rects.get(k));
-            let after = seq_rects.get(at + 1);
-            if before.is_some_and(|(_, r)| px < r.center().x) {
-                actions.push(DockAction::MoveSequence(id, index.saturating_sub(1)));
-            } else if after.is_some_and(|(_, r)| px > r.center().x) {
-                actions.push(DockAction::MoveSequence(id, index + 1));
-            }
+            actions.push(SeqAction::Move(*id, at));
         }
-        // the » list: every tab of the group, the shown one ticked
-        let list_open = ui.ctx().data(|d| d.get_temp::<bool>(list_id)).unwrap_or(false);
-        if let Some(r) = more.filter(|_| list_open) {
-            let mut picked = None;
-            let area = egui::Area::new(list_id.with("area")).order(egui::Order::Foreground).pivot(Align2::RIGHT_TOP).fixed_pos(r.right_bottom()).show(
-                ui.ctx(),
-                |ui| {
-                    egui::Frame::popup(ui.style()).show(ui, |ui| {
-                        ui.set_min_width(160.0);
-                        // many open sequences: the list scrolls instead of leaving the window
-                        egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
-                            for tab in &tabs {
-                                let label = if tab.active { format!("✓ {}", tab.title) } else { tab.title.clone() };
-                                let resp = ui.button(label);
-                                match tab.seq {
-                                    Some(id) => reg.add_response(&format!("timeline.tabs.list.{id}"), &resp, &tab.title),
-                                    None => reg.add_response(&format!("panel.tabs.list.{}", tab.panel.id()), &resp, &tab.title),
-                                }
-                                if resp.clicked() {
-                                    picked = Some(tab);
-                                }
+        reg.add_response(&format!("timeline.tab.{id}"), &resp, name);
+        let label_x = tab_rect.min.x + 8.0 + close_w;
+        let col = if is_active || resp.hovered() { t.tab_text_active } else { t.tab_text };
+        let label_w = galley.size().x;
+        painter.galley_with_override_text_color(pos2(label_x, text_y - galley.size().y / 2.0), galley, col);
+        let mut closed = false;
+        if is_active {
+            // × closes the sequence's tab (the sequence stays in the project)
+            let cr = Rect::from_center_size(pos2(tab_rect.min.x + 10.0, text_y), vec2(8.0, 8.0));
+            let cresp = ui.interact(cr.expand(4.0), egui::Id::unique(("tab-close", *id)), Sense::click());
+            cresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, cresp.enabled(), "close sequence"));
+            reg.add_response(&format!("timeline.tab.{id}.close"), &cresp, "close sequence");
+            let cc = if cresp.hovered() { t.tab_text_active } else { t.tab_text };
+            painter.line_segment([cr.left_top(), cr.right_bottom()], Stroke::new(1.2, cc));
+            painter.line_segment([cr.right_top(), cr.left_bottom()], Stroke::new(1.2, cc));
+            paint_widget_focus(&painter, &cresp, t);
+            if cresp.clicked() {
+                actions.push(SeqAction::Close(*id));
+                closed = true;
+            }
+            let uy = strip.max.y - 2.0;
+            painter.line_segment([pos2(label_x, uy), pos2(label_x + label_w, uy)], Stroke::new(1.0, t.tab_text_active));
+        }
+        if (resp.clicked() || resp.drag_started()) && !closed && !is_active {
+            actions.push(SeqAction::Open(*id));
+        }
+        if resp.middle_clicked() {
+            actions.push(SeqAction::Close(*id));
+        }
+        if resp.secondary_clicked() {
+            actions.push(SeqAction::Menu(*id, resp.interact_pointer_pos().unwrap_or(tab_rect.left_bottom())));
+        }
+        x += w + 8.0;
+    }
+    // Dragging a sequence tab sideways: it changes places with a neighbour when the pointer
+    // passes that neighbour's middle.
+    if let Some(id) = dragged
+        && let Some(px) = ui.input(|i| i.pointer.latest_pos()).map(|p| p.x)
+        && let Some(at) = seq_rects.iter().position(|(s, _)| *s == id)
+        && let Some(index) = seqs.open.iter().position(|(s, _)| *s == id)
+    {
+        let before = at.checked_sub(1).and_then(|k| seq_rects.get(k));
+        let after = seq_rects.get(at + 1);
+        if before.is_some_and(|(_, r)| px < r.center().x) {
+            actions.push(SeqAction::Move(id, index.saturating_sub(1)));
+        } else if after.is_some_and(|(_, r)| px > r.center().x) {
+            actions.push(SeqAction::Move(id, index + 1));
+        }
+    }
+    // the » list: every open sequence, the shown one ticked
+    let list_open = ui.ctx().data(|d| d.get_temp::<bool>(list_id)).unwrap_or(false);
+    if let Some(r) = more.filter(|_| list_open) {
+        let mut picked = None;
+        let area =
+            egui::Area::new(list_id.with("area")).order(egui::Order::Foreground).pivot(Align2::RIGHT_TOP).fixed_pos(r.right_bottom()).show(ui.ctx(), |ui| {
+                egui::Frame::popup(ui.style()).show(ui, |ui| {
+                    ui.set_min_width(160.0);
+                    // many open sequences: the list scrolls instead of leaving the window
+                    egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                        for (id, name) in &seqs.open {
+                            let label = if seqs.active == Some(*id) { format!("✓ {name}") } else { name.clone() };
+                            let resp = ui.button(label);
+                            reg.add_response(&format!("timeline.tabs.list.{id}"), &resp, name);
+                            if resp.clicked() {
+                                picked = Some(*id);
                             }
-                        });
+                        }
                     });
-                },
-            );
-            if let Some(tab) = picked {
-                activate(tab, &mut actions);
-                actions.push(DockAction::Focus(tab.panel));
-            }
-            if picked.is_some() || (!list_opened && area.response.clicked_elsewhere()) {
-                ui.ctx().data_mut(|d| d.remove::<bool>(list_id));
-            }
-        } else if list_open {
+                });
+            });
+        if let Some(id) = picked {
+            actions.push(SeqAction::Open(id));
+        }
+        if picked.is_some() || (!list_opened && area.response.clicked_elsewhere()) {
             ui.ctx().data_mut(|d| d.remove::<bool>(list_id));
         }
+    } else if list_open {
+        ui.ctx().data_mut(|d| d.remove::<bool>(list_id));
     }
-    // Activating presses focus their tab immediately, rather than the group's old active panel.
-    // Otherwise entering an inspector can briefly reactivate a stale Project/Timeline selection.
-    // Middle-click closes a tab, so it keeps the active panel as the focus target.
-    if let Some(p) = active_panel
-        && ui.rect_contains_pointer(g.rect)
-        && ui.input(|i| i.pointer.any_pressed())
-    {
-        let panel = ui
-            .input(|i| i.pointer.interact_pos().filter(|_| i.pointer.primary_pressed() || i.pointer.secondary_pressed()))
-            .and_then(|pos| tab_rects.iter().find(|(_, rect)| rect.contains(pos)).map(|(panel, _)| *panel))
-            .unwrap_or(p);
-        actions.push(DockAction::Focus(panel));
-    }
-    Chrome { actions, tabs: tab_rects }
+    actions
 }
 
-/// Paint once after the group's contents so child backgrounds cannot hide its focus (#1075).
-pub(crate) fn paint_group_focus(ui: &egui::Ui, group: &Group, focused: PanelKind, tokens: &Tokens) {
-    if group.panels.get(group.active).copied() == Some(focused) {
-        ui.painter().rect_stroke(group.rect, 0.0, Stroke::new(1.0, tokens.focus), StrokeKind::Inside);
-    }
-}
-
-fn paint_widget_focus(painter: &egui::Painter, response: &egui::Response, tokens: &Tokens) {
+pub(crate) fn paint_widget_focus(painter: &egui::Painter, response: &egui::Response, tokens: &Tokens) {
     if response.has_focus() {
         painter.rect_stroke(response.rect.shrink(2.0), 2.0, Stroke::new(1.5, tokens.focus), StrokeKind::Inside);
     }
@@ -898,68 +799,179 @@ pub fn placeholder(ui: &mut egui::Ui, rect: Rect, t: &Tokens, text: &str) {
 mod tests {
     use super::*;
 
-    #[test]
-    fn split_first_never_panics_on_tiny_areas() {
-        let split_first = |size: SplitSize, avail: f32| {
-            split_rect(Rect::from_min_size(egui::Pos2::ZERO, vec2(avail, 100.0)), SplitAxis::Horizontal, size.shared(), 0.0, 20.0).unwrap().first_size()
-        };
-        for avail in [0.0, 1.0, 15.0, 20.0, 35.0, 39.9, 40.0, 100.0, 2000.0] {
-            for size in [
-                SplitSize::Ratio(0.0),
-                SplitSize::Ratio(0.5),
-                SplitSize::Ratio(1.0),
-                SplitSize::FixedA(300.0),
-                SplitSize::FixedB(300.0),
-                SplitSize::FixedA(0.0),
-            ] {
-                let f = split_first(size, avail);
-                assert!((0.0..=avail).contains(&f), "{size:?} in {avail}: {f}");
-            }
-        }
-        assert_eq!(split_first(SplitSize::FixedA(300.0), 1000.0), 300.0);
-        assert_eq!(split_first(SplitSize::FixedB(300.0), 1000.0), 700.0);
-        assert_eq!(split_first(SplitSize::Ratio(0.0), 1000.0), 20.0);
-    }
-
     #[test]
     fn workspaces_contain_core_panels() {
         for w in WORKSPACES {
             let d = workspace(w);
-            assert!(d.contains(PanelKind::Timeline), "{w}");
-            assert!(d.contains(PanelKind::Program), "{w}");
+            d.validate().unwrap();
+            assert!(d.contains(&PanelKind::Timeline), "{w}");
+            assert!(d.contains(&PanelKind::Program), "{w}");
         }
     }
 
+    /// The fixed sizes of a tree's splits, depth first.
+    fn fixed_splits(node: &Node<PanelKind>) -> Vec<SplitSize> {
+        match node {
+            Node::Split { size, first, second, .. } => {
+                let mut out = if matches!(size, SplitSize::Ratio(_)) { vec![] } else { vec![*size] };
+                out.extend(fixed_splits(first));
+                out.extend(fixed_splits(second));
+                out
+            }
+            _ => vec![],
+        }
+    }
+
+    /// In every built-in workspace Tools and the Audio Meters keep their widths as the window
+    /// resizes; every other group resizes with it.
     #[test]
-    fn close_and_open() {
-        let mut d = workspace("Editing");
-        d.close(PanelKind::Metadata);
-        assert!(!d.contains(PanelKind::Metadata));
-        d.open_near(PanelKind::LumetriColor, PanelKind::Program);
-        assert!(d.is_visible(PanelKind::LumetriColor));
-        let s = serde_json::to_string(&d).unwrap();
-        let back: DockNode = serde_json::from_str(&s).unwrap();
-        assert_eq!(back, d);
+    fn workspaces_fix_only_tools_and_meters() {
+        for w in WORKSPACES {
+            let layout = workspace(w);
+            let fixed = layout.root.as_ref().map(fixed_splits).unwrap_or_default();
+            assert_eq!(fixed, vec![SplitSize::FixedFirst(TOOLS_WIDTH), SplitSize::FixedSecond(METERS_WIDTH)], "{w}");
+        }
+    }
+
+    /// A saved workspace keeps its fixed split sizes, docked and floating, and its ratios.
+    #[test]
+    fn saved_workspaces_keep_fixed_and_ratio_splits() {
+        let workspace = serde_json::json!({"layout": {"root": {"Split": {"axis": "Horizontal", "size": {"FixedSecond": 450.0},
+            "first": {"Split": {"axis": "Horizontal", "size": {"Ratio": 0.25},
+                "first": {"Tabs": {"panels": ["Tools"], "active": 0}}, "second": {"Tabs": {"panels": ["Timeline"], "active": 0}}}},
+            "second": {"Tabs": {"panels": ["AudioMeters"], "active": 0}}}},
+            "floating": [{"root": {"Split": {"axis": "Vertical", "size": {"FixedFirst": 100.0},
+                "first": {"Tabs": {"panels": ["Info"], "active": 0}}, "second": {"Tabs": {"panels": ["Effects"], "active": 0}}}},
+                "rect": [10.0, 20.0, 300.0, 304.0]}]}, "hidden": []});
+        let prefs = WorkspacePrefs { saved: vec![SavedWorkspace { name: "Mine".into(), workspace, ..Default::default() }], current: "Mine".into() };
+        let loaded = saved_docking(&prefs, "Mine");
+        assert!(loaded.is_docked(PanelKind::Tools) && loaded.is_visible(PanelKind::Info) && loaded.is_visible(PanelKind::Effects), "{loaded:?}");
+        let root = loaded.root.as_ref().unwrap();
+        let Node::Split { size: SplitSize::FixedSecond(outer), first, .. } = root else { panic!("{root:?}") };
+        assert_eq!(*outer, 450.0);
+        let Node::Split { size: SplitSize::Ratio(inner), .. } = &**first else { panic!("{first:?}") };
+        assert_eq!(*inner, 0.25);
+        let floating: Vec<_> = loaded.floating.iter().flat_map(|window| fixed_splits(&window.root)).collect();
+        assert_eq!(floating, vec![SplitSize::FixedFirst(100.0)], "{:?}", loaded.floating);
     }
 
     /// #284: with Project and Program closed (or every panel closed) a panel still opens.
     #[test]
     fn open_near_falls_back_to_the_first_group() {
         let mut d = workspace("Editing");
-        let mut all = Vec::new();
-        d.panels(&mut all);
-        for p in all {
-            d.close(p);
+        for p in d.panels().into_iter().copied().collect::<Vec<_>>() {
+            d.apply(Action::Close { panel: p }).unwrap();
         }
-        assert_eq!(d, DockNode::Tabs { panels: vec![], active: 0 });
+        assert_eq!(d.root, None);
         d.open_near(PanelKind::Program, PanelKind::Project);
         assert!(d.is_visible(PanelKind::Program));
         d.restore_timeline();
         assert!(d.is_visible(PanelKind::Timeline));
         // a tree without Project or Program: the panel joins the first group
-        let mut d = hsplit(SplitSize::Ratio(0.5), tabs(&[PanelKind::Effects], 0), tabs(&[PanelKind::Markers], 0));
+        let mut d = Layout { root: Some(hsplit(SplitSize::Ratio(0.5), tabs(&[PanelKind::Effects], 0), tabs(&[PanelKind::Markers], 0))), floating: vec![] };
         d.open_near(PanelKind::Info, PanelKind::Source);
         assert!(d.is_visible(PanelKind::Info));
-        assert_eq!(d, hsplit(SplitSize::Ratio(0.5), tabs(&[PanelKind::Effects, PanelKind::Info], 1), tabs(&[PanelKind::Markers], 0)));
+        assert_eq!(d.root, Some(hsplit(SplitSize::Ratio(0.5), tabs(&[PanelKind::Effects, PanelKind::Info], 1), tabs(&[PanelKind::Markers], 0))));
+    }
+
+    /// A workspace file written before FilmCraft saved craft-ui workspaces still opens, and a
+    /// saved workspace reads back as written.
+    #[test]
+    fn saved_workspaces_read_earlier_files_and_round_trip() {
+        let legacy = serde_json::json!({"saved": [{"name": "Mine", "layout": {"Split": {"vertical": false, "size": {"FixedA": 300.0},
+            "a": {"Tabs": {"panels": ["Project", "Info"], "active": 1}}, "b": {"Tabs": {"panels": ["Timeline"], "active": 0}}}},
+            "floating": [{"panels": ["Effects"], "active": 0, "rect": [10.0, 20.0, 300.0, 200.0]}]},
+            {"name": "Broken", "layout": {"Tabs": {"panels": ["NoSuchPanel"], "active": 0}}}], "current": "Mine"});
+        let prefs: WorkspacePrefs = serde_json::from_value(legacy).unwrap();
+        let mine = saved_docking(&prefs, "Mine");
+        assert!(mine.is_visible(PanelKind::Info) && mine.is_visible(PanelKind::Timeline) && mine.is_visible(PanelKind::Effects));
+        // the Project column keeps its fixed 300 pt
+        let Some(Node::Split { size, .. }) = &mine.root else { panic!("{:?}", mine.root) };
+        assert_eq!(*size, SplitSize::FixedFirst(300.0));
+        assert_eq!(saved_docking(&prefs, "Broken"), workspace("Broken"));
+        let saved = SavedWorkspace { name: "Mine".into(), workspace: serde_json::to_value(Workspace::new(mine.clone())).unwrap(), ..Default::default() };
+        let prefs = WorkspacePrefs { saved: vec![saved], current: "Mine".into() };
+        let text = serde_json::to_string(&prefs).unwrap();
+        assert!(!text.contains("\"layout\":{\"Split\""), "{text}");
+        let back: WorkspacePrefs = serde_json::from_str(&text).unwrap();
+        assert_eq!(saved_docking(&back, "Mine"), mine);
+    }
+
+    /// A saved workspace still opens in versions that read only the earlier `layout` and
+    /// `floating` fields, as long as every floating window is one tab group.
+    #[test]
+    fn saved_workspaces_open_in_earlier_versions() {
+        // The shapes earlier versions read the file into.
+        #[allow(dead_code)]
+        #[derive(Debug, PartialEq, Deserialize)]
+        enum OldSize {
+            Ratio(f32),
+            FixedA(f32),
+            FixedB(f32),
+        }
+        #[allow(dead_code)]
+        #[derive(Debug, PartialEq, Deserialize)]
+        enum OldNode {
+            Split { vertical: bool, size: OldSize, a: Box<OldNode>, b: Box<OldNode> },
+            Tabs { panels: Vec<PanelKind>, active: usize },
+        }
+        #[derive(Debug, PartialEq, Deserialize)]
+        struct OldFloating {
+            panels: Vec<PanelKind>,
+            active: usize,
+            rect: [f32; 4],
+        }
+        #[derive(Default, Deserialize)]
+        #[serde(rename_all = "camelCase", default)]
+        struct OldSaved {
+            layout: serde_json::Value,
+            floating: serde_json::Value,
+        }
+        #[derive(Default, Deserialize)]
+        #[serde(rename_all = "camelCase", default)]
+        struct OldPrefs {
+            saved: Vec<OldSaved>,
+        }
+        let read = |layout: &Layout| {
+            let prefs = WorkspacePrefs { saved: vec![SavedWorkspace::new("Mine", layout).unwrap()], current: "Mine".into() };
+            let text = serde_json::to_string(&prefs).unwrap();
+            assert_eq!(saved_docking(&serde_json::from_str(&text).unwrap(), "Mine"), *layout, "{text}");
+            let old: OldPrefs = serde_json::from_str(&text).unwrap();
+            let entry = old.saved.into_iter().next().unwrap();
+            let floating: Vec<OldFloating> = if entry.floating.is_null() { vec![] } else { serde_json::from_value(entry.floating).unwrap() };
+            (serde_json::from_value::<OldNode>(entry.layout).ok(), floating)
+        };
+
+        fn panels(node: &OldNode, out: &mut Vec<PanelKind>) {
+            match node {
+                OldNode::Split { a, b, .. } => {
+                    panels(a, out);
+                    panels(b, out);
+                }
+                OldNode::Tabs { panels, .. } => out.extend(panels),
+            }
+        }
+
+        let mut layout = workspace("Editing");
+        layout.apply(Action::Float { panel: PanelKind::Info, rect: [10.0, 20.0, 300.0, 200.0] }).unwrap();
+        let (root, floating) = read(&layout);
+        let mut old = Vec::new();
+        panels(&root.unwrap(), &mut old);
+        let docked = Layout { root: layout.root.clone(), floating: vec![] };
+        assert_eq!(old, docked.panels().into_iter().copied().collect::<Vec<_>>());
+        assert_eq!(floating, vec![OldFloating { panels: vec![PanelKind::Info], active: 0, rect: [10.0, 20.0, 300.0, 200.0] }]);
+
+        // A floating window split in two has no earlier form: those versions use the default.
+        let mut split = layout.clone();
+        split.apply(Action::Float { panel: PanelKind::Effects, rect: [400.0, 20.0, 300.0, 200.0] }).unwrap();
+        let window = split.floating.iter().position(|w| w.contains(&PanelKind::Effects)).unwrap();
+        let effects = split.floating.remove(window);
+        split.floating[0].root = Node::Split {
+            axis: SplitAxis::Vertical,
+            size: SplitSize::Ratio(0.5),
+            first: Box::new(split.floating[0].root.clone()),
+            second: Box::new(effects.root),
+        };
+        assert_eq!(read(&split), (None, vec![]));
     }
 }
diff --git a/crates/ui-egui/src/dock_shared.rs b/crates/ui-egui/src/dock_shared.rs
deleted file mode 100644
index 2b64351db..000000000
--- a/crates/ui-egui/src/dock_shared.rs
+++ /dev/null
@@ -1,131 +0,0 @@
-//! Convert the persisted workspace schema to shared docking transactions.
-
-use craft_ui::docking::{Action, Floating as SharedFloating, Layout as SharedLayout, Location, Node, Placement, Zone};
-use craft_ui::layout::{SplitAxis, SplitSize as SharedSplitSize};
-
-use crate::dock::{DockNode, Floating, Layout, PanelKind, SplitSize};
-
-const MAX_DEPTH: usize = 32;
-const MAX_NODES: usize = 4096;
-const MAX_PANELS: usize = 128;
-
-fn encode_node(node: &DockNode, depth: usize, count: &mut usize) -> Result<Node<PanelKind>, String> {
-    *count = count.saturating_add(1);
-    if depth > MAX_DEPTH || *count > MAX_NODES {
-        return Err("workspace dock tree exceeds supported limits".into());
-    }
-    Ok(match node {
-        DockNode::Tabs { panels, active } => {
-            if panels.len() > MAX_PANELS {
-                return Err("too many workspace tabs".into());
-            }
-            Node::Tabs { panels: panels.clone(), active: *active }
-        }
-        DockNode::Split { vertical, size, a, b } => Node::Split {
-            axis: if *vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal },
-            size: match *size {
-                SplitSize::Ratio(value) => SharedSplitSize::Ratio(value),
-                SplitSize::FixedA(value) => SharedSplitSize::FixedFirst(value),
-                SplitSize::FixedB(value) => SharedSplitSize::FixedSecond(value),
-            },
-            first: Box::new(encode_node(a, depth.saturating_add(1), count)?),
-            second: Box::new(encode_node(b, depth.saturating_add(1), count)?),
-        },
-    })
-}
-
-fn decode_node(node: Node<PanelKind>) -> Result<DockNode, String> {
-    Ok(match node {
-        Node::Tabs { panels, active } => DockNode::Tabs { panels, active },
-        Node::Stack { .. } => return Err("FilmCraft does not use stacked panels".into()),
-        Node::Split { axis, size, first, second } => DockNode::Split {
-            vertical: axis == SplitAxis::Vertical,
-            size: match size {
-                SharedSplitSize::Ratio(value) => SplitSize::Ratio(value),
-                SharedSplitSize::FixedFirst(value) => SplitSize::FixedA(value),
-                SharedSplitSize::FixedSecond(value) => SplitSize::FixedB(value),
-            },
-            a: Box::new(decode_node(*first)?),
-            b: Box::new(decode_node(*second)?),
-        },
-    })
-}
-
-pub(crate) fn encode(root: &DockNode, floating: &[Floating]) -> Result<SharedLayout<PanelKind>, String> {
-    if floating.len() > MAX_PANELS || floating.iter().any(|group| group.panels.len() > MAX_PANELS) {
-        return Err("too many floating workspace panels".into());
-    }
-    let root = if matches!(root, DockNode::Tabs { panels, active: 0 } if panels.is_empty()) { None } else { Some(encode_node(root, 0, &mut 0)?) };
-    Ok(SharedLayout {
-        root,
-        floating: floating.iter().map(|group| SharedFloating { panels: group.panels.clone(), active: group.active, rect: group.rect }).collect(),
-    })
-}
-
-pub(crate) fn decode(layout: SharedLayout<PanelKind>) -> Result<Layout, String> {
-    Ok(Layout {
-        root: match layout.root {
-            Some(root) => decode_node(root)?,
-            None => DockNode::Tabs { panels: vec![], active: 0 },
-        },
-        floating: layout.floating.into_iter().map(|group| Floating { panels: group.panels, active: group.active, rect: group.rect }).collect(),
-    })
-}
-
-pub(crate) fn apply(layout: &mut Layout, action: Action<PanelKind>) -> Result<(), String> {
-    let mut shared = encode(&layout.root, &layout.floating)?;
-    shared.validate().map_err(|error| error.to_string())?;
-    check_last_docked(&shared, &action)?;
-    shared.apply(action).map_err(|error| error.to_string())?;
-    let proposed = decode(shared)?;
-    encode(&proposed.root, &proposed.floating)?;
-    *layout = proposed;
-    Ok(())
-}
-
-pub(crate) fn apply_tree(root: &mut DockNode, action: Action<PanelKind>) -> bool {
-    let Ok(mut shared) = encode(root, &[]) else { return false };
-    if shared.apply(action).is_err() {
-        return false;
-    }
-    let Ok(layout) = decode(shared) else { return false };
-    if encode(&layout.root, &[]).is_err() {
-        return false;
-    }
-    *root = layout.root;
-    true
-}
-
-/// Dock a panel along one edge of the whole workspace. The shared model restores a panel beside a
-/// complete sibling subtree, so naming every remaining docked panel targets the root itself.
-pub(crate) fn dock_at_edge(layout: &mut SharedLayout<PanelKind>, panel: PanelKind, zone: Zone) -> Result<(), String> {
-    let size = match zone {
-        Zone::Left | Zone::Top => SharedSplitSize::Ratio(0.25),
-        Zone::Right | Zone::Bottom => SharedSplitSize::Ratio(0.75),
-        Zone::Center => return Err("a workspace edge needs a left, right, top or bottom zone".into()),
-    };
-    let mut proposed = layout.clone();
-    proposed.apply(Action::Close { panel }).map_err(|error| error.to_string())?;
-    let sibling: Vec<PanelKind> = SharedLayout { root: proposed.root.clone(), floating: vec![] }.panels().into_iter().copied().collect();
-    let anchor = *sibling.first().ok_or("another docked panel is required to dock beside")?;
-    let location = Location { floating: None, anchor: Some(anchor), placement: Placement::Split(zone), size: Some(size), stack: None, sibling };
-    proposed.restore(panel, &location).map_err(|error| error.to_string())?;
-    *layout = proposed;
-    Ok(())
-}
-
-/// Keep one docked destination available for dragging floating panels back into the workspace.
-pub(crate) fn check_last_docked(layout: &SharedLayout<PanelKind>, action: &Action<PanelKind>) -> Result<(), String> {
-    let panel = match action {
-        Action::Float { panel, .. } => Some(panel),
-        Action::Move { panel, anchor, .. } if layout.floating.iter().any(|group| group.panels.contains(anchor)) => Some(panel),
-        _ => None,
-    };
-    if let Some(panel) = panel {
-        let docked = SharedLayout { root: layout.root.clone(), floating: vec![] };
-        if docked.contains(panel) && docked.panels().len() <= 1 {
-            return Err("the last docked panel must remain in the workspace".into());
-        }
-    }
-    Ok(())
-}
diff --git a/crates/ui-egui/src/dock_ui.rs b/crates/ui-egui/src/dock_ui.rs
index 26b30601a..7a30f2c15 100644
--- a/crates/ui-egui/src/dock_ui.rs
+++ b/crates/ui-egui/src/dock_ui.rs
@@ -1,26 +1,35 @@
-//! FilmCraft's panel chrome and document tabs over the shared docking transactions.
+//! FilmCraft's panels in craft-ui's shared docking. craft-ui draws the frames, tab strips,
+//! floating windows and drag previews and owns the gestures; FilmCraft draws the panel
+//! bodies, the ≡ panel menu, the panel items of each tab's context menu and the Timeline's
+//! sequence tabs, and maps its control commands onto
+//! craft-ui's `DockCommand`.
 
-use craft_ui::docking::{Action, DropTarget, Placement, Zone, resolve_drop};
-use egui::{Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use std::collections::HashMap;
+
+use craft_ui::docking::{
+    Action, Divider, DockArea, DockCommand, DockContent, DockEvent, DockStyle, FloatSpace, Hit, Layout, ResizeEdge, WindowKind, Workspace,
+};
+use egui::{Rect, Sense, Stroke, StrokeKind, vec2};
 use serde_json::{Value, json};
 
-use crate::dock::{self, DockAction, DockNode, Group, PanelKind};
+use crate::dock::{self, LayoutExt as _, PanelKind, SeqAction, SeqTabs};
+use crate::icons::{self, Icon};
+use crate::theme::Tokens;
 use crate::{FilmcraftApp, panels};
 
-/// Single source for rendering and hit testing: saved offscreen positions remain
-/// reachable, and every panel has enough room for its chrome.
-fn floating_rect(group: &dock::Floating, screen: Rect) -> Rect {
-    let rect = Rect::from_min_size(pos2(group.rect[0], group.rect[1]), vec2(group.rect[2].max(160.0), group.rect[3].max(100.0)));
-    rect.translate(vec2(
-        (screen.min.x - rect.min.x).max(0.0) + (screen.max.x - 40.0 - rect.min.x).min(0.0),
-        (screen.min.y - rect.min.y).max(0.0) + (screen.max.y - 30.0 - rect.min.y).min(0.0),
-    ))
+/// The dock area's egui id; `DockArea::hit_rects` and `float_space` read by it.
+pub fn area_id() -> egui::Id {
+    egui::Id::unique("filmcraft-docking")
 }
 
-fn drag_id() -> egui::Id {
-    egui::Id::new("dock-panel-drag")
+/// Where each panel body was drawn last frame, and on which layer.
+fn bodies_id() -> egui::Id {
+    area_id().with("bodies")
 }
 
+/// Width of the ≡ panel menu button at the end of each tab strip.
+const MENU_W: f32 = 26.0;
+
 pub(crate) fn route(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
     if id == "window.dockAction" {
         return Some((|| {
@@ -30,170 +39,184 @@ pub(crate) fn route(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, param
             Ok(Value::Null)
         })());
     }
-    if !matches!(id, "window.dockPanel" | "window.floatPanel" | "window.closePanel") {
-        return None;
+    if matches!(id, "window.dockPanel" | "window.floatPanel" | "window.closePanel") {
+        return Some(alias(app, ctx, id, params));
     }
-    Some((|| {
-        let panel = match params.get("panel") {
-            None => app.ui.focused,
-            Some(value) => value.as_str().and_then(PanelKind::from_name).ok_or("unknown panel")?,
-        };
-        let action = match id {
-            "window.closePanel" => Action::Close { panel },
-            "window.floatPanel" => {
-                let rect = match params.get("rect") {
-                    None => default_float_rect(ctx.content_rect()),
-                    Some(value) => serde_json::from_value::<[f32; 4]>(value.clone()).map_err(|_| "rect must contain four finite numbers")?,
-                };
-                Action::Float { panel, rect }
-            }
-            _ => {
-                let zone_name = match params.get("zone") {
-                    None => "center",
-                    Some(value) => value.as_str().ok_or("zone must be a string")?,
-                };
-                let zone = match zone_name.to_ascii_lowercase().as_str() {
-                    "left" => Zone::Left,
-                    "right" => Zone::Right,
-                    "top" => Zone::Top,
-                    "bottom" => Zone::Bottom,
-                    "center" | "tab" => Zone::Center,
-                    _ => return Err("unknown docking zone".into()),
-                };
-                let Some(anchor) = params.get("anchor") else {
-                    if params.get("before").is_some() {
-                        return Err("before needs an anchor panel".into());
-                    }
-                    app.dock_to_edge(panel, zone)?;
-                    return Ok(json!({"panel": panel.id()}));
-                };
-                let anchor = anchor.as_str().and_then(PanelKind::from_name).ok_or("a known anchor panel is required")?;
-                let placement = match params.get("before") {
-                    Some(value) => Placement::Tab { before: Some(value.as_str().and_then(PanelKind::from_name).ok_or("unknown before panel")?) },
-                    None => Placement::Split(zone),
-                };
-                Action::Move { panel, anchor, placement }
-            }
-        };
-        app.apply_dock(action)?;
-        Ok(json!({"panel": panel.id()}))
-    })())
+    if id.starts_with("window.panel.") && DockCommand::<PanelKind>::IDS.contains(&id) {
+        return Some((|| {
+            let mut params = if params.is_object() { params.clone() } else { json!({}) };
+            params["command"] = json!(id);
+            let command: DockCommand<PanelKind> = serde_json::from_value(params).map_err(|error| format!("invalid docking command: {error}"))?;
+            app.run_dock_command(ctx, command)?;
+            Ok(Value::Null)
+        })());
+    }
+    None
 }
 
-pub(crate) fn default_float_rect(screen: Rect) -> [f32; 4] {
-    let center = screen.center();
-    [center.x - 210.0, center.y - 160.0, 420.0, 320.0]
+/// FilmCraft's own docking commands, as craft-ui `window.panel.*` commands. `panel` defaults to
+/// the focused panel.
+fn alias(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Result<Value, String> {
+    let panel = match params.get("panel") {
+        None => app.ui.focused,
+        Some(value) => value.as_str().and_then(PanelKind::from_name).ok_or("unknown panel")?,
+    };
+    let command = match id {
+        "window.closePanel" => json!({"command": "window.panel.close", "panel": panel}),
+        "window.floatPanel" => match params.get("rect") {
+            None => json!({"command": "window.panel.float", "panel": panel}),
+            Some(value) => {
+                let rect = serde_json::from_value::<[f32; 4]>(value.clone()).map_err(|_| "rect must contain four finite numbers")?;
+                json!({"command": "window.panel.layout", "action": Action::Float { panel, rect }})
+            }
+        },
+        _ => {
+            let zone = match params.get("zone") {
+                None => "center",
+                Some(value) => value.as_str().ok_or("zone must be a string")?,
+            };
+            match params.get("anchor") {
+                Some(anchor) => {
+                    let anchor = anchor.as_str().and_then(PanelKind::from_name).ok_or("a known anchor panel is required")?;
+                    let mut command = json!({"command": "window.panel.dock", "panel": panel, "anchor": anchor, "zone": zone.to_ascii_lowercase()});
+                    if let Some(before) = params.get("before") {
+                        command["before"] = json!(before.as_str().and_then(PanelKind::from_name).ok_or("unknown before panel")?);
+                    }
+                    command
+                }
+                None if params.get("before").is_some() => return Err("before needs an anchor panel".into()),
+                // Without an anchor a side zone docks along that edge of the whole workspace.
+                None => match zone.to_ascii_lowercase().as_str() {
+                    "center" | "tab" => json!({"command": "window.panel.dock", "panel": panel}),
+                    edge @ ("left" | "right" | "top" | "bottom") => json!({"command": "window.panel.dock", "panel": panel, "zone": edge}),
+                    _ => return Err("unknown docking zone".into()),
+                },
+            }
+        }
+    };
+    let command: DockCommand<PanelKind> = serde_json::from_value(command).map_err(|error| format!("invalid docking command: {error}"))?;
+    app.run_dock_command(ctx, command)?;
+    Ok(json!({"panel": panel.id()}))
+}
+
+/// Keep one docked destination available for dragging floating panels back into the workspace:
+/// no move or float may leave the frame tree empty. Closing the last docked panel stays allowed.
+fn check_last_docked(before: &Layout<PanelKind>, action: &Action<PanelKind>, after: &Layout<PanelKind>) -> Result<(), String> {
+    let closing = matches!(action, Action::Close { .. } | Action::CloseGroup { .. } | Action::CloseWindow { .. } | Action::CloseOthers { .. });
+    if !closing && before.root.is_some() && after.root.is_none() {
+        return Err("the last docked panel must remain in the workspace".into());
+    }
+    Ok(())
 }
 
 impl FilmcraftApp {
+    /// A layout action from the dock area, through the command path the control channel uses.
     fn dock_command(&mut self, ctx: &egui::Context, action: Action<PanelKind>) -> Result<(), String> {
         let value = serde_json::to_value(action).map_err(|error| error.to_string())?;
         crate::menus::invoke(self, ctx, "window.dockAction", json!({"action": value})).map(|_| ())
     }
 
+    /// Run a craft-ui docking command on the current layout, all or nothing. Workspaces are
+    /// FilmCraft's own (Window ▸ Workspaces).
+    pub(crate) fn run_dock_command(&mut self, ctx: &egui::Context, command: DockCommand<PanelKind>) -> Result<(), String> {
+        if command.is_app_owned() {
+            return Err("use the window.workspace.* commands for workspaces".into());
+        }
+        // A closed panel reopens through FilmCraft's own path: where it was, floating again if it
+        // was closed floating (#1985).
+        if let DockCommand::Activate { panel } = &command
+            && !self.ui.dock.contains(panel)
+        {
+            self.show_panel(*panel);
+            return Ok(());
+        }
+        let space = craft_ui::docking::float_space(ctx, area_id()).unwrap_or_else(|| FloatSpace::new(self.float_bounds(ctx)));
+        let actions = command.to_actions(&Workspace::new(self.ui.dock.clone()), false, &space).map_err(|error| error.to_string())?;
+        self.apply_dock_all(actions)
+    }
+
+    /// Where floating windows may go. With `integrated_titlebar` the header sits in the macOS
+    /// title-bar strip, where a press on a floating window would move the whole app window.
+    pub(crate) fn float_bounds(&self, ctx: &egui::Context) -> Rect {
+        let mut bounds = ctx.content_rect();
+        if self.integrated_titlebar {
+            bounds.min.y += crate::header::HEIGHT;
+        }
+        bounds
+    }
+
     pub fn apply_dock(&mut self, action: Action<PanelKind>) -> Result<(), String> {
-        let relocating = matches!(&action, Action::Move { .. } | Action::Float { .. });
-        let reveal = match &action {
-            Action::Activate { panel } => Some(*panel),
-            _ => None,
-        };
-        self.commit_dock(|shared| {
-            crate::dock_shared::check_last_docked(shared, &action)?;
-            shared.apply(action).map_err(|error| error.to_string())
-        })?;
+        self.apply_dock_all(vec![action])
+    }
+
+    fn apply_dock_all(&mut self, actions: Vec<Action<PanelKind>>) -> Result<(), String> {
+        let mut layout = self.ui.dock.clone();
+        let mut relocating = false;
+        let mut reveal = None;
+        let mut closed_floating = self.ui.closed_floating.clone();
+        for action in actions {
+            relocating |= matches!(&action, Action::Move { .. } | Action::Float { .. } | Action::MoveGroup { .. } | Action::MoveWindow { .. });
+            if let Action::Activate { panel } = &action {
+                reveal = Some(*panel);
+            }
+            // a panel closed while floating remembers where; closed while docked, it forgets (#1985)
+            for panel in layout.closed_by(&action).map_err(|error| error.to_string())? {
+                closed_floating.retain(|(p, _)| *p != panel);
+                if let Some(window) = layout.floating.iter().find(|window| window.contains(&panel)) {
+                    closed_floating.push((panel, window.rect));
+                }
+            }
+            let before = layout.clone();
+            layout.apply(action.clone()).map_err(|error| error.to_string())?;
+            check_last_docked(&before, &action, &layout)?;
+        }
+        self.ui.dock = layout;
+        self.ui.closed_floating = closed_floating;
         if let Some(panel) = reveal {
             self.pending_panel_raise = Some(panel);
         }
-        if relocating
-            || self.ui.keys.maximized.is_some_and(|panel| !self.ui.dock.contains(panel) && !self.ui.floating.iter().any(|group| group.panels.contains(&panel)))
-        {
+        if relocating || self.ui.keys.maximized.is_some_and(|panel| !self.ui.dock.is_docked(panel)) {
             self.ui.keys.maximized = None;
         }
         Ok(())
     }
 
-    /// Dock a panel along an edge of the whole workspace rather than beside one group.
-    pub fn dock_to_edge(&mut self, panel: PanelKind, zone: Zone) -> Result<(), String> {
-        self.commit_dock(|shared| crate::dock_shared::dock_at_edge(shared, panel, zone))?;
-        self.ui.keys.maximized = None;
-        Ok(())
-    }
-
-    fn commit_dock(&mut self, change: impl FnOnce(&mut craft_ui::docking::Layout<PanelKind>) -> Result<(), String>) -> Result<(), String> {
-        let mut shared = crate::dock_shared::encode(&self.ui.dock, &self.ui.floating)?;
-        shared.validate().map_err(|error| error.to_string())?;
-        change(&mut shared)?;
-        let layout = crate::dock_shared::decode(shared)?;
-        crate::dock_shared::encode(&layout.root, &layout.floating)?;
-        self.ui.dock = layout.root;
-        self.ui.floating = layout.floating;
-        Ok(())
-    }
-
-    fn panel_body(&mut self, ui: &mut egui::Ui, panel: PanelKind, content: Rect) {
-        self.auto.add(&format!("panel.{}", panel.id()), content, panel.title());
-        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(content).id_salt(("panel", panel.id())));
-        child.set_clip_rect(content.intersect(ui.clip_rect()));
-        panels::show(self, &mut child, panel, content);
-    }
-
-    /// OS drag positions come from the host cursor hook, so egui pointer capture alone
-    /// cannot decide whether a Timeline is covered. Use the same geometry and layer
-    /// ordering as our renderer before any panel can dispatch an edit.
+    /// OS drag positions come from the host cursor hook, so egui pointer capture alone cannot
+    /// decide whether a Timeline is covered: the Timeline body drawn last frame must hold `pos`,
+    /// with no floating window above it there.
     pub(crate) fn timeline_drop_target(&self, ctx: &egui::Context, pos: egui::Pos2) -> bool {
         if !ctx.content_rect().contains(pos) {
             return false;
         }
-        if let Some(panel) =
-            self.ui.keys.maximized.filter(|panel| self.ui.dock.contains(*panel) || self.ui.floating.iter().any(|group| group.panels.contains(panel)))
-        {
-            return panel == PanelKind::Timeline;
-        }
-        for index in self.floating_order(ctx).into_iter().rev() {
-            if let Some(group) = self.ui.floating.get(index)
-                && floating_rect(group, ctx.content_rect()).contains(pos)
-            {
-                return group.panels.get(group.active) == Some(&PanelKind::Timeline);
-            }
-        }
-        true
+        let Some(bodies) = ctx.data(|data| data.get_temp::<Vec<(PanelKind, Rect, egui::LayerId)>>(bodies_id())) else { return true };
+        let Some((_, _, timeline)) = bodies.iter().find(|(panel, rect, _)| *panel == PanelKind::Timeline && rect.contains(pos)) else { return false };
+        let layers = ctx.memory(|memory| memory.layer_ids().collect::<Vec<_>>());
+        let rank = |layer: &egui::LayerId| layers.iter().position(|other| other == layer);
+        !self.ui.dock.floating.iter().any(|window| {
+            let Some(layer) = DockArea::floating_layer(area_id(), window) else { return false };
+            // Floating windows are hidden while a frame is maximized.
+            ctx.memory(|memory| memory.areas().is_visible(&layer))
+                && layer != *timeline
+                && rank(&layer) > rank(timeline)
+                && ctx.memory(|memory| memory.area_rect(layer.id)).is_some_and(|rect| rect.contains(pos))
+        })
     }
 
-    fn floating_order(&self, ctx: &egui::Context) -> Vec<usize> {
-        let layers = ctx.memory(|memory| memory.layer_ids().collect::<Vec<_>>());
-        let mut order: Vec<_> = (0..self.ui.floating.len()).collect();
-        order.sort_by_key(|index| {
-            self.ui
-                .floating
-                .get(*index)
-                .and_then(|group| group.panels.first())
-                .and_then(|panel| {
-                    let id = egui::Id::new(("floating-panel", panel.id()));
-                    layers.iter().position(|layer| layer.id == id)
-                })
-                .unwrap_or(usize::MAX)
-        });
-        order
+    /// Whether a modal dialog is open: Settings, Recovery or Revert (egui `Modal`s), any other
+    /// egui `Modal` shown last frame, the Save changes? prompt of Quit or Close Project, or a
+    /// native file dialog. egui's `Modal` blocks input only in the main window, so the dock area
+    /// blocks its native windows meanwhile.
+    fn modal_open(&self, ctx: &egui::Context) -> bool {
+        matches!(self.dialog, Some(crate::Dialog::Preferences | crate::Dialog::Recovery | crate::Dialog::RevertConfirm))
+            || self.ui.clip_dialog.as_ref().is_some_and(|dialog| matches!(dialog.command.as_str(), "app.quit" | "file.closeProject"))
+            || self.native_dialog_open()
+            || ctx.memory(|memory| memory.top_modal_layer().is_some())
     }
 
     pub(crate) fn dock_area(&mut self, ui: &mut egui::Ui, body: Rect) {
         let t = self.tokens;
         let ctx = ui.ctx().clone();
-        if let Some(panel) = self.pending_panel_raise.take()
-            && let Some(owner) = self.ui.floating.iter().find(|group| group.panels.contains(&panel)).and_then(|group| group.panels.first())
-        {
-            ctx.move_to_top(egui::LayerId::new(egui::Order::Middle, egui::Id::new(("floating-panel", owner.id()))));
-        }
-        let maximized =
-            self.ui.keys.maximized.filter(|panel| self.ui.dock.contains(*panel) || self.ui.floating.iter().any(|group| group.panels.contains(panel)));
-        let mut dock = match maximized {
-            Some(panel) => DockNode::Tabs { panels: vec![panel], active: 0 },
-            None => std::mem::replace(&mut self.ui.dock, DockNode::Tabs { panels: vec![], active: 0 }),
-        };
-        let mut groups = vec![];
-        let mut layout_actions = Vec::new();
-        dock::layout_with_actions(ui, &mut dock, body, &t, "", &mut groups, &mut self.auto, &mut layout_actions);
-        let seqs = dock::SeqTabs {
+        let seqs = SeqTabs {
             open: self
                 .session
                 .state
@@ -209,253 +232,334 @@ impl FilmcraftApp {
                 .collect(),
             active: self.session.state.active_sequence.map(|id| id.0),
         };
-        let mut actions = vec![];
-        let mut targets = vec![];
-        for group in &groups {
-            let chrome = dock::draw_group_chrome_details(ui, group, &seqs, &t, &mut self.auto);
-            if let Some(target) = target(group, chrome.tabs, true) {
-                targets.push(target);
-            }
-            actions.extend(chrome.actions);
+        let style = dock_style(ui, &t);
+        // No `monitors`: the monitor list comes with the egui fork's `ViewportInfo::monitors`.
+        let control_input_only = self.control_input_only;
+        let armed = std::sync::Arc::clone(&self.native_ctrl_click_armed);
+        let mut area = DockArea::new(area_id())
+            .float_bounds(self.float_bounds(&ctx))
+            .maximized(self.ui.keys.maximized.filter(|panel| self.ui.dock.is_docked(*panel)))
+            .input_blocked(self.modal_open(&ctx))
+            .native_input_hook(move |_ctx, raw_input| crate::rewrite_native_window_input(control_input_only, &armed, raw_input));
+        if let Some(panel) = self.pending_panel_raise.take() {
+            area = area.raise_panel(panel);
         }
-        if maximized.is_none() {
-            self.ui.dock = dock;
+        let layout = self.ui.dock.clone();
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(body).id_salt("filmcraft-dock-area"));
+        child.set_clip_rect(body.intersect(ui.clip_rect()));
+        let seq_width = dock::sequence_tabs_width(ui, &seqs);
+        // Known before anything draws, so header elements of a native window (the ≡ menu, the
+        // Timeline's sequence tabs), drawn before its bodies, carry that window too.
+        self.auto.windows =
+            self.ui.dock.floating.iter().enumerate().map(|(index, window)| (DockArea::<PanelKind>::window_viewport(area_id(), window.id), index)).collect();
+        let mut content =
+            FilmContent { app: self, seqs, seq_width, tokens: t, seq_actions: Vec::new(), menu: None, bodies: Vec::new(), restore_workspace: false };
+        let output = area.show_content(&mut child, &layout, &style, &mut content);
+        let FilmContent { seq_actions, mut menu, bodies, restore_workspace, .. } = content;
+        ctx.data_mut(|data| data.insert_temp(bodies_id(), bodies));
+        if let Some(panel) = output.focused {
+            self.ui.focused = panel;
         }
-        for group in &groups {
-            if let Some(panel) = group.panels.get(group.active).copied() {
-                self.panel_body(ui, panel, group.content);
+        self.handle_forwarded_keys(&ctx, output.forwarded_events);
+        self.window_files = output.window_files;
+        if let Some(error) = output.error {
+            self.ui.status = error.to_string();
+        }
+        for event in output.events {
+            if let DockEvent::ToggleMaximize { panel } = event {
+                panels::keyboard::toggle_maximize(self, panel);
             }
         }
-        for group in &groups {
-            dock::paint_group_focus(ui, group, self.ui.focused, &t);
-        }
-        let floating_order = self.floating_order(&ctx);
-        for index in floating_order.into_iter().filter(|_| maximized.is_none()) {
-            if let Some(target) = self.floating_group(&ctx, index, &seqs, &mut actions) {
-                targets.push(target);
+        for action in output.actions {
+            for action in self.close_keeping_timeline(action) {
+                if let Err(error) = self.dock_command(&ctx, action) {
+                    self.ui.status = error;
+                }
             }
         }
-        for action in layout_actions {
-            let _ = self.dock_command(&ctx, action);
+        if restore_workspace {
+            let workspace = self.ui.workspace.clone();
+            self.set_workspace(&workspace);
         }
-        for action in actions {
-            match action {
-                DockAction::Activate(panel) => {
-                    let _ = self.dock_command(&ctx, Action::Activate { panel });
-                }
-                DockAction::Close(panel) => {
-                    let _ = self.dock_command(&ctx, Action::Close { panel });
-                }
-                DockAction::Focus(panel) => self.ui.focused = panel,
-                DockAction::BeginDrag(panel) => {
-                    ctx.data_mut(|data| data.insert_temp(drag_id(), panel));
-                }
-                DockAction::OpenSequence(id) => {
-                    let _ = self.dock_command(&ctx, Action::Activate { panel: PanelKind::Timeline });
-                    if self.session.state.active_sequence.map(|item| item.0) != Some(id)
-                        && let Err(error) = self.session.execute("sequence.open", json!({"item": id}))
-                    {
-                        self.ui.status = error.to_string();
+        for action in seq_actions {
+            let result = match action {
+                SeqAction::Open(id) => {
+                    let _ = self.apply_dock(Action::Activate { panel: PanelKind::Timeline });
+                    self.ui.focused = PanelKind::Timeline;
+                    if self.session.state.active_sequence.map(|item| item.0) == Some(id) {
+                        Ok(Value::Null)
+                    } else {
+                        self.session.execute("sequence.open", json!({"item": id}))
                     }
                 }
-                DockAction::CloseSequence(id) => {
-                    if let Err(error) = self.session.execute("sequence.close", json!({"item": id})) {
-                        self.ui.status = error.to_string();
+                SeqAction::Close(id) => self.session.execute("sequence.close", json!({"item": id})),
+                SeqAction::Move(id, index) => self.session.execute("sequence.moveTab", json!({"item": id, "index": index})),
+                SeqAction::Menu(id, pos) => {
+                    menu = Some((PanelKind::Timeline, pos));
+                    self.ui.focused = PanelKind::Timeline;
+                    if self.session.state.active_sequence.map(|item| item.0) == Some(id) {
+                        Ok(Value::Null)
+                    } else {
+                        self.session.execute("sequence.open", json!({"item": id}))
                     }
                 }
-                DockAction::MoveSequence(id, index) => {
-                    if let Err(error) = self.session.execute("sequence.moveTab", json!({"item": id, "index": index})) {
-                        self.ui.status = error.to_string();
-                    }
-                }
-                DockAction::PanelMenu(panel, pos) => {
-                    let frame = ctx.cumulative_frame_nr();
-                    ctx.data_mut(|data| {
-                        data.insert_temp(egui::Id::new("panel-menu"), (panel, pos));
-                        data.insert_temp(egui::Id::new("panel-menu-opened"), frame);
-                    });
-                }
+            };
+            if let Err(error) = result {
+                self.ui.status = error.to_string();
             }
         }
-        self.panel_drag(&ctx, body, &targets);
+        if let Some((panel, pos)) = menu {
+            let frame = ctx.cumulative_frame_nr();
+            ctx.data_mut(|data| {
+                data.insert_temp(egui::Id::unique("panel-menu"), (panel, pos));
+                data.insert_temp(egui::Id::unique("panel-menu-opened"), frame);
+            });
+        }
+        let hits = DockArea::<PanelKind>::hit_rects(&ctx, area_id());
+        self.register_dock_hits(&hits);
         panels::panel_menu_popup(self, ui);
-        self.cancel_value_drag(ui.ctx());
     }
 
-    fn floating_group(&mut self, ctx: &egui::Context, index: usize, seqs: &dock::SeqTabs, actions: &mut Vec<DockAction>) -> Option<DropTarget<PanelKind>> {
-        let floating = self.ui.floating.get(index)?.clone();
-        let panel = *floating.panels.first()?;
-        let rect = floating_rect(&floating, ctx.content_rect());
-        let t = self.tokens;
-        let id = egui::Id::new(("floating-panel", panel.id()));
-        let mut output = None;
-        egui::Area::new(id).order(egui::Order::Middle).fixed_pos(rect.min).constrain(false).interactable(true).show(ctx, |ui| {
-            let (rect, _) = ui.allocate_exact_size(rect.size(), Sense::hover());
-            let compact = floating.panels.len() == 1 && panel.compact();
-            let header = if compact { 8.0 } else { t.tab_h };
-            let strip = Rect::from_min_size(rect.min, vec2(rect.width(), header));
-            let response = ui.interact(strip, id.with("move"), Sense::drag());
-            self.auto.add_response(&format!("panel.float.{index}.move"), &response, "Move floating panel");
-            let mut next = if response.dragged() { rect.translate(response.drag_delta()) } else { rect };
-            let group = Group {
-                path: format!("f{index}"),
-                rect,
-                content: Rect::from_min_max(pos2(rect.min.x, rect.min.y + header), rect.max),
-                panels: floating.panels.clone(),
-                active: floating.active,
+    /// The Timeline's tabs stand for its open sequences: a close from the dock area (a tab's
+    /// middle click or Close Panel, a group, window or Close Other Panels item) that would
+    /// remove the Timeline while a sequence is open closes the active sequence instead, and the
+    /// Timeline stays. The other panels the action covers still close.
+    fn close_keeping_timeline(&mut self, action: Action<PanelKind>) -> Vec<Action<PanelKind>> {
+        if self.session.state.active_sequence.is_none() {
+            return vec![action];
+        }
+        let closed = match self.ui.dock.closed_by(&action) {
+            Ok(closed) if closed.contains(&PanelKind::Timeline) => closed,
+            _ => return vec![action],
+        };
+        if let Err(error) = self.session.execute("sequence.close", json!({})) {
+            self.ui.status = error.to_string();
+        }
+        closed.into_iter().filter(|panel| *panel != PanelKind::Timeline).map(|panel| Action::Close { panel }).collect()
+    }
+
+    /// Automation ids for craft-ui's gesture sources: `panel.tab.<Panel>`, `panel.drag.<Panel>`
+    /// (the group's drag bar), `panel.tabs.more.<Panel>`, `panel.float.<n>.move` and `.resize`,
+    /// `dock.gutter.<path>` (`a`/`b` per split level), `dock.corner.<outer path>.<inner path>`
+    /// where two dividers meet, the same inside floating window `n` as `panel.float.<n>.gutter.…`
+    /// and `panel.float.<n>.corner.…`. Controls of a floating window in its own OS window are
+    /// registered in that window's viewport.
+    fn register_dock_hits(&mut self, hits: &[(Hit<PanelKind>, Rect)]) {
+        let window = |panel: &PanelKind| self.ui.dock.floating.iter().position(|window| window.contains(panel));
+        let native: HashMap<usize, egui::ViewportId> = self.auto.windows.iter().map(|(viewport, index)| (*index, *viewport)).collect();
+        let mut found = Vec::new();
+        for (hit, rect) in hits {
+            let viewport = match hit {
+                Hit::Divider(Divider::Split(_) | Divider::Intersection(..)) => None,
+                Hit::Divider(Divider::WindowSplit(panel, _) | Divider::WindowIntersection(panel, ..))
+                | Hit::Tab(panel)
+                | Hit::DragBar(panel)
+                | Hit::Overflow(panel)
+                | Hit::Title(panel)
+                | Hit::Resize(panel, _) => window(panel).and_then(|index| native.get(&index).copied()),
+                _ => None,
+            }
+            .unwrap_or(egui::ViewportId::ROOT);
+            let entry = match hit {
+                Hit::Tab(panel) => (format!("panel.tab.{}", panel.id()), panel.title()),
+                Hit::DragBar(panel) => (format!("panel.drag.{}", panel.id()), "Move panel"),
+                Hit::Overflow(panel) => (format!("panel.tabs.more.{}", panel.id()), "more tabs"),
+                Hit::Title(panel) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.move"), "Move floating panel"),
+                    None => continue,
+                },
+                Hit::Resize(panel, edge) => match window(panel) {
+                    Some(index) if *edge == ResizeEdge::BottomRight => (format!("panel.float.{index}.resize"), "Resize floating panel"),
+                    Some(index) => (format!("panel.float.{index}.resize.{edge:?}"), "Resize floating panel"),
+                    None => continue,
+                },
+                Hit::Divider(Divider::Split(path)) => (format!("dock.gutter.{}", path_id(path)), "gutter"),
+                Hit::Divider(Divider::Intersection(outer, inner)) => (format!("dock.corner.{}.{}", path_id(outer), path_id(inner)), "gutter corner"),
+                Hit::Divider(Divider::WindowSplit(panel, path)) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.gutter.{}", path_id(path)), "gutter"),
+                    None => continue,
+                },
+                Hit::Divider(Divider::WindowIntersection(panel, outer, inner)) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.corner.{}.{}", path_id(outer), path_id(inner)), "gutter corner"),
+                    None => continue,
+                },
+                _ => continue,
             };
-            let chrome = dock::draw_group_chrome_details(ui, &group, seqs, &t, &mut self.auto);
-            actions.extend(chrome.actions);
-            if let Some(active) = group.panels.get(group.active).copied() {
-                self.panel_body(ui, active, group.content);
-            }
-            ui.painter().rect_stroke(rect, t.radius, Stroke::new(1.0, t.focus), StrokeKind::Outside);
-            let grip = Rect::from_min_max(rect.max - vec2(14.0, 14.0), rect.max);
-            let response = ui.interact(grip, id.with("resize"), Sense::click_and_drag());
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, response.enabled(), tl!("Resize floating panel")));
-            self.auto.add_response(&format!("panel.float.{index}.resize"), &response, "Resize floating panel");
-            for step in 0..3 {
-                let offset = 4.0 + step as f32 * 4.0;
-                ui.painter()
-                    .line_segment([pos2(rect.max.x - offset, rect.max.y - 2.0), pos2(rect.max.x - 2.0, rect.max.y - offset)], Stroke::new(1.0, t.text_faint));
-            }
-            if response.hovered() || response.dragged() {
-                ctx.set_cursor_icon(egui::CursorIcon::ResizeNwSe);
-            }
-            let delta = floating_resize_delta(ui, &response);
-            if response.has_focus() {
-                ui.painter().rect_stroke(grip, 2.0, Stroke::new(1.5, t.focus), StrokeKind::Inside);
-            }
-            if delta != egui::Vec2::ZERO {
-                next = Rect::from_min_size(next.min, (next.size() + delta).max(vec2(160.0, 100.0)));
-            }
-            if next != rect {
-                let _ = self.dock_command(ctx, Action::MoveFloating { panel, rect: [next.min.x, next.min.y, next.width(), next.height()] });
-            }
-            dock::paint_group_focus(ui, &group, self.ui.focused, &t);
-            output = target(&group, chrome.tabs, false);
-        });
-        output
-    }
-
-    fn panel_drag(&mut self, ctx: &egui::Context, body: Rect, targets: &[DropTarget<PanelKind>]) {
-        let Some(panel) = ctx.data(|data| data.get_temp::<PanelKind>(drag_id())) else { return };
-        let canceled =
-            ctx.input(|input| input.key_pressed(egui::Key::Escape) || !input.focused || (!input.pointer.primary_down() && !input.pointer.primary_released()));
-        if canceled || (!self.ui.dock.contains(panel) && !self.ui.floating.iter().any(|group| group.panels.contains(&panel))) {
-            ctx.data_mut(|data| data.remove::<PanelKind>(drag_id()));
-            return;
+            found.push((entry, *rect, DockArea::hit_id(area_id(), hit), viewport));
         }
-        let Some(pos) = ctx.pointer_latest_pos() else { return };
-        let force_float = ctx.input(|input| input.modifiers.command);
-        let edge = (!force_float).then(|| workspace_edge(body, pos, targets)).flatten();
-        let proposal = (!force_float && edge.is_none()).then(|| resolve_drop(&panel, pos, targets)).flatten();
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("dock-drop")));
+        // The widget id lets keyboard focus on a divider or grip map to its element (shortcuts
+        // stay live while one is focused).
+        for ((id, label), rect, widget, viewport) in found {
+            self.auto.add_in(viewport, &id, rect, label);
+            if let Some(element) = self.auto.elements.last_mut() {
+                element.widget_id = Some(format!("{:016x}", widget.value()));
+                element.response_id = Some(widget);
+            }
+        }
+    }
+}
+
+/// A split path as `a`/`b` per level (first/second child).
+fn path_id(path: &[bool]) -> String {
+    path.iter().map(|second| if *second { 'b' } else { 'a' }).collect()
+}
+
+/// FilmCraft's window is all groups: drops on all four window edges, Ctrl/Cmd-drag undocks, a
+/// release over no target cancels, and a floating window's title bar only moves it.
+fn dock_style(ui: &egui::Ui, t: &Tokens) -> DockStyle {
+    let mut style = DockStyle::from_ui(ui);
+    style.side_edge_zones = true;
+    style.new_dock_zones = false;
+    style.maximize_item = true;
+    style.close_others_item = true;
+    style.command_press_floats = true;
+    style.float_on_empty_drop = false;
+    style.title_bar_docks = false;
+    style.float_hint = true;
+    style.wheel_selects_tabs = true;
+    style.middle_click_closes_tabs = true;
+    style.float_label = "Undock Panel".into();
+    style.float_group_label = "Undock Panel Group".into();
+    style.close_group_label = "Close Panel Group".into();
+    style.tab_height = t.tab_h;
+    style.gap = t.gap;
+    style.background = t.panel_bg;
+    style.tab_background = t.tab_bg;
+    style.active_background = t.panel_bg;
+    style.floating_background = t.panel_bg;
+    style.text = t.tab_text_active;
+    style.inactive_text = t.tab_text;
+    style.accent = t.focus;
+    style.font = Tokens::ui(12.0);
+    style
+}
+
+/// FilmCraft's side of the dock area for one frame.
+struct FilmContent<'a> {
+    app: &'a mut FilmcraftApp,
+    seqs: SeqTabs,
+    /// The width the sequence tabs take in the Timeline's tab strip.
+    seq_width: f32,
+    tokens: Tokens,
+    seq_actions: Vec<SeqAction>,
+    /// The ≡ button clicked: its panel and where its menu opens.
+    menu: Option<(PanelKind, egui::Pos2)>,
+    bodies: Vec<(PanelKind, Rect, egui::LayerId)>,
+    /// Restore Workspace chosen in a tab's menu; it replaces the layout after the dock area is drawn.
+    restore_workspace: bool,
+}
+
+impl DockContent<PanelKind> for FilmContent<'_> {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &PanelKind) {
         let t = self.tokens;
-        if let Some((_, _, preview)) = edge {
-            painter.rect_filled(preview.shrink(2.0), t.radius, t.focus.gamma_multiply(0.2));
-            painter.rect_stroke(preview.shrink(2.0), t.radius, Stroke::new(2.0, t.focus), StrokeKind::Inside);
+        let frame = ui.max_rect();
+        let rect = frame;
+        self.bodies.push((*panel, rect, ui.layer_id()));
+        // A panel in its own OS window draws in that window's coordinates: its automation
+        // elements carry the window so they are not matched against main-window points.
+        let viewport = ui.ctx().viewport_id();
+        self.app.auto.viewport = viewport;
+        self.app.auto.add(&format!("panel.{}", panel.id()), rect, panel.title());
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(rect).id_salt(("panel", panel.id())));
+        child.set_clip_rect(rect.intersect(ui.clip_rect()));
+        panels::show(self.app, &mut child, *panel, rect);
+        // FilmCraft's drag payload lives in context data, not egui's drag-and-drop, so craft-ui
+        // routes it to the native window under the pointer only when asked, each frame.
+        if panels::dragging(ui.ctx()) {
+            craft_ui::docking::route_app_drag(ui.ctx(), area_id());
         }
-        if let Some(proposal) = &proposal {
-            painter.rect_filled(proposal.preview.shrink(2.0), t.radius, t.focus.gamma_multiply(0.2));
-            painter.rect_stroke(proposal.preview.shrink(2.0), t.radius, Stroke::new(2.0, t.focus), StrokeKind::Inside);
-            if let Some(mark) = proposal.insertion {
-                painter.rect_filled(mark, 0.0, t.focus);
-            }
+        self.app.auto.viewport = egui::ViewportId::ROOT;
+        // The body fills its frame; allocating it lets a floated panel take its full size.
+        ui.allocate_rect(ui.max_rect(), Sense::hover());
+        // Painted after the body so child backgrounds cannot hide the focus outline (#1075).
+        if self.app.ui.focused == *panel {
+            ui.painter().rect_stroke(frame, 0.0, Stroke::new(1.0, t.focus), StrokeKind::Inside);
         }
-        let title = painter.layout_no_wrap(panel.title().to_owned(), crate::theme::Tokens::ui(12.0), Color32::WHITE);
-        let ghost = Rect::from_min_size(pos + vec2(12.0, 10.0), title.size() + vec2(16.0, 8.0));
-        painter.rect_filled(ghost, 4.0, t.focus.gamma_multiply(0.85));
-        painter.galley(ghost.min + vec2(8.0, 4.0), title, Color32::WHITE);
-        ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
-        ctx.request_repaint();
-        if ctx.input(|input| input.pointer.primary_released()) {
-            ctx.data_mut(|data| data.remove::<PanelKind>(drag_id()));
-            if let Some((_, zone, _)) = edge {
-                if crate::menus::invoke(self, ctx, "window.dockPanel", json!({"panel": panel.id(), "zone": zone})).is_ok() {
-                    self.ui.focused = panel;
+    }
+
+    /// A native floating window drew its last body: its end-of-pass IME check, for the Program
+    /// monitor's text editor when it is there.
+    fn window_drawn(&mut self, ui: &mut egui::Ui) {
+        self.app.finish_ime_window(ui.ctx());
+    }
+
+    fn logical_label(&self, panel: &PanelKind) -> String {
+        crate::i18n::t(panel.title()).to_string()
+    }
+
+    /// Every floating panel gets its own OS window on desktop.
+    fn allow_native(&self, _panel: &PanelKind) -> bool {
+        true
+    }
+
+    /// The video viewers float as normal windows, say on a second display; the other panels
+    /// are palettes.
+    fn window_kind(&self, panel: &PanelKind) -> WindowKind {
+        match panel {
+            PanelKind::Program | PanelKind::Source | PanelKind::ReferenceMonitor | PanelKind::LumetriScopes => WindowKind::Normal,
+            _ => WindowKind::Palette,
+        }
+    }
+
+    /// With no sequence open, the Timeline's tab says so.
+    fn label(&mut self, _ui: &egui::Ui, panel: &PanelKind, logical: &str, _font: &egui::FontId, _color: egui::Color32) -> egui::WidgetText {
+        if *panel == PanelKind::Timeline && self.seqs.open.is_empty() { self.seqs.label().into() } else { logical.into() }
+    }
+
+    /// FilmCraft's own panel items head a tab's context menu, as in its ≡ menu; craft-ui adds
+    /// Undock, Move, Close and the group items after them.
+    fn panel_menu(&mut self, ui: &mut egui::Ui, panel: &PanelKind) {
+        let app = &mut *self.app;
+        let mut close = false;
+        if *panel == PanelKind::Timeline && app.session.state.active_sequence.is_some() {
+            let response = ui.add_enabled(app.session.state.open_sequences.len() > 1, egui::Button::new(tl!("Close Other Timeline Panels")));
+            app.auto.add_response("panel.tabMenu.Timeline.closeOthers", &response, "Close Other Timeline Panels");
+            if response.clicked() {
+                if let Err(error) = app.session.execute("sequence.closeOthers", json!({})) {
+                    app.ui.status = error.to_string();
                 }
-                return;
-            }
-            let action = match proposal {
-                Some(proposal) => Some(Action::Move { panel, anchor: proposal.anchor, placement: proposal.placement }),
-                None if force_float || !targets.iter().any(|target| target.rect.contains(pos)) => {
-                    Some(Action::Float { panel, rect: [pos.x - 40.0, pos.y - 12.0, 420.0, 320.0] })
-                }
-                None => None,
-            };
-            if let Some(action) = action
-                && self.dock_command(ctx, action).is_ok()
-            {
-                self.ui.focused = panel;
+                close = true;
             }
         }
+        let response = ui.button(tl!("Restore Workspace"));
+        app.auto.add_response(&format!("panel.tabMenu.{}.restoreWorkspace", panel.id()), &response, "Restore Workspace");
+        if response.clicked() {
+            self.restore_workspace = true;
+            close = true;
+        }
+        close |= panels::panel_items(app, ui, *panel);
+        ui.separator();
+        if close {
+            ui.close();
+        }
+    }
+
+    /// The ≡ menu, and the Timeline's sequence tabs before it while the Timeline is shown.
+    /// The sequence tabs take at most two thirds of the strip, so the group's own tabs keep room;
+    /// past that they scroll into their » list.
+    fn group_header_width(&self, _panels: &[PanelKind], active: &PanelKind, _floating: bool, strip_width: f32) -> f32 {
+        if *active == PanelKind::Timeline && !self.seqs.open.is_empty() { (self.seq_width + MENU_W).min(strip_width * 2.0 / 3.0).max(MENU_W) } else { MENU_W }
+    }
+
+    /// The ≡ panel menu of the group's shown panel; for the Timeline, its sequence tabs first.
+    fn group_header(&mut self, ui: &mut egui::Ui, _panels: &[PanelKind], active: &PanelKind, _floating: bool) {
+        let t = self.tokens;
+        let header = ui.max_rect();
+        let menu = Rect::from_min_max(egui::pos2((header.max.x - MENU_W).max(header.min.x), header.min.y), header.max);
+        if *active == PanelKind::Timeline && !self.seqs.open.is_empty() {
+            let strip = Rect::from_min_max(header.min, egui::pos2(menu.min.x, header.max.y));
+            self.seq_actions.extend(dock::sequence_tabs(ui, strip, &self.seqs, &t, &mut self.app.auto));
+        }
+        let rect = Rect::from_center_size(menu.center(), vec2(18.0, 18.0));
+        let response = ui.interact(rect, egui::Id::unique(("panel-menu-button", active.id())), Sense::click());
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, response.enabled(), "panel menu"));
+        self.app.auto.add_response(&format!("panel.menu.{}", active.id()), &response, "panel menu");
+        let color = if response.hovered() { t.tab_text_active } else { t.tab_text };
+        icons::paint(ui.painter(), Rect::from_center_size(rect.center(), vec2(16.0, 16.0)), Icon::Hamburger, color);
+        dock::paint_widget_focus(ui.painter(), &response, &t);
+        if response.clicked() {
+            self.app.ui.focused = *active;
+            self.menu = Some((*active, rect.left_bottom()));
+        }
     }
 }
-
-/// Width of the band along the workspace border that docks beside the whole layout.
-const EDGE_BAND: f32 = 8.0;
-
-/// The outermost drop zone: near the workspace border a drop splits the root, not the group
-/// under the pointer. A floating group over the border (it rejects splits) keeps the drop.
-fn workspace_edge(body: Rect, pos: egui::Pos2, targets: &[DropTarget<PanelKind>]) -> Option<(Zone, &'static str, Rect)> {
-    if !body.is_finite() || !body.contains(pos) || targets.iter().any(|target| !target.allow_splits && target.rect.contains(pos)) {
-        return None;
-    }
-    let band = EDGE_BAND.min(body.width() / 4.0).min(body.height() / 4.0);
-    let edges = [
-        (pos.x - body.left(), Zone::Left, "left"),
-        (body.right() - pos.x, Zone::Right, "right"),
-        (pos.y - body.top(), Zone::Top, "top"),
-        (body.bottom() - pos.y, Zone::Bottom, "bottom"),
-    ];
-    let (distance, zone, name) = edges.into_iter().min_by(|a, b| a.0.total_cmp(&b.0))?;
-    if distance > band {
-        return None;
-    }
-    let size = body.size() * 0.25;
-    let preview = match zone {
-        Zone::Left => Rect::from_min_size(body.min, vec2(size.x, body.height())),
-        Zone::Right => Rect::from_min_max(pos2(body.right() - size.x, body.top()), body.max),
-        Zone::Top => Rect::from_min_size(body.min, vec2(body.width(), size.y)),
-        Zone::Bottom | Zone::Center => Rect::from_min_max(pos2(body.left(), body.bottom() - size.y), body.max),
-    };
-    Some((zone, name, preview))
-}
-
-fn target(group: &Group, mut tabs: Vec<(PanelKind, Rect)>, allow_splits: bool) -> Option<DropTarget<PanelKind>> {
-    let strip = Rect::from_min_max(group.rect.min, pos2(group.rect.max.x, group.content.min.y));
-    // A compact grip still identifies the source group to the shared resolver.
-    for panel in &group.panels {
-        if !tabs.iter().any(|(candidate, _)| candidate == panel) {
-            tabs.push((*panel, Rect::NOTHING));
-        }
-    }
-    Some(DropTarget { anchor: *group.panels.get(group.active)?, rect: group.rect, tab_strip: Some(strip), tabs, allow_splits, accepts_tabs: true })
-}
-
-/// A corner is a two-axis resize control; focused arrows belong to it and Tab moves on.
-fn floating_resize_delta(ui: &mut egui::Ui, response: &egui::Response) -> egui::Vec2 {
-    if response.drag_started() {
-        response.request_focus();
-    }
-    let mut delta = if response.dragged() { response.drag_delta() } else { egui::Vec2::ZERO };
-    if response.has_focus() {
-        ui.memory_mut(|memory| {
-            memory.set_focus_lock_filter(response.id, egui::EventFilter { horizontal_arrows: true, vertical_arrows: true, ..Default::default() })
-        });
-        ui.input_mut(|input| {
-            for (key, amount) in [
-                (egui::Key::ArrowLeft, vec2(-8.0, 0.0)),
-                (egui::Key::ArrowRight, vec2(8.0, 0.0)),
-                (egui::Key::ArrowUp, vec2(0.0, -8.0)),
-                (egui::Key::ArrowDown, vec2(0.0, 8.0)),
-            ] {
-                if input.consume_key(egui::Modifiers::NONE, key) {
-                    delta += amount;
-                }
-            }
-        });
-    }
-    if response.enabled() { delta } else { egui::Vec2::ZERO }
-}
diff --git a/crates/ui-egui/src/frames.rs b/crates/ui-egui/src/frames.rs
index 496372e05..f2ec94dd7 100644
--- a/crates/ui-egui/src/frames.rs
+++ b/crates/ui-egui/src/frames.rs
@@ -10,7 +10,7 @@
 use std::cell::Cell;
 use std::collections::{HashMap, VecDeque};
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Condvar, Mutex};
+use std::sync::{Arc, Condvar, Mutex, PoisonError};
 use std::time::Duration;
 
 use web_time::Instant;
@@ -33,6 +33,10 @@ pub enum Target {
     MulticamGrid(ItemId, u8, u16),
     /// One angle of a multi-camera source (Edit Cameras thumbnails).
     MulticamAngle(ItemId, u32),
+    /// Composite of a sequence rendered live, never from a render preview: previews are
+    /// flattened over black, and the monitors' Transparency Grid and Alpha display mode need the
+    /// frame's alpha.
+    SequenceLive(ItemId),
 }
 
 /// Item jobs at this priority or a larger number are background work: thumbnails of the Project
@@ -71,12 +75,61 @@ pub fn draft_playback(playing: bool, scale: f32, enabled: bool) -> bool {
     enabled && playing && scale <= 0.5
 }
 
+/// A rendered frame as sRGB RGBA8: the color is the picture over black and the fourth byte is
+/// its alpha ([`filmcraft_render::Image::over_black_with_alpha_rgba8`]).
 pub struct Rgba {
     pub w: usize,
     pub h: usize,
     pub px: Vec<u8>,
 }
 
+impl Rgba {
+    /// The frame as a texture image: opaque (the picture over black), or with its alpha, so what
+    /// is painted under it shows through its transparent areas.
+    pub fn color_image(&self, alpha: bool) -> egui::ColorImage {
+        let pixels = if alpha {
+            self.px.as_chunks::<4>().0.iter().map(|p| gamma_premultiplied(*p)).collect()
+        } else {
+            self.px.as_chunks::<4>().0.iter().map(|p| egui::Color32::from_rgb(p[0], p[1], p[2])).collect()
+        };
+        egui::ColorImage::new([self.w, self.h], pixels)
+    }
+}
+
+/// A frame pixel (sRGB of the linear color premultiplied by alpha) as egui's color, which is the
+/// sRGB of the straight color multiplied by alpha.
+fn gamma_premultiplied([r, g, b, a]: [u8; 4]) -> egui::Color32 {
+    match a {
+        255 => egui::Color32::from_rgb(r, g, b),
+        0 => egui::Color32::TRANSPARENT,
+        _ => {
+            let straight = |v: u8| straight_srgb(a, v);
+            egui::Color32::from_rgba_unmultiplied(straight(r), straight(g), straight(b), a)
+        }
+    }
+}
+
+/// The sRGB of the straight color whose premultiplied value is sRGB `v` at alpha `a`, from a table
+/// made on first use: a frame with partial alpha would otherwise take two `powf` per channel per
+/// pixel on every upload.
+fn straight_srgb(a: u8, v: u8) -> u8 {
+    static TABLE: std::sync::OnceLock<Vec<u8>> = std::sync::OnceLock::new();
+    let table = TABLE.get_or_init(|| {
+        use egui::ecolor::{gamma_u8_from_linear_f32, linear_f32_from_gamma_u8};
+        let mut t = vec![0u8; 256 * 256];
+        for a in 1..=255u8 {
+            let k = f32::from(a) / 255.0;
+            for v in 0..=255u8 {
+                if let Some(x) = t.get_mut(usize::from(a) * 256 + usize::from(v)) {
+                    *x = gamma_u8_from_linear_f32((linear_f32_from_gamma_u8(v) / k).min(1.0));
+                }
+            }
+        }
+        t
+    });
+    table.get(usize::from(a) * 256 + usize::from(v)).copied().unwrap_or(v)
+}
+
 struct Job {
     key: FrameKey,
     queued: Instant,
@@ -112,6 +165,8 @@ struct Shared {
     workers: usize,
     /// Always-on counters for `perf.stats`.
     stats: Mutex<FrameStats>,
+    /// Set (under the queue lock) when the [`FrameServer`] is dropped: the workers return.
+    stop: AtomicBool,
 }
 
 /// Cumulative frame-job statistics (`perf.stats`): cheap enough to keep on all the time.
@@ -394,7 +449,7 @@ pub fn playback_plan(render_cost: f64, fps: f64, workers: usize) -> (i64, i64) {
 impl FrameServer {
     /// Settings ▸ Memory ▸ frame cache budget (bytes); evicts down to it right away.
     pub fn set_cache_budget(&self, bytes: usize) {
-        let mut c = self.shared.done.lock().unwrap_or_else(|e| e.into_inner());
+        let mut c = self.shared.done.lock().unwrap_or_else(PoisonError::into_inner);
         c.budget = bytes.max(16 << 20);
         if c.bytes > c.budget
             && let Some((k, v)) = c.map.iter().next().map(|(k, (v, _))| (*k, v.clone()))
@@ -406,7 +461,7 @@ impl FrameServer {
 
     /// (bytes cached, budget).
     pub fn cache_usage(&self) -> (usize, usize) {
-        let c = self.shared.done.lock().unwrap_or_else(|e| e.into_inner());
+        let c = self.shared.done.lock().unwrap_or_else(PoisonError::into_inner);
         (c.bytes, c.budget)
     }
 
@@ -422,6 +477,7 @@ impl FrameServer {
             render_cost: Mutex::new(0.0),
             workers: workers.max(1),
             stats: Mutex::new(FrameStats::default()),
+            stop: AtomicBool::new(false),
         });
         let repaint: Arc<Mutex<Option<Box<dyn Fn() + Send + Sync>>>> = Arc::new(Mutex::new(None));
         #[cfg(not(target_arch = "wasm32"))]
@@ -444,7 +500,7 @@ impl FrameServer {
     }
 
     pub fn set_context(&self, ctx: &egui::Context) {
-        let mut g = self.repaint.lock().unwrap_or_else(|e| e.into_inner());
+        let mut g = self.repaint.lock().unwrap_or_else(PoisonError::into_inner);
         if g.is_none() {
             let ctx = ctx.clone();
             *g = Some(Box::new(move || ctx.request_repaint()));
@@ -457,12 +513,12 @@ impl FrameServer {
     }
 
     pub fn take_records(&self) -> Vec<JobRecord> {
-        std::mem::take(&mut *self.shared.records.lock().unwrap_or_else(|e| e.into_inner()))
+        std::mem::take(&mut *self.shared.records.lock().unwrap_or_else(PoisonError::into_inner))
     }
 
     /// Cumulative job statistics (`perf.stats`).
     pub fn stats(&self) -> FrameStats {
-        self.shared.stats.lock().unwrap_or_else(|e| e.into_inner()).clone()
+        self.shared.stats.lock().unwrap_or_else(PoisonError::into_inner).clone()
     }
 
     /// Worker threads.
@@ -473,15 +529,15 @@ impl FrameServer {
     /// (cached images, their bytes, cached GPU plans, their bytes).
     pub fn cache_entries(&self) -> (usize, usize, usize, usize) {
         let (n, b) = {
-            let c = self.shared.done.lock().unwrap_or_else(|e| e.into_inner());
+            let c = self.shared.done.lock().unwrap_or_else(PoisonError::into_inner);
             (c.map.len(), c.bytes)
         };
-        let p = self.shared.plans.lock().unwrap_or_else(|e| e.into_inner());
+        let p = self.shared.plans.lock().unwrap_or_else(PoisonError::into_inner);
         (n, b, p.map.len(), p.bytes)
     }
 
     pub fn get(&self, k: &FrameKey) -> Option<Arc<Rgba>> {
-        let mut c = self.shared.done.lock().unwrap_or_else(|e| e.into_inner());
+        let mut c = self.shared.done.lock().unwrap_or_else(PoisonError::into_inner);
         c.clock += 1;
         let clock = c.clock;
         c.map.get_mut(k).map(|(v, s)| {
@@ -491,20 +547,20 @@ impl FrameServer {
     }
 
     pub fn get_plan(&self, k: &FrameKey) -> Option<Arc<GpuPlan>> {
-        self.shared.plans.lock().unwrap_or_else(|e| e.into_inner()).get(k)
+        self.shared.plans.lock().unwrap_or_else(PoisonError::into_inner).get(k)
     }
 
     /// Whether the exact frame (image or plan) is ready.
     pub fn is_ready(&self, k: &FrameKey) -> bool {
         match k.target {
-            Target::SequencePlan(_) => self.shared.plans.lock().unwrap_or_else(|e| e.into_inner()).map.contains_key(k),
-            _ => self.shared.done.lock().unwrap_or_else(|e| e.into_inner()).map.contains_key(k),
+            Target::SequencePlan(_) => self.shared.plans.lock().unwrap_or_else(PoisonError::into_inner).map.contains_key(k),
+            _ => self.shared.done.lock().unwrap_or_else(PoisonError::into_inner).map.contains_key(k),
         }
     }
 
     /// Nearest cached plan at or before `frame`.
     pub fn nearest_plan(&self, key: FrameKey, max_back: i64) -> Option<(FrameKey, Arc<GpuPlan>)> {
-        let mut g = self.shared.plans.lock().unwrap_or_else(|e| e.into_inner());
+        let mut g = self.shared.plans.lock().unwrap_or_else(PoisonError::into_inner);
         (0..=max_back).find_map(|d| {
             let k = FrameKey { frame: key.frame - d, ..key };
             g.get(&k).map(|p| (k, p))
@@ -522,18 +578,18 @@ impl FrameServer {
     }
 
     fn request_job(&self, key: FrameKey, time: Tick, scale: f32, project: &Arc<Project>, prio: u32, prefetch: bool, catch_up: Option<Tick>) {
-        let hit = || self.shared.stats.lock().unwrap_or_else(|e| e.into_inner()).request_hits += 1;
-        if self.shared.done.lock().unwrap_or_else(|e| e.into_inner()).map.contains_key(&key)
-            || self.shared.plans.lock().unwrap_or_else(|e| e.into_inner()).map.contains_key(&key)
+        let hit = || self.shared.stats.lock().unwrap_or_else(PoisonError::into_inner).request_hits += 1;
+        if self.shared.done.lock().unwrap_or_else(PoisonError::into_inner).map.contains_key(&key)
+            || self.shared.plans.lock().unwrap_or_else(PoisonError::into_inner).map.contains_key(&key)
         {
             hit();
             return;
         }
-        if self.shared.in_flight.lock().unwrap_or_else(|e| e.into_inner()).iter().any(|(k, c, _)| *k == key && !c.load(Ordering::Relaxed)) {
+        if self.shared.in_flight.lock().unwrap_or_else(PoisonError::into_inner).iter().any(|(k, c, _)| *k == key && !c.load(Ordering::Relaxed)) {
             hit();
             return;
         }
-        let mut q = self.shared.queue.lock().unwrap_or_else(|e| e.into_inner());
+        let mut q = self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner);
         if let Some(j) = q.iter_mut().find(|j| j.key == key) {
             j.prio = j.prio.min(prio);
             j.prefetch &= prefetch;
@@ -546,7 +602,7 @@ impl FrameServer {
             hit();
             return;
         }
-        self.shared.stats.lock().unwrap_or_else(|e| e.into_inner()).request_misses += 1;
+        self.shared.stats.lock().unwrap_or_else(PoisonError::into_inner).request_misses += 1;
         if prio == 0 {
             // A new frame on screen for this view replaces the one asked for before: scrubbing
             // asks for one per refresh, and without this the oldest position would decode
@@ -558,7 +614,7 @@ impl FrameServer {
             // refresh, cancelling each one for the next would show nothing until the mouse rests.
             let same_view = |k: &FrameKey| k.target == key.target && k.size == key.size;
             q.retain(|j| !(j.prio == 0 && !j.prefetch && same_view(&j.key)));
-            for (k, c, prefetch) in self.shared.in_flight.lock().unwrap_or_else(|e| e.into_inner()).iter() {
+            for (k, c, prefetch) in self.shared.in_flight.lock().unwrap_or_else(PoisonError::into_inner).iter() {
                 if !prefetch && same_view(k) && k.frame != key.frame {
                     c.store(true, Ordering::Relaxed);
                 }
@@ -610,15 +666,15 @@ impl FrameServer {
 
     /// The current per-frame render cost estimate (s), see [`playback_plan`].
     pub fn render_cost(&self) -> f64 {
-        *self.shared.render_cost.lock().unwrap_or_else(|e| e.into_inner())
+        *self.shared.render_cost.lock().unwrap_or_else(PoisonError::into_inner)
     }
 
     /// Drop queued jobs that fail `keep` (e.g. stale revisions or frames far from the playhead).
     /// Jobs already running for such frames are cancelled: a worker blocked behind a decoder
     /// would otherwise go on to decode a frame playback has passed, possibly from its keyframe.
     pub fn retain_queue(&self, keep: impl Fn(&FrameKey) -> bool) {
-        self.shared.queue.lock().unwrap_or_else(|e| e.into_inner()).retain(|j| keep(&j.key));
-        for (k, c, _) in self.shared.in_flight.lock().unwrap_or_else(|e| e.into_inner()).iter() {
+        self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner).retain(|j| keep(&j.key));
+        for (k, c, _) in self.shared.in_flight.lock().unwrap_or_else(PoisonError::into_inner).iter() {
             if !keep(k) {
                 c.store(true, Ordering::Relaxed);
             }
@@ -628,8 +684,8 @@ impl FrameServer {
     /// Playback stopped: drop its queued prefetch jobs and cancel the running ones (left alone,
     /// they would keep the workers busy, e.g. rendering effects for frames nobody will see).
     pub fn stop_prefetch(&self) {
-        self.shared.queue.lock().unwrap_or_else(|e| e.into_inner()).retain(|j| !j.prefetch);
-        for (_, c, prefetch) in self.shared.in_flight.lock().unwrap_or_else(|e| e.into_inner()).iter() {
+        self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner).retain(|j| !j.prefetch);
+        for (_, c, prefetch) in self.shared.in_flight.lock().unwrap_or_else(PoisonError::into_inner).iter() {
             if *prefetch {
                 c.store(true, Ordering::Relaxed);
             }
@@ -637,7 +693,7 @@ impl FrameServer {
     }
 
     pub fn queue_len(&self) -> usize {
-        self.shared.queue.lock().unwrap_or_else(|e| e.into_inner()).len()
+        self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner).len()
     }
 
     /// The most recent cached frame for `target` at or before `frame` within `max_back` frames.
@@ -662,7 +718,7 @@ impl FrameServer {
         let mut retry = Vec::new();
         loop {
             let job = {
-                let mut q = self.shared.queue.lock().unwrap_or_else(|e| e.into_inner());
+                let mut q = self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner);
                 if q.is_empty() {
                     break;
                 }
@@ -682,7 +738,7 @@ impl FrameServer {
             }
         }
         if !retry.is_empty() {
-            let mut q = self.shared.queue.lock().unwrap_or_else(|e| e.into_inner());
+            let mut q = self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner);
             for j in retry.into_iter().rev() {
                 if !q.iter().any(|x| x.key == j.key) {
                     q.push_front(j);
@@ -693,6 +749,21 @@ impl FrameServer {
     }
 }
 
+impl Drop for FrameServer {
+    /// Stop the workers: queued jobs are dropped, running ones are cancelled, and each worker
+    /// returns once it has no job, releasing the frame cache, the media pool and the services.
+    fn drop(&mut self) {
+        let mut q = self.shared.queue.lock().unwrap_or_else(PoisonError::into_inner);
+        self.shared.stop.store(true, Ordering::Relaxed);
+        q.clear();
+        drop(q);
+        for (_, c, _) in self.shared.in_flight.lock().unwrap_or_else(PoisonError::into_inner).iter() {
+            c.store(true, Ordering::Relaxed);
+        }
+        self.shared.cv.notify_all();
+    }
+}
+
 /// Counts shown and dropped frames while playing.
 ///
 /// A frame of the timeline is *shown* when its exact picture was on screen at some refresh while
@@ -773,8 +844,11 @@ fn worker(
 ) {
     loop {
         let job = {
-            let mut q = sh.queue.lock().unwrap_or_else(|e| e.into_inner());
+            let mut q = sh.queue.lock().unwrap_or_else(PoisonError::into_inner);
             loop {
+                if sh.stop.load(Ordering::Relaxed) {
+                    return;
+                }
                 if !q.is_empty() {
                     // highest priority (lowest number) first; FIFO among equals
                     let best = q.iter().enumerate().min_by_key(|(i, j)| (j.prio, *i)).map(|(i, _)| i).unwrap_or(0);
@@ -782,7 +856,7 @@ fn worker(
                         break job;
                     }
                 }
-                q = sh.cv.wait(q).unwrap_or_else(|e| e.into_inner());
+                q = sh.cv.wait(q).unwrap_or_else(PoisonError::into_inner);
             }
         };
         // A panic while decoding or rendering one frame (bad media, a decoder bug) must not take
@@ -790,11 +864,11 @@ fn worker(
         // monitors blank. Log it, forget the job and keep serving.
         let ran = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| run_job(&sh, &job, &pool, &services, &previews)));
         if ran.is_err() {
-            sh.in_flight.lock().unwrap_or_else(|e| e.into_inner()).retain(|(k, c, _)| !(*k == job.key && Arc::ptr_eq(c, &job.cancel)));
-            sh.stats.lock().unwrap_or_else(|e| e.into_inner()).failed += 1;
+            sh.in_flight.lock().unwrap_or_else(PoisonError::into_inner).retain(|(k, c, _)| !(*k == job.key && Arc::ptr_eq(c, &job.cancel)));
+            sh.stats.lock().unwrap_or_else(PoisonError::into_inner).failed += 1;
             log::error!("frame job {:?} panicked; the worker continues", job.key);
         }
-        if let Some(f) = repaint.lock().unwrap_or_else(|e| e.into_inner()).as_ref() {
+        if let Some(f) = repaint.lock().unwrap_or_else(PoisonError::into_inner).as_ref() {
             f();
         }
     }
@@ -811,7 +885,15 @@ pub fn inject_job_panics(n: u32) {
 static INJECT_PANICS: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
 
 fn run_job(sh: &Shared, job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Services>, previews: &PreviewStore) -> bool {
-    sh.in_flight.lock().unwrap_or_else(|e| e.into_inner()).push((job.key, job.cancel.clone(), job.prefetch));
+    {
+        let mut in_flight = sh.in_flight.lock().unwrap_or_else(PoisonError::into_inner);
+        // A job taken from the queue just before the server was dropped is not in the list
+        // that `Drop` cancels.
+        if sh.stop.load(Ordering::Relaxed) {
+            job.cancel.store(true, Ordering::Relaxed);
+        }
+        in_flight.push((job.key, job.cancel.clone(), job.prefetch));
+    }
     if INJECT_PANICS.load(Ordering::Relaxed) > 0 && INJECT_PANICS.fetch_sub(1, Ordering::Relaxed) > 0 {
         crate::crash::injected_fault("injected frame-job fault");
     }
@@ -834,14 +916,14 @@ fn run_job(sh: &Shared, job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Ser
                         if !job.cancel.load(Ordering::Relaxed) && !loading {
                             // Convert texels for upload here, not on the UI thread when the frame is shown.
                             let prepared = filmcraft_gpu::prepare(&plan);
-                            sh.plans.lock().unwrap_or_else(|e| e.into_inner()).insert(job.key, GpuPlan { plan, prepared });
+                            sh.plans.lock().unwrap_or_else(PoisonError::into_inner).insert(job.key, GpuPlan { plan, prepared });
                         }
                         pv
                     } else {
                         let (img, pv) = render_job(job, pool, services, previews);
                         loading = filmcraft_media::pending::take();
                         if !job.cancel.load(Ordering::Relaxed) && !loading {
-                            sh.done.lock().unwrap_or_else(|e| e.into_inner()).insert(job.key, Arc::new(img));
+                            sh.done.lock().unwrap_or_else(PoisonError::into_inner).insert(job.key, Arc::new(img));
                         }
                         pv
                     }
@@ -850,13 +932,13 @@ fn run_job(sh: &Shared, job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Ser
         })
     });
     let cancelled = job.cancel.load(Ordering::Relaxed);
-    sh.in_flight.lock().unwrap_or_else(|e| e.into_inner()).retain(|(k, c, _)| !(*k == job.key && Arc::ptr_eq(c, &job.cancel)));
+    sh.in_flight.lock().unwrap_or_else(PoisonError::into_inner).retain(|(k, c, _)| !(*k == job.key && Arc::ptr_eq(c, &job.cancel)));
     if job.prefetch {
         // Work beyond fetching source frames (decoding is sequential per source and is
         // not saved by skipping frames, so it is left out of the estimate). A cancelled job
         // only tells that the work takes at least this long.
         let cost = started.elapsed().saturating_sub(SOURCE_TIME.with(|s| s.get()).0).as_secs_f64();
-        let mut c = sh.render_cost.lock().unwrap_or_else(|e| e.into_inner());
+        let mut c = sh.render_cost.lock().unwrap_or_else(PoisonError::into_inner);
         if !cancelled || cost > *c {
             *c = if *c == 0.0 { cost } else { *c * 0.8 + cost * 0.2 };
         }
@@ -865,7 +947,7 @@ fn run_job(sh: &Shared, job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Ser
         let job_wall = started.elapsed();
         let source = SOURCE_TIME.with(|s| s.get()).0;
         let (src_ms, render_ms) = (source.as_secs_f64() * 1e3, job_wall.saturating_sub(source).as_secs_f64() * 1e3);
-        let mut st = sh.stats.lock().unwrap_or_else(|e| e.into_inner());
+        let mut st = sh.stats.lock().unwrap_or_else(PoisonError::into_inner);
         st.jobs += 1;
         st.cancelled += cancelled as u64;
         st.preview += preview as u64;
@@ -892,7 +974,7 @@ fn run_job(sh: &Shared, job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Ser
             preview,
             cancelled,
         };
-        sh.records.lock().unwrap_or_else(|e| e.into_inner()).push(rec);
+        sh.records.lock().unwrap_or_else(PoisonError::into_inner).push(rec);
     }
     !loading
 }
@@ -951,12 +1033,14 @@ fn render_job(job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Services>, pr
                 o.composite_onto(&mut img.px, w, h);
             }
         }
-        return (Rgba { w: img.w, h: img.h, px: img.over_black_rgba8() }, true);
+        return (Rgba { w: img.w, h: img.h, px: img.over_black_with_alpha_rgba8() }, true);
     }
     let provider = provider(job, pool, services);
     let opts = filmcraft_render::RenderOptions { scale: job.scale, captions: true, ..Default::default() };
     let img = match job.key.target {
-        Target::Sequence(seq) | Target::SequencePlan(seq) => Some(filmcraft_render::render_sequence(&job.project, seq, job.time, opts, &provider)),
+        Target::Sequence(seq) | Target::SequencePlan(seq) | Target::SequenceLive(seq) => {
+            Some(filmcraft_render::render_sequence(&job.project, seq, job.time, opts, &provider))
+        }
         Target::Item(item) => filmcraft_render::render_item(&job.project, item, job.time, job.scale, &provider),
         Target::MulticamGrid(item, side, page) => {
             let side = (side > 0).then_some(side as usize);
@@ -967,7 +1051,7 @@ fn render_job(job: &Job, pool: &Arc<MediaPool>, services: &Arc<dyn Services>, pr
         }
     };
     let rgba = match img {
-        Some(img) => Rgba { w: img.w, h: img.h, px: img.over_black_rgba8() },
+        Some(img) => Rgba { w: img.w, h: img.h, px: img.over_black_with_alpha_rgba8() },
         None => Rgba { w: 1, h: 1, px: vec![0, 0, 0, 255] },
     };
     (rgba, false)
@@ -991,6 +1075,27 @@ mod tests {
         assert!(!background_work(50, Target::SequencePlan(ItemId(1))));
     }
 
+    #[test]
+    fn the_straight_color_table_matches_the_formula() {
+        use egui::ecolor::{gamma_u8_from_linear_f32, linear_f32_from_gamma_u8};
+        for a in 1..=255u8 {
+            for v in 0..=255u8 {
+                let want = gamma_u8_from_linear_f32((linear_f32_from_gamma_u8(v) / (f32::from(a) / 255.0)).min(1.0));
+                assert_eq!(super::straight_srgb(a, v), want, "a {a} v {v}");
+            }
+        }
+    }
+
+    #[test]
+    fn a_frame_goes_up_opaque_or_with_its_alpha() {
+        use egui::Color32;
+        // opaque red, transparent, and half-transparent white: linear 0.5 over black is sRGB 188
+        let img = super::Rgba { w: 3, h: 1, px: vec![255, 0, 0, 255, 0, 0, 0, 0, 188, 188, 188, 128] };
+        assert_eq!(img.color_image(false).pixels, [Color32::from_rgb(255, 0, 0), Color32::BLACK, Color32::from_rgb(188, 188, 188)]);
+        // egui's colors are the sRGB of the straight color times alpha: white at half is 128
+        assert_eq!(img.color_image(true).pixels, [Color32::from_rgb(255, 0, 0), Color32::TRANSPARENT, Color32::from_rgba_premultiplied(128, 128, 128, 128)]);
+    }
+
     #[test]
     fn draft_decoding_only_for_reduced_resolution_playback() {
         use super::draft_playback;
@@ -1053,4 +1158,56 @@ mod tests {
         m.finish();
         assert_eq!((m.shown, m.dropped), (4, 0));
     }
+
+    /// The workers of a dropped server return and release its state (the frame cache, the media
+    /// pool, the projects of queued jobs) instead of waiting for jobs for the rest of the process.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn dropping_the_server_ends_its_workers() {
+        use super::{FrameKey, FrameServer};
+        use std::sync::Arc;
+        use std::time::{Duration, Instant};
+
+        let s = filmcraft_engine::Session::default();
+        let server = FrameServer::new(s.media.clone(), s.services.clone(), s.previews.clone(), 3);
+        let p = Arc::new(filmcraft_project::Project::new("Frames"));
+        let key = FrameKey { target: Target::Item(ItemId(999)), frame: 0, size: 32, revision: 0, draft: false };
+        server.request(key, filmcraft_time::Tick::ZERO, 0.1, &p, 0);
+        let (shared, project) = (Arc::downgrade(&server.shared), Arc::downgrade(&p));
+        drop(p);
+        drop(server);
+        let t0 = Instant::now();
+        while (shared.strong_count() > 0 || project.strong_count() > 0) && t0.elapsed() < Duration::from_secs(30) {
+            std::thread::sleep(Duration::from_millis(5));
+        }
+        assert_eq!(shared.strong_count(), 0, "a worker still holds the dropped server's state");
+        assert_eq!(project.strong_count(), 0, "a queued job still holds its project");
+    }
+
+    /// A job a worker took from the queue before the server was dropped runs cancelled.
+    #[test]
+    fn a_job_started_after_the_drop_is_cancelled() {
+        use super::{FrameKey, FrameServer, Job, run_job};
+        use std::sync::Arc;
+        use std::sync::atomic::Ordering;
+
+        let s = filmcraft_engine::Session::default();
+        let server = FrameServer::new(s.media.clone(), s.services.clone(), s.previews.clone(), 1);
+        let job = Job {
+            key: FrameKey { target: Target::Item(ItemId(999)), frame: 0, size: 32, revision: 0, draft: false },
+            queued: web_time::Instant::now(),
+            cancel: Default::default(),
+            prefetch: false,
+            catch_up: None,
+            time: filmcraft_time::Tick::ZERO,
+            scale: 0.1,
+            project: Arc::new(filmcraft_project::Project::new("Frames")),
+            prio: 0,
+        };
+        // what `Drop` sets before it cancels the jobs in flight
+        server.shared.stop.store(true, Ordering::Relaxed);
+        run_job(&server.shared, &job, &server.pool, &server.services, &server.previews);
+        assert!(job.cancel.load(Ordering::Relaxed), "the job ran without its cancel flag");
+        assert!(!server.is_ready(&job.key), "a cancelled job's frame is not cached");
+    }
 }
diff --git a/crates/ui-egui/src/graphics_notice.rs b/crates/ui-egui/src/graphics_notice.rs
index a94a69294..b1cd14e62 100644
--- a/crates/ui-egui/src/graphics_notice.rs
+++ b/crates/ui-egui/src/graphics_notice.rs
@@ -44,7 +44,7 @@ pub(crate) fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let title = tlf!("Safe graphics mode: {mode}", mode = i18n::t(&notice.mode));
     let (mut reset, mut close) = (false, false);
     let shown = egui::Window::new("graphics-notice")
-        .id(egui::Id::new("graphics-notice"))
+        .id(egui::Id::unique("graphics-notice"))
         .title_bar(false)
         .collapsible(false)
         .resizable(false)
diff --git a/crates/ui-egui/src/header.rs b/crates/ui-egui/src/header.rs
index 5b8f23c85..181de229f 100644
--- a/crates/ui-egui/src/header.rs
+++ b/crates/ui-egui/src/header.rs
@@ -10,12 +10,16 @@ use crate::icons::{self, Icon};
 use crate::state::Mode;
 use crate::theme::Tokens;
 
+/// Height of the header bar. With `integrated_titlebar` it sits in the macOS title-bar strip.
+pub const HEIGHT: f32 = 38.0;
+
+/// Draw the header bar; dragging starts a native window move and double-click toggles maximized.
 pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().clone();
     p.rect_filled(rect, 0.0, t.header_bg);
     p.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, Color32::BLACK));
-    let drag = ui.interact(rect, egui::Id::new("header-drag"), Sense::click_and_drag());
+    let drag = ui.interact(rect, egui::Id::unique("header-drag"), Sense::click_and_drag());
     if drag.drag_started() {
         ui.ctx().send_viewport_cmd(egui::ViewportCommand::StartDrag);
     }
@@ -26,7 +30,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let mut x = rect.min.x + if app.integrated_titlebar { 104.0 } else { 14.0 };
     // Home
     let home = Rect::from_center_size(pos2(x + 10.0, rect.center().y), vec2(26.0, 26.0));
-    let hresp = ui.interact(home, egui::Id::new("hdr-home"), Sense::click()).on_hover_text(tl!("Home"));
+    let hresp = ui.interact(home, egui::Id::unique("hdr-home"), Sense::click()).on_hover_text(tl!("Home"));
     app.auto.add("header.home", home, "Home");
     if hresp.hovered() {
         p.rect_filled(home, 4.0, t.hover);
@@ -41,7 +45,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let active = app.ui.mode == m;
         let galley = p.layout_no_wrap(shown.to_string(), Tokens::ui(14.0), if active { t.tab_text_active } else { t.tab_text });
         let r = Rect::from_min_size(pos2(x - 6.0, rect.min.y + 6.0), vec2(galley.size().x + 12.0, rect.height() - 12.0));
-        let resp = ui.interact(r, egui::Id::new(("mode", label)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("mode", label)), Sense::click());
         app.auto.add(&format!("header.mode.{}", label.to_ascii_lowercase()), r, label);
         let col = if active || resp.hovered() { t.tab_text_active } else { t.tab_text };
         let gw = galley.size().x;
@@ -72,7 +76,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let mut btn = |ui: &mut egui::Ui, icon: Icon, id: &str, tip: &str, app: &mut FilmcraftApp| -> egui::Response {
         let r = Rect::from_center_size(pos2(rx - 14.0, rect.center().y), vec2(28.0, 28.0));
         rx -= 38.0;
-        let resp = ui.interact(r, egui::Id::new(("hdr", id)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("hdr", id)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("header.{id}"), r, tip);
         if resp.hovered() {
             ui.painter().rect_filled(r, 4.0, t.hover);
@@ -97,7 +101,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let qx = rect.max.x - 14.0 - 4.0 * 38.0; // the fifth button from the right
     if btn(ui, Icon::Export, "quickExport", tl!("Quick Export"), app).clicked() {
         app.ui.export.quick_open = !app.ui.export.quick_open;
-        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new("quick-export-toggled"), true));
+        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique("quick-export-toggled"), true));
     }
     crate::panels::export_mode::quick_export(app, ui.ctx(), pos2(qx - 340.0, rect.max.y + 4.0));
     // Appearance Mode: click for the next one (Auto, Light, Dark); the icon shows the current one.
@@ -117,7 +121,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let ws = crate::i18n::t(&app.ui.workspace).to_uppercase();
     let wg = p.layout_no_wrap(ws.clone(), Tokens::ui(11.0), t.text_dim);
     let wr = Rect::from_min_size(pos2(rx - wg.size().x + 10.0, rect.center().y - 10.0), vec2(wg.size().x + 8.0, 20.0));
-    let wresp = ui.interact(wr, egui::Id::new("hdr-ws-name"), Sense::click());
+    let wresp = ui.interact(wr, egui::Id::unique("hdr-ws-name"), Sense::click());
     app.auto.add("header.workspaceName", wr, &ws);
     p.galley_with_override_text_color(pos2(wr.min.x + 4.0, rect.center().y - wg.size().y / 2.0), wg, if wresp.hovered() { t.text } else { t.text_dim });
     // Community: a labelled Discord button, always one click away.
@@ -126,7 +130,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let g = p.layout_no_wrap(label.to_string(), Tokens::ui(12.0), Color32::WHITE);
         let w = g.size().x + 34.0;
         let r = Rect::from_min_size(pos2(wr.min.x - w - 14.0, rect.center().y - 12.0), vec2(w, 24.0));
-        let resp = ui.interact(r, egui::Id::new("hdr-discord"), Sense::click()).on_hover_text(tl!("Join the ArtCraft Discord (discord.gg/artcraft)"));
+        let resp = ui.interact(r, egui::Id::unique("hdr-discord"), Sense::click()).on_hover_text(tl!("Join the ArtCraft Discord (discord.gg/artcraft)"));
         app.auto.add("header.discord", r, "Join the ArtCraft Discord");
         ui.painter().rect_filled(r, 12.0, if resp.hovered() { t.accent_hover } else { t.accent });
         icons::paint(ui.painter(), Rect::from_center_size(pos2(r.min.x + 14.0, r.center().y), vec2(14.0, 14.0)), Icon::Chat, Color32::WHITE);
@@ -152,7 +156,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             crate::links::open(app, ui.ctx(), crate::links::DISCORD);
         }
     }
-    let popup_id = egui::Id::new("workspaces-popup");
+    let popup_id = egui::Id::unique("workspaces-popup");
     if ws_resp.clicked() || wresp.clicked() {
         ui.ctx().data_mut(|d| d.insert_temp(popup_id, true));
     }
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index bbd437424..b97843aea 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -5,13 +5,19 @@
 # was consulted or copied; add entries the same way. Like the German catalogs of the other Craft
 # apps, text addresses the user informally ("du") and commands use the infinitive ("Projekt
 # öffnen…"). Product, format and feature names (FilmCraft, ArtCraft, Lumetri, Essential Graphics,
-# EDL, AAF…) keep their spelling. This catalog covers every menu, including the native macOS
-# app menu; anything else is shown in English.
+# EDL, AAF…) keep their spelling. The catalog covers the whole interface: first every menu,
+# including the native macOS app menu, then the rest of the Spanish catalog (panels, dialogs,
+# effects and their parameters, presets, settings, status messages). Strings added later show in
+# English until they are translated.
 #
 # Terms: track = Spur, bin = Ablage, marker = Marker, playhead = Abspielposition, In/Out = In-/Out-
 # Punkt, transition = Übergang, frame hold = Standbild, panel = Bedienfeld, workspace =
 # Arbeitsbereich, label (colour) = Farbmarkierung, preferences (also the native macOS Settings
-# menu) = Voreinstellungen. "Timeline" is not translated.
+# menu) = Voreinstellungen. "Timeline" is not translated. Further: frame = Frame, keyframe =
+# Keyframe, preset = Vorgabe, footage = Material, render = rendern, application = Anwendung;
+# ripple, roll, slip and slide edits keep their names (Ripple-Trimmen, Rollen-Werkzeug…); in
+# Lumetri highlights = Lichter, shadows = Tiefen, midtones = Mitteltöne. Keys: Shift = Umschalt,
+# Option = Wahl, Ctrl = Strg.
 
 	AAF…	AAF…
 	About FilmCraft	Über FilmCraft
@@ -342,6 +348,7 @@
 	Show Active Caption Tracks Only	Nur aktive Untertitelspuren anzeigen
 	Show All Caption Tracks	Alle Untertitelspuren anzeigen
 	Show All Marker Colors	Alle Markerfarben anzeigen
+	Show Duplicate Frame Markers	Markierungen für doppelte Frames anzeigen
 	Show Guides	Hilfslinien anzeigen
 	Show Rulers	Lineale anzeigen
 	Show Through Edits	Durchgehende Schnitte anzeigen
@@ -391,3 +398,3219 @@
 	Zoom to Sequence	Auf Sequenz zoomen
 	Project Notes	Projektnotizen
 
+
+# Beyond the menus, in the order of the Spanish catalog.
+
+	Refresh Changed Media	Geänderte Medien aktualisieren
+	Medium	Mittel
+	Recent	Zuletzt verwendet
+	Home	Start
+	Import	Importieren
+	{name} - Edited	{name} – bearbeitet
+	Full screen	Vollbild
+	Volume	Lautstärke
+	Master volume: use the Audio Track Mixer	Gesamtlautstärke: über das Audiospur-Mischpult
+	Search	Suchen
+	Quick Export	Schnellexport
+	Join the ArtCraft Discord (discord.gg/artcraft)	Dem ArtCraft-Discord beitreten (discord.gg/artcraft)
+	Cancel	Abbrechen
+	OK	OK
+	Interpret Footage	Material interpretieren
+	Color Management · {n} item	Farbmanagement · {n} Element
+	Color Management · {n} items	Farbmanagement · {n} Elemente
+	Media colour space (from file metadata): {detected}	Farbraum des Mediums (aus den Datei-Metadaten): {detected}
+	Override media colour space:	Farbraum des Mediums überschreiben:
+	Use file metadata	Datei-Metadaten verwenden
+	Sequence Color Management	Farbmanagement der Sequenz
+	Working Color Space	Arbeitsfarbraum
+	Wide gamut color (composite in BT.2020)	Farben mit großem Farbumfang (in BT.2020 zusammensetzen)
+	Auto tone map media (HDR and log into SDR)	Automatisches Tone-Mapping für Medien (HDR und Log nach SDR)
+	Audio Gain	Audioverstärkung
+	Set Gain to:	Verstärkung festlegen auf:
+	Adjust Gain by:	Verstärkung anpassen um:
+	Normalize Max Peak to:	Maximale Spitze normalisieren auf:
+	Normalize All Peaks to:	Alle Spitzen normalisieren auf:
+	Peak Amplitude: {peak}	Spitzenamplitude: {peak}
+	Standard	Standard
+	Adaptive	Adaptiv
+	Mono	Mono
+	Stereo	Stereo
+	Add Tracks	Spuren hinzufügen
+	Amount	Anzahl
+	Placement	Platzierung
+	Track type	Spurtyp
+	Add video tracks	Videospuren hinzufügen
+	Add audio tracks	Audiospuren hinzufügen
+	Add audio submix tracks	Audio-Submix-Spuren hinzufügen
+	After {name}	Nach {name}
+	Before First Track	Vor der ersten Spur
+	Delete Tracks	Spuren löschen
+	Video Tracks	Videospuren
+	Audio Tracks	Audiospuren
+	Delete Video Tracks	Videospuren löschen
+	Delete Audio Tracks	Audiospuren löschen
+	All Empty Tracks	Alle leeren Spuren
+	Caption Tracks	Untertitelspuren
+	Delete Caption Tracks	Untertitelspuren löschen
+	Delete Caption Track	Untertitelspur löschen
+	Delete Empty Caption Tracks	Leere Untertitelspuren löschen
+	Version {version}	Version {version}
+	A clean-room, pure-Rust non-linear video editor. Part of the ArtCraft family.	Ein nichtlinearer Videoeditor in reinem Rust, im Clean-Room-Verfahren entwickelt. Teil der ArtCraft-Familie.
+	Join the ArtCraft Discord	Dem ArtCraft-Discord beitreten
+	Source code on GitHub	Quellcode auf GitHub
+	Report an issue	Problem melden
+	MIT OR Apache-2.0. Fonts: Inter, Noto Serif and JetBrains Mono (SIL OFL 1.1).	MIT OR Apache-2.0. Schriften: Inter, Noto Serif und JetBrains Mono (SIL OFL 1.1).
+	just now	gerade eben
+	{n} s ago	vor {n} s
+	{n} min ago	vor {n} Min.
+	{n} h ago	vor {n} Std.
+	All Events	Alle Ereignisse
+	Warnings and Errors	Warnungen und Fehler
+	Errors Only	Nur Fehler
+	Clear All	Alle löschen
+	No events.	Keine Ereignisse.
+	Show finished jobs	Abgeschlossene Aufträge anzeigen
+	Cancelled	Abgebrochen
+	Failed: {e}	Fehlgeschlagen: {e}
+	Done	Fertig
+	No background jobs.	Keine Hintergrundaufträge.
+	Recover Unsaved Changes	Nicht gespeicherte Änderungen wiederherstellen
+	Untitled	Unbenannt
+	FilmCraft was closed while “{name}” had unsaved changes.	FilmCraft wurde geschlossen, während „{name}“ nicht gespeicherte Änderungen hatte.
+	FilmCraft quit unexpectedly while “{name}” had unsaved changes.	FilmCraft wurde unerwartet beendet, während „{name}“ nicht gespeicherte Änderungen hatte.
+	Recover unsaved changes from {when}?	Nicht gespeicherte Änderungen von {when} wiederherstellen?
+	The project had not been saved yet.	Das Projekt war noch nicht gespeichert worden.
+	{n} sessions have unsaved changes:	{n} Sitzungen haben nicht gespeicherte Änderungen:
+	Discard	Verwerfen
+	Recover	Wiederherstellen
+	Not Now	Nicht jetzt
+	Are you sure you want to discard your changes to '{file}'?	Möchtest du deine Änderungen an „{file}“ wirklich verwerfen?
+	Yes	Ja
+	No	Nein
+	Add media to your project. Drop files anywhere in the window, or choose a source below.	Füge deinem Projekt Medien hinzu. Zieh Dateien irgendwo ins Fenster oder wähle unten eine Quelle.
+	Browse files…	Dateien durchsuchen…
+	Movies, audio and stills from disk	Filme, Audio und Standbilder von der Festplatte
+	Demo footage	Demomaterial
+	Six procedural 1080p clips with sound	Sechs prozedural erzeugte 1080p-Clips mit Ton
+	Demo project	Demoprojekt
+	A cut sequence with transitions, effects and music	Eine geschnittene Sequenz mit Übergängen, Effekten und Musik
+	Bars and Tone	Farbbalken und Ton
+	SMPTE HD bars with 1 kHz reference tone	SMPTE-HD-Farbbalken mit 1-kHz-Referenzton
+	Community	Community
+	Join us on Discord	Komm zu uns auf Discord
+	OMF Export Settings	OMF-Exporteinstellungen
+	AAF Export Settings	AAF-Exporteinstellungen
+	OMF Title:	OMF-Titel:
+	Mixdown video	Video abmischen
+	Audio:	Audio:
+	Encapsulate	Kapseln
+	Separate Audio	Separates Audio
+	Embed	Einbetten
+	Separate Files	Separate Dateien
+	Link to Media	Mit Medien verknüpfen
+	Audio File Format:	Audiodateiformat:
+	Sample Rate:	Abtastrate:
+	Bits per Sample:	Bits pro Sample:
+	Rendering:	Rendern:
+	Trim audio files	Audiodateien trimmen
+	Handle Frames:	Zugabe-Frames:
+	Render audio clip effects	Audioclip-Effekte rendern
+	Breakout to mono	In Mono aufteilen
+	Exported {path}	Exportiert: {path}
+	Select a clip to view its metadata.	Wähle einen Clip aus, um seine Metadaten anzuzeigen.
+	Clip: {name}	Clip: {name}
+	Open	Öffnen
+	(no sequence)	(keine Sequenz)
+	Show or hide {color} markers	{color}-Marker ein- oder ausblenden
+	Marker	Marker
+	{tc}  Chapter	{tc}  Kapitel
+	No markers. Press M to add one.	Keine Marker. Drück M, um einen hinzuzufügen.
+	All markers are hidden by the colour filter.	Der Farbfilter blendet alle Marker aus.
+	Type:	Typ:
+	Video:	Video:
+	Codec:	Codec:
+	Duration:	Dauer:
+	Settings:	Einstellungen:
+	Playhead:	Abspielposition:
+	Video {n}:	Video {n}:
+	Audio {n}:	Audio {n}:
+	UI:	Oberfläche:
+	{fps} fps · {n} frames queued	{fps} fps · {n} Frames in der Warteschlange
+	{panel} — coming in a later milestone	{panel} – kommt in einem späteren Meilenstein
+	Close Panel	Bedienfeld schließen
+	Close Other Timeline Panels	Andere Timeline-Bedienfelder schließen
+	Close All	Alle schließen
+	Maximize Frame	Rahmen maximieren
+	Restore Frame	Rahmen wiederherstellen
+	Restore Workspace	Arbeitsbereich wiederherstellen
+	Reveal Sequence in Project	Sequenz im Projekt anzeigen
+	Video Thumbnails	Video-Miniaturen
+	Audio Waveforms	Audio-Wellenformen
+	Delete Preset	Vorgabe löschen
+	Export Preset…	Vorgabe exportieren…
+	Import Presets…	Vorgaben importieren…
+	Effect presets	Effektvorgaben
+	Save Preset	Vorgabe speichern
+	Name:	Name:
+	Type	Typ
+	Scale	Skalieren
+	Anchor to In Point	Am In-Punkt verankern
+	Anchor to Out Point	Am Out-Punkt verankern
+	Without keyframes	Ohne Keyframes
+	Description:	Beschreibung:
+	Saved preset “{name}”	Vorgabe „{name}“ gespeichert
+	Current duration {seconds} s	Aktuelle Dauer {seconds} s
+	Remix Properties	Remix-Eigenschaften
+	Target Duration:	Zieldauer:
+	Segments:	Segmente:
+	Fewer · More	Weniger · Mehr
+	Variations:	Variationen:
+	Remixed to {seconds} s	Auf {seconds} s geremixt
+	{mode} · no clip	{mode} · kein Clip
+	{mode} · no sequence	{mode} · keine Sequenz
+	Remove Row	Zeile entfernen
+	Add a timecode row	Timecode-Zeile hinzufügen
+	Panner	Panner
+	Mute	Stumm
+	Send {n} Level	Pegel Send {n}
+	Show Keyframes	Keyframes anzeigen
+	Clip Keyframes	Clip-Keyframes
+	Track Keyframes	Spur-Keyframes
+	Delete	Löschen
+	Untitled Workspace	Unbenannter Arbeitsbereich
+	New Workspace	Neuer Arbeitsbereich
+	Edit Workspaces	Arbeitsbereiche bearbeiten
+	Rename	Umbenennen
+	Restore Original	Original wiederherstellen
+	Search effects	Effekte suchen
+	Apply to Selected Clips	Auf ausgewählte Clips anwenden
+	Metadata Display	Metadatenanzeige
+	Save As New View Preset	Als neue Ansichtsvorgabe speichern
+	Manage Saved View Presets	Gespeicherte Ansichtsvorgaben verwalten
+	Freeform View Options	Optionen für die freie Ansicht
+	Save Arrangement	Anordnung speichern
+	Saves the view, columns, sort, thumbnail and font size.	Speichert Ansicht, Spalten, Sortierung, Miniatur- und Schriftgröße.
+	Grid spacing:	Rasterabstand:
+	Default clip size:	Standard-Clipgröße:
+	Snap to grid	Am Raster ausrichten
+	Show clip names	Clipnamen anzeigen
+	Show durations	Dauer anzeigen
+	Show:	Anzeigen:
+	Search fields	Felder durchsuchen
+	Project Metadata	Projektmetadaten
+	Add Property…	Eigenschaft hinzufügen…
+	Column order	Spaltenreihenfolge
+	{n}. (empty)	{n}. (leer)
+	Restore	Wiederherstellen
+	Overwrite with Current View	Mit aktueller Ansicht überschreiben
+	Graphics text search arrives with M10.1–M10.2	Die Textsuche in Grafiken kommt mit M10.1–M10.2
+	Open a sequence to work with captions	Öffne eine Sequenz, um mit Untertiteln zu arbeiten
+	Add captions	Untertitel hinzufügen
+	Create a caption track or import a caption file.	Erstelle eine Untertitelspur oder importiere eine Untertiteldatei.
+	Create new caption track	Neue Untertitelspur erstellen
+	Import captions file…	Untertiteldatei importieren…
+	New {format} track	Neue {format}-Spur
+	Add caption at playhead	Untertitel an Abspielposition hinzufügen
+	Split caption at playhead	Untertitel an Abspielposition teilen
+	Merge selected captions	Ausgewählte Untertitel zusammenführen
+	Delete selected captions	Ausgewählte Untertitel löschen
+	No captions on this track. Press + to add one at the playhead.	Keine Untertitel auf dieser Spur. Drück +, um einen an der Abspielposition hinzuzufügen.
+	No matching captions.	Keine passenden Untertitel.
+	Open a sequence to see its transcript	Öffne eine Sequenz, um ihr Transkript zu sehen
+	Transcribe sequence	Sequenz transkribieren
+	Speech-to-text turns the dialogue into editable text.	Spracherkennung macht aus dem Dialog bearbeitbaren Text.
+	This build has no speech-to-text; import a transcript with transcript.set.	Dieser Build hat keine Spracherkennung; importiere ein Transkript mit transcript.set.
+	Transcribe	Transkribieren
+	Extract selected text	Ausgewählten Text extrahieren
+	Lift selected text	Ausgewählten Text herausheben
+	Remove filler words	Füllwörter entfernen
+	Create captions	Untertitel erstellen
+	Speaker	Sprecher
+	Box	Kasten
+	Align	Ausrichten
+	Align left	Linksbündig
+	Align center	Zentriert
+	Align right	Rechtsbündig
+	Position	Position
+	Position: top	Position: oben
+	Position: middle	Position: Mitte
+	Position: bottom	Position: unten
+	(gap)	(Lücke)
+	Out: {name}	Out: {name}
+	In: {name}	In: {name}
+	Play Around Edit (Space loops, Shift+K once)	Um Schnitt herum abspielen (Leertaste in Schleife, Umschalt+K einmal)
+	Trim Backward Many	Weit rückwärts trimmen
+	Trim Backward	Rückwärts trimmen
+	Apply Default Transitions	Standardübergänge anwenden
+	Apply Default Transitions to Selection (Shift+D)	Standardübergänge auf Auswahl anwenden (Umschalt+D)
+	Trim Forward	Vorwärts trimmen
+	Trim Forward Many	Weit vorwärts trimmen
+	Exit Trim Mode	Trimmmodus beenden
+	Voice-over record (right-click: Voice-Over Record Settings…)	Voice-over aufnehmen (Rechtsklick: Voice-over-Aufnahmeeinstellungen…)
+	Voice-Over Record Settings…	Voice-over-Aufnahmeeinstellungen…
+	Recording voice-over…	Voice-over wird aufgenommen…
+	Voice-over recorded: {p}	Voice-over aufgenommen: {p}
+	Voice-over recording stopped (nothing recorded)	Voice-over-Aufnahme gestoppt (nichts aufgenommen)
+	Post-roll	Nachlauf
+	● Recording	● Aufnahme
+	Voice-Over Record Settings	Voice-over-Aufnahmeeinstellungen
+	Source:	Quelle:
+	Default Input	Standardeingang
+	Input:	Eingang:
+	Channel {n}	Kanal {n}
+	Countdown Sound Cues	Countdown-Signaltöne
+	Pre-roll:	Vorlauf:
+	 seconds	 Sekunden
+	Post-roll:	Nachlauf:
+	Playback starts the pre-roll before the playhead (or the In point); with In/Out marked, recording punches in and out there.	Die Wiedergabe beginnt mit dem Vorlauf vor der Abspielposition (oder dem In-Punkt); sind In und Out gesetzt, startet und endet die Aufnahme dort (Punch-in/-out).
+	Effect	Effekt
+	Clip Fx Editor	Clip-Effekteditor
+	Track Fx Editor	Spur-Effekteditor
+	Master Gain	Gesamtverstärkung
+	Reset	Zurücksetzen
+	Band {n}	Band {n}
+	Solo	Solo
+	Bypass	Bypass
+	Thr	Schw.
+	Ratio	Ratio
+	Att	Att.
+	Rel	Rel.
+	Gain	Verstärkung
+	Output Gain	Ausgangsverstärkung
+	Limiter	Limiter
+	Link Channels	Kanäle verknüpfen
+	Limiter Threshold	Limiter-Schwellenwert
+	Limiter Release	Limiter-Release
+	Auto Gate	Auto-Gate
+	Threshold	Schwellenwert
+	Attack	Attack
+	Release	Release
+	Hold	Hold
+	Compressor	Kompressor
+	Auto Makeup	Automatischer Make-up-Gain
+	Makeup	Make-up-Gain
+	Expander	Expander
+	Soft Clip	Soft Clip
+	(no sequences)	(keine Sequenzen)
+	(no clips)	(keine Clips)
+	Show Transport Controls	Transportsteuerung anzeigen
+	Loop	Schleife
+	Multi-Camera Audio Follows Video	Mehrkamera-Audio folgt Video
+	Multi-Camera Record	Mehrkamera-Aufnahme
+	Multi-Camera Selection Top Down	Mehrkamera-Auswahl von oben nach unten
+	Show Multi-Camera Preview Monitor	Mehrkamera-Vorschaumonitor anzeigen
+	Auto-Adjust Multi-Camera Playback Quality	Mehrkamera-Wiedergabequalität automatisch anpassen
+	Transmit Multi-Camera View	Mehrkameraansicht übertragen
+	Multi-Camera Layout	Mehrkamera-Layout
+	Automatic	Automatisch
+	Edit Cameras…	Kameras bearbeiten…
+	Add Marker (M)	Marker hinzufügen (M)
+	Mark In (I)	In-Punkt setzen (I)
+	Mark Out (O)	Out-Punkt setzen (O)
+	Go to In (Shift+I)	Zum In-Punkt gehen (Umschalt+I)
+	Step Back 1 Frame (Left)	1 Frame zurück (Links)
+	Play-Stop Toggle (Space)	Wiedergabe/Stopp (Leertaste)
+	Step Forward 1 Frame (Right)	1 Frame vor (Rechts)
+	Go to Out (Shift+O)	Zum Out-Punkt gehen (Umschalt+O)
+	Insert (,)	Einfügen (,)
+	Overwrite (.)	Überschreiben (.)
+	Export Frame (Shift+E)	Frame exportieren (Umschalt+E)
+	Lift (;)	Herausheben (;)
+	Extract (')	Extrahieren (')
+	Export Frame: use Export mode (M6)	Frame exportieren: verwende den Exportmodus (M6)
+	Button Editor	Schaltflächen-Editor
+	More transport controls	Weitere Transportsteuerelemente
+	Multi-Camera Record on	Mehrkamera-Aufnahme an
+	Multi-Camera Record off	Mehrkamera-Aufnahme aus
+	{first} - Merged	{first} – zusammengeführt
+	{first} Multicam	{first} Mehrkamera
+	In Points	In-Punkte
+	Out Points	Out-Punkte
+	Clip Marker	Clipmarker
+	Merge Clips	Clips zusammenführen
+	Create Multi-Camera Source Sequence	Mehrkamera-Quellsequenz erstellen
+	Synchronize Clips	Clips synchronisieren
+	Clip Name:	Clipname:
+	Sequence Name:	Sequenzname:
+	{n} clip(s): {names}	{n} Clip(s): {names}
+	{n} clip(s) selected; the clip on the reference track stays put.	{n} Clip(s) ausgewählt; der Clip auf der Referenzspur bleibt, wo er ist.
+	Synchronize Point	Synchronisationspunkt
+	Ignore Hours	Stunden ignorieren
+	first marker	erster Marker
+	Offset Audio by:	Audio versetzen um:
+	Offset:	Versatz:
+	 frames	 Frames
+	Reference track:	Referenzspur:
+	lowest (V1…)	unterste (V1…)
+	Remove Audio from AV Clip	Audio aus AV-Clip entfernen
+	Camera 1	Kamera 1
+	All Cameras	Alle Kameras
+	Switch Audio	Audio umschalten
+	Camera Names	Kameranamen
+	Clip Names	Clipnamen
+	Enumerate Cameras	Kameras nummerieren
+	Camera Angle Metadata	Kamerawinkel-Metadaten
+	Move source clips to Processed Clips bin	Quellclips in die Ablage „Verarbeitete Clips“ verschieben
+	Synchronized {n} clip group(s)	{n} Clipgruppe(n) synchronisiert
+	Merged clip created	Zusammengeführter Clip erstellt
+	Multi-camera source sequence with {n} camera(s)	Mehrkamera-Quellsequenz mit {n} Kamera(s)
+	No multi-camera clip at the playhead	Kein Mehrkamera-Clip an der Abspielposition
+	Camera {n} — {name}	Kamera {n} – {name}
+	Page {page} of {pages}	Seite {page} von {pages}
+	Previous page	Vorherige Seite
+	Next page	Nächste Seite
+	Multi-Camera Record On/Off (0)	Mehrkamera-Aufnahme ein/aus (0)
+	Record	Aufnehmen
+	Edit Cameras	Kameras bearbeiten
+	Cameras shown in the Multi-Camera view (uncheck to hide).	In der Mehrkameraansicht gezeigte Kameras (Häkchen entfernen zum Ausblenden).
+	Recorded {n} multi-camera cut(s)	{n} Mehrkamera-Schnitt(e) aufgenommen
+	Clamp Signal	Signal begrenzen
+	Presets	Vorgaben
+	Parade ({kind})	Parade ({kind})
+	Waveform ({kind})	Wellenform ({kind})
+	Parade Type	Paradetyp
+	Waveform Type	Wellenformtyp
+	Vectorscope Targets	Vektorskop-Zielmarken
+	Colour Space	Farbraum
+	Brightness	Helligkeit
+	Signal Scale	Signalskala
+	Histogram	Histogramm
+	Paste Attributes	Attribute einfügen
+	Remove Attributes	Attribute entfernen
+	New Offline File	Neue Offline-Datei
+	Nested Sequence Name	Name der verschachtelten Sequenz
+	Make Subclip	Subclip erstellen
+	Edit Subclip	Subclip bearbeiten
+	Modify Clip: Audio Channels	Clip ändern: Audiokanäle
+	Modify Clip: Timecode	Clip ändern: Timecode
+	Frame Hold Options	Standbildoptionen
+	Field Options	Halbbildoptionen
+	Save Project	Projekt speichern
+	Motion	Bewegung
+	Opacity	Deckkraft
+	Time Remapping	Zeitneuzuordnung
+	Channel Volume	Kanallautstärke
+	In Point	In-Punkt
+	Out Point	Out-Punkt
+	Playhead	Abspielposition
+	Source Timecode	Quell-Timecode
+	Sequence Time	Sequenzzeit
+	Video Attributes	Videoattribute
+	Audio Attributes	Audioattribute
+	No effects	Keine Effekte
+	Scale Attribute Times	Attributzeiten skalieren
+	File Name:	Dateiname:
+	Tape Name:	Bandname:
+	Contains:	Enthält:
+	Video	Video
+	Width:	Breite:
+	Height:	Höhe:
+	Frame Rate:	Framerate:
+	Media Start:	Medienstart:
+	Subclip: {name}	Subclip: {name}
+	Start:	Start:
+	End:	Ende:
+	Restrict Trims To Subclip Boundaries	Trimmen auf Subclip-Grenzen beschränken
+	Convert to Master Clip	In Master-Clip umwandeln
+	Clip Channel Format:	Kanalformat des Clips:
+	Number of Audio Clips:	Anzahl der Audioclips:
+	Media Source Channels	Kanäle der Medienquelle
+	Ch. {n}	K. {n}
+	Clip {n}	Clip {n}
+	Source channels the selected audio clips play:	Quellkanäle, die die ausgewählten Audioclips wiedergeben:
+	Set Timecode:	Timecode festlegen:
+	Use the file's timecode	Timecode der Datei verwenden
+	Hold On	Halten bei
+	Timecode:	Timecode:
+	Hold Filters	Filter halten
+	Reverse Field Dominance	Halbbilddominanz umkehren
+	Processing Options	Verarbeitungsoptionen
+	None	Keine
+	Always Deinterlace	Immer Deinterlacing anwenden
+	Flicker Removal	Flimmerentfernung
+	Save changes to “{project_name}” before closing?	Änderungen an „{project_name}“ vor dem Schließen speichern?
+	Don't Save	Nicht speichern
+	All media is online.	Alle Medien sind online.
+	{name} (copy)	{name} (Kopie)
+	Offline	Offline
+	Missing	Fehlt
+	Link Media	Medien verknüpfen
+	{n} clip(s) can't find their media. Locate them, search a folder, or leave them offline.	{n} Clip(s) finden ihre Medien nicht. Such sie, durchsuche einen Ordner oder lass sie offline.
+	Clip Name	Clipname
+	File Name	Dateiname
+	File Path	Dateipfad
+	Status	Status
+	Match file properties:	Übereinstimmende Dateieigenschaften:
+	File Extension	Dateierweiterung
+	Clip ID (fingerprint)	Clip-ID (Fingerabdruck)
+	Duration	Dauer
+	Media Start	Medienstart
+	Frame Size / Rate	Bildgröße/-rate
+	Align Timecode	Timecode ausrichten
+	Relink others automatically	Andere automatisch neu verknüpfen
+	Search in:	Suchen in:
+	Browse…	Durchsuchen…
+	A file dialog is already open	Ein Dateidialog ist bereits geöffnet
+	Exact name matches only	Nur exakte Namenstreffer
+	No candidates yet — Search a folder or Locate the file.	Noch keine Kandidaten – durchsuche einen Ordner oder such die Datei.
+	✔ same file	✔ dieselbe Datei
+	✔ matches	✔ passt
+	✖ different file	✖ andere Datei
+	Preview	Vorschau
+	Offline All	Alle offline
+	Locate…	Datei suchen…
+	Linked {n} clip(s)	{n} Clip(s) verknüpft
+	Nothing found with that name.	Unter diesem Namen wurde nichts gefunden.
+	Make Offline	Offline setzen
+	Make {n} selected clip(s) offline. Their clips show the offline slate until you link them again.	{n} ausgewählte(n) Clip(s) offline setzen. Die Clips zeigen die Offline-Tafel, bis du sie wieder verknüpfst.
+	Media files remain on disk	Mediendateien bleiben auf der Festplatte
+	Media files are deleted	Mediendateien werden gelöscht
+	Create Proxies	Proxys erstellen
+	{n} clip(s) selected.	{n} Clip(s) ausgewählt.
+	Format and size	Format und Größe
+	Destination	Ziel
+	Next to the original media, in a Proxies folder	Neben den Originalmedien, in einem Ordner „Proxies“
+	Proxies are made in the background and attached when done. Export always uses full-resolution media.	Proxys werden im Hintergrund erstellt und nach Abschluss angehängt. Der Export verwendet immer Medien in voller Auflösung.
+	Creating {n} proxy file(s)…	{n} Proxy-Datei(en) werden erstellt…
+	Project Manager	Projektmanager
+	Sequences	Sequenzen
+	Resulting Project	Resultierendes Projekt
+	Collect Files and Copy to New Location	Dateien sammeln und an neuen Speicherort kopieren
+	Consolidate and Transcode	Zusammenfassen und transkodieren
+	Options	Optionen
+	Exclude Unused Clips	Nicht verwendete Clips ausschließen
+	Include Handles:	Zugaben einschließen:
+	Include Proxies	Proxys einschließen
+	Include Preview Files	Vorschaudateien einschließen
+	Destination Path	Zielpfad
+	Disk space: original {original} · resulting {result} ({n} files)	Speicherplatz: Original {original} · Ergebnis {result} ({n} Dateien)
+	Disk space: —	Speicherplatz: –
+	Calculate	Berechnen
+	Project Manager: writing {path}	Projektmanager: {path} wird geschrieben
+	Timeline: (no sequences)	Timeline: (keine Sequenzen)
+	Browse	Durchsuchen
+	Select audio clips, then click a preset to apply it.	Wähle Audioclips aus und klick dann auf eine Vorgabe, um sie anzuwenden.
+	{name} (user)	{name} (Benutzer)
+	Select audio clips to edit them here	Wähle Audioclips aus, um sie hier zu bearbeiten
+	Multiple Clips Selected	Mehrere Clips ausgewählt
+	The selected clips have different audio types. Assign one type to edit them together.	Die ausgewählten Clips haben unterschiedliche Audiotypen. Weise einen Typ zu, um sie gemeinsam zu bearbeiten.
+	Assign an audio type to the selection:	Weise der Auswahl einen Audiotyp zu:
+	Clear Audio Type	Audiotyp entfernen
+	Preset:	Vorgabe:
+	(Custom)	(Benutzerdefiniert)
+	Preset name	Vorgabenname
+	Reduce Noise	Rauschen reduzieren
+	Reduce Rumble	Rumpeln reduzieren
+	DeHum	Brummen entfernen
+	DeEss	De-Esser
+	Reduce Reverb	Hall reduzieren
+	Dynamics	Dynamik
+	EQ	EQ
+	Enhance Speech	Sprache verbessern
+	Low Tone	Tiefen
+	High Tone	Höhen
+	Mix	Mischung
+	Reverb	Hall
+	Stereo Width	Stereobreite
+	Remixing music to a target duration is not available yet. Trim the clip and add a crossfade instead.	Musik auf eine Zieldauer zu remixen ist noch nicht verfügbar. Trimme stattdessen den Clip und füge eine Überblendung hinzu.
+	Pan	Panorama
+	Auto-Match	Automatisch angleichen
+	Not matched yet	Noch nicht angeglichen
+	Matches each of the {n} clips on its own.	Gleicht jeden der {n} Clips einzeln an.
+	Duck against:	Absenken gegenüber:
+	Untagged	Ohne Typ
+	Sensitivity	Empfindlichkeit
+	Reduce By	Absenken um
+	Fades	Blenden
+	Generate Keyframes	Keyframes erzeugen
+	Clip Volume	Cliplautstärke
+	(no clip selected)	(kein Clip ausgewählt)
+	Master · {name}	Master · {name}
+	Add Lumetri Color to clip	Lumetri-Farbe zum Clip hinzufügen
+	Input LUT	Eingabe-LUT
+	Temperature	Temperatur
+	Tint	Tönung
+	Saturation	Sättigung
+	Exposure	Belichtung
+	Contrast	Kontrast
+	Highlights	Lichter
+	Shadows	Tiefen
+	Whites	Weiß
+	Blacks	Schwarz
+	HDR	HDR
+	HDR White	HDR-Weiß
+	HDR Specular	HDR-Spitzlichter
+	Look	Look
+	Look LUT	Look-LUT
+	Intensity	Intensität
+	Adjustments	Anpassungen
+	Faded Film	Verblasster Film
+	Sharpen	Scharfzeichnen
+	Vibrance	Dynamik
+	RGB Curves	RGB-Kurven
+	HDR Range	HDR-Bereich
+	Hue Saturation Curves	Farbton-Sättigungs-Kurven
+	Hue vs Sat	Farbton/Sättigung
+	Hue vs Hue	Farbton/Farbton
+	Hue vs Luma	Farbton/Luminanz
+	Luma vs Sat	Luminanz/Sättigung
+	Sat vs Sat	Sättigung/Sättigung
+	Midtones	Mitteltöne
+	Key	Key
+	Hue	Farbton
+	Hue Range	Farbtonbereich
+	Saturation Min	Minimale Sättigung
+	Luma Min	Minimale Luminanz
+	Luma Max	Maximale Luminanz
+	Soften	Weichzeichnen
+	Show Mask	Maske anzeigen
+	Off	Aus
+	Color/Gray	Farbe/Grau
+	Color/Black	Farbe/Schwarz
+	White/Black	Weiß/Schwarz
+	Refine	Verfeinern
+	Denoise	Entrauschen
+	Blur	Weichzeichner
+	Correction	Korrektur
+	Hue Shift	Farbtonverschiebung
+	Midpoint	Mittelpunkt
+	Roundness	Rundheit
+	Feather	Weiche Kante
+	LUT	LUT
+	Color Match	Farbabgleich
+	Reference	Referenz
+	Face Detection (protect skin tones)	Gesichtserkennung (Hauttöne schützen)
+	Apply Match	Abgleich anwenden
+	Create ellipse mask	Ellipsenmaske erstellen
+	Create 4-point polygon mask	4-Punkt-Polygonmaske erstellen
+	Free draw bezier	Freihand-Bézier
+	Click in the Program monitor to place mask points (drag for curves); click the first point or press Enter to close	Klick in den Programmmonitor, um Maskenpunkte zu setzen (ziehen für Kurven); klick auf den ersten Punkt oder drück die Eingabetaste, um sie zu schließen
+	Delete Mask	Maske löschen
+	Inverted	Umgekehrt
+	Drag: move · Alt-click: smooth/corner · Cmd-click: delete	Ziehen: verschieben · Alt+Klick: glatt/Ecke · Cmd+Klick: löschen
+	Track selected mask backward	Ausgewählte Maske rückwärts verfolgen
+	Track selected mask backward 1 frame	Ausgewählte Maske 1 Frame rückwärts verfolgen
+	Track selected mask forward 1 frame	Ausgewählte Maske 1 Frame vorwärts verfolgen
+	Track selected mask forward	Ausgewählte Maske vorwärts verfolgen
+	Stop tracking	Verfolgung stoppen
+	Tracking method: {method}	Verfolgungsmethode: {method}
+	Composite	Zusammengesetzt
+	Comparison	Vergleich
+	Video and Waveform	Video und Wellenform
+	System Default	Systemstandard
+	Default location	Standardspeicherort
+	Font family	Schriftfamilie
+	Label Colors	Markierungsfarben
+	Decoded frames held for the monitors and thumbnails: {used} of {budget}.	Für Monitore und Miniaturen vorgehaltene dekodierte Frames: {used} von {budget}.
+	FilmCraft keeps the rest of the RAM free for other applications.	FilmCraft lässt den restlichen Arbeitsspeicher für andere Programme frei.
+	not available in this session	in dieser Sitzung nicht verfügbar
+	Currently: {loc} — {files} file(s), {size}	Aktuell: {loc} – {files} Datei(en), {size}
+	 ({ch} output channels)	 ({ch} Ausgangskanäle)
+	Programme left → device output {l}, right → device output {r}{dev}. Outputs beyond the device's channels fall back to 1 and 2.	Programm links → Geräteausgang {l}, rechts → Geräteausgang {r}{dev}. Ausgänge über die Kanalzahl des Geräts hinaus fallen auf 1 und 2 zurück.
+	Auto-saves go to: {dir}	Automatische Speicherungen landen in: {dir}
+	Recovery copy: {dir}	Wiederherstellungskopie: {dir}
+	Last auto-save {a} · last recovery copy {j}	Letzte automatische Speicherung {a} · letzte Wiederherstellungskopie {j}
+	Last auto-save {a}	Letzte automatische Speicherung {a}
+	Last recovery copy {j}	Letzte Wiederherstellungskopie {j}
+	Remove Media Cache Files	Mediencache-Dateien entfernen
+	Deleted {n} file(s), {size}.	{n} Datei(en) gelöscht, {size}.
+	Reset…	Zurücksetzen…
+	Source · {name}	Quelle · {name}
+	Reset Effect	Effekt zurücksetzen
+	Reset Parameter	Parameter zurücksetzen
+	Save Preset…	Vorgabe speichern…
+	Custom Setup	Benutzerdefinierte Einrichtung
+	Edit…	Bearbeiten…
+	Show graphs	Diagramme anzeigen
+	Toggle animation	Animation ein/aus
+	Eyedropper (pick a color from the Program monitor)	Pipette (Farbe aus dem Programmmonitor aufnehmen)
+	Eyedropper: no picture to sample	Pipette: kein Bild zum Aufnehmen
+	Add/Remove Keyframe	Keyframe hinzufügen/entfernen
+	Temporal Interpolation	Zeitliche Interpolation
+	Linear	Linear
+	Bezier	Bézier
+	Auto Bezier	Automatische Bézier
+	Continuous Bezier	Kontinuierliche Bézier
+	Ease In	Ease In
+	Ease Out	Ease Out
+	Select a clip to grade	Wähle einen Clip zum Graden aus
+	Select a clip to see its properties	Wähle einen Clip aus, um seine Eigenschaften zu sehen
+	Anchor point	Ankerpunkt
+	Rotation	Drehung
+	Level	Pegel
+	Speed {n}%	Geschwindigkeit {n} %
+	Value	Wert
+	Velocity	Geschwindigkeit
+	Default	Standard
+	Custom ({n} points)	Benutzerdefiniert ({n} Punkte)
+	Select a graphic clip, or use the Type tool (T) on the Program monitor	Wähle einen Grafikclip aus oder verwende das Textwerkzeug (T) im Programmmonitor
+	Create new graphic	Neue Grafik erstellen
+	New Text Layer	Neue Textebene
+	New Text	Neuer Text
+	New Rectangle	Neues Rechteck
+	New Ellipse	Neue Ellipse
+	Delete Layer	Ebene löschen
+	Select a layer to edit its properties.	Wähle eine Ebene aus, um ihre Eigenschaften zu bearbeiten.
+	Align Left	Links ausrichten
+	Align Center Horizontally	Horizontal zentrieren
+	Align Right	Rechts ausrichten
+	Align Top	Oben ausrichten
+	Align Center Vertically	Vertikal zentrieren
+	Align Bottom	Unten ausrichten
+	Font	Schrift
+	Font Style	Schriftschnitt
+	Font Size	Schriftgröße
+	Alignment	Ausrichtung
+	Left Align Text	Text linksbündig
+	Center Align Text	Text zentrieren
+	Right Align Text	Text rechtsbündig
+	Justify	Blocksatz
+	Tracking	Laufweite
+	Leading	Zeilenabstand
+	Baseline Shift	Grundlinienversatz
+	Text Box Width	Textfeldbreite
+	Style	Stil
+	Faux Bold	Faux-Fett
+	Faux Italic	Faux-Kursiv
+	All Caps	Großbuchstaben
+	Small Caps	Kapitälchen
+	Underline	Unterstrichen
+	OpenType	OpenType
+	Kerning	Unterschneidung
+	Ligatures	Ligaturen
+	Shape	Form
+	Size	Größe
+	Corner Radius	Eckenradius
+	Polygon Sides	Polygonseiten
+	Fill	Füllung
+	Stroke	Kontur
+	Stroke 2	Kontur 2
+	Background	Hintergrund
+	   Opacity	   Deckkraft
+	   Size	   Größe
+	   Corner Radius	   Eckenradius
+	Shadow	Schatten
+	   Angle	   Winkel
+	   Distance	   Abstand
+	   Blur	   Weichzeichnung
+	Search templates	Vorlagen suchen
+	All Categories	Alle Kategorien
+	Install…	Installieren…
+	Install Motion Graphics Template (.fcgt)	Motion-Graphics-Vorlage installieren (.fcgt)
+	No templates match.	Keine passenden Vorlagen.
+	{category} · My Template	{category} · Meine Vorlage
+	Apply	Anwenden
+	Remove	Entfernen
+	{n} editable properties	{n} bearbeitbare Eigenschaften
+	   Template: {name}	   Vorlage: {name}
+	Intro Duration	Dauer des Intros
+	Outro Duration	Dauer des Outros
+	Roll	Rollen
+	Start Off Screen	Außerhalb des Bildes beginnen
+	End Off Screen	Außerhalb des Bildes enden
+	Preroll	Vorlauf
+	Postroll	Nachlauf
+	Video Frame	Videobild
+	Pin To	Anheften an
+	Pinned Edges	Angeheftete Kanten
+	FilmCraft Graphics Template	FilmCraft-Grafikvorlage
+	{n} Font	{n} Schrift
+	{n} Size	{n} Größe
+	{n} Color	{n} Farbe
+	{n} Position	{n} Position
+	Show {n}	{n} anzeigen
+	My Templates	Meine Vorlagen
+	Export As Motion Graphics Template	Als Motion-Graphics-Vorlage exportieren
+	Category:	Kategorie:
+	Editable properties:	Bearbeitbare Eigenschaften:
+	Saved as a FilmCraft graphics template (.fcgt) in your templates folder.	Wird als FilmCraft-Grafikvorlage (.fcgt) in deinem Vorlagenordner gespeichert.
+	Exported graphics template to {path}	Grafikvorlage nach {path} exportiert
+	Replace Fonts in Projects	Schriften in Projekten ersetzen
+	Fonts used in the project:	Im Projekt verwendete Schriften:
+	{f} (missing)	{f} (fehlt)
+	Replace:	Ersetzen:
+	Replaced {n} font uses	{n} Schriftverwendungen ersetzt
+	Show/Hide Effects and Sends	Effekte und Sends ein-/ausblenden
+	Audio Track Mixer menu	Menü des Audiospur-Mischpults
+	Show/Hide Tracks…	Spuren ein-/ausblenden…
+	Meter Input(s) Only	Nur Eingänge messen
+	Show/Hide Tracks	Spuren ein-/ausblenden
+	Show All	Alle anzeigen
+	Post-Fader	Post-Fader
+	Remove Effect	Effekt entfernen
+	Fill the slots above first	Füll zuerst die Plätze darüber
+	pre 	pre 
+	Pre-Fader	Pre-Fader
+	Mute Send	Send stummschalten
+	Remove Send	Send entfernen
+	New Submix	Neuer Submix
+	Pan / balance (drag; double-click: centre)	Panorama/Balance (ziehen; Doppelklick: Mitte)
+	Solo safe	Solo-sicher
+	Enable track for recording	Spur für Aufnahme aktivieren
+	Volume (drag; double-click: 0 dB)	Lautstärke (ziehen; Doppelklick: 0 dB)
+	5.1 panner (drag the puck; double-click: front centre)	5.1-Panner (Punkt ziehen; Doppelklick: vorne Mitte)
+	Center	Mitte
+	Go to In Point	Zum In-Punkt gehen
+	Go to Out Point	Zum Out-Punkt gehen
+	Play In to Out	Von In bis Out abspielen
+	Record (voice-over on the record-enabled track)	Aufnehmen (Voice-over auf der aufnahmebereiten Spur)
+	Write keyframes	Keyframes schreiben
+	Something went wrong while drawing the window. Your project is still open; save it to be safe.	Beim Zeichnen des Fensters ist etwas schiefgelaufen. Dein Projekt ist noch geöffnet; speichere es sicherheitshalber.
+	Continue	Fortfahren
+	Go Back	Zurück
+	Go Forward	Vorwärts
+	Up One Level	Eine Ebene nach oben
+	File Types Displayed	Angezeigte Dateitypen
+	List View	Listenansicht
+	Thumbnail View	Miniaturansicht
+	Ingest	Ingest
+	Open Ingest Settings	Ingest-Einstellungen öffnen
+	Import as Image Sequence	Als Bildsequenz importieren
+	{sel} of {total} items selected	{sel} von {total} Elementen ausgewählt
+	{total} items	{total} Elemente
+	Cannot open {dir}: {e}	{dir} kann nicht geöffnet werden: {e}
+	Favorites	Favoriten
+	Local Drives	Lokale Laufwerke
+	Network	Netzwerk
+	Recent Directories	Zuletzt verwendete Ordner
+	  (none)	  (keine)
+	Remove from Favorites	Aus Favoriten entfernen
+	Add to Favorites	Zu Favoriten hinzufügen
+	Clear Recent Directories	Zuletzt verwendete Ordner leeren
+	Open In Source Monitor	Im Quellmonitor öffnen
+	Reveal in Finder	Im Dateimanager anzeigen
+	Edit Columns…	Spalten bearbeiten…
+	Hover Scrub	Hover-Scrubbing
+	New Media Browser Panel	Neues Medienbrowser-Bedienfeld
+	Create Folder For Imported Projects	Ordner für importierte Projekte erstellen
+	Allow Duplicate Media During Project Import	Doppelte Medien beim Projektimport zulassen
+	Refresh	Aktualisieren
+	Edit Columns	Spalten bearbeiten
+	Guides	Hilfslinien
+	(no audio)	(kein Audio)
+	Generating waveform…	Wellenform wird erzeugt…
+	Reference  {tc}	Referenz  {tc}
+	Set	Setzen
+	Set the reference to the playhead	Referenz auf die Abspielposition setzen
+	Reference: next frame	Referenz: nächster Frame
+	Reference: previous frame	Referenz: vorheriger Frame
+	RGBA Channels	RGBA-Kanäle
+	Add Guide	Hilfslinie hinzufügen
+	Save Guides as Template	Hilfslinien als Vorlage speichern
+	Manage Guides	Hilfslinien verwalten
+	Orientation:	Ausrichtung:
+	Vertical	Vertikal
+	Horizontal	Horizontal
+	Position:	Position:
+	No saved guide templates.	Keine gespeicherten Hilfslinienvorlagen.
+	Project: {name}	Projekt: {name}
+	Bin: {name}	Ablage: {name}
+	Up one level	Eine Ebene nach oben
+	Video Usage: {vu}  Audio Usage: {au}	Videonutzung: {vu}  Audionutzung: {au}
+	Icon View	Symbolansicht
+	Freeform View	Freiformansicht
+	Sort Icons	Symbole sortieren
+	Clear (Delete)	Löschen (Entf)
+	New Item	Neues Element
+	New Bin	Neue Ablage
+	Find	Suchen
+	Automate to Sequence	Automatisch in Sequenz einfügen
+	Select items to clear	Wähle die zu löschenden Elemente aus
+	User Order	Benutzerdefinierte Reihenfolge
+	Descending	Absteigend
+	Refresh Project	Projekt aktualisieren
+	Reveal Project in Finder…	Projekt im Dateimanager anzeigen…
+	New Bin From Selection	Neue Ablage aus Auswahl
+	New Search Bin	Neue Suchablage
+	New Project Shortcut	Neue Projektverknüpfung
+	List	Liste
+	Icon	Symbol
+	Freeform	Freiform
+	Preview Area	Vorschaubereich
+	Thumbnails	Miniaturen
+	Thumbnails show effects applied	Miniaturen zeigen angewendete Effekte
+	Thumbnail controls for all pointing devices	Miniatursteuerung für alle Zeigegeräte
+	Refresh Sort Order	Sortierreihenfolge aktualisieren
+	Metadata Display…	Metadatenanzeige…
+	Save Current View Preset	Aktuelle Ansichtsvorgabe speichern
+	Restore View Preset	Ansichtsvorgabe wiederherstellen
+	Project View Preset {n}	Projekt-Ansichtsvorgabe {n}
+	Freeform View Options…	Optionen für die Freiformansicht…
+	Media missing	Medium fehlt
+	Unreadable	Nicht lesbar
+	Open in Source Monitor	Im Quellmonitor öffnen
+	Open in Timeline	In der Timeline öffnen
+	New Sequence From Clip	Neue Sequenz aus Clip
+	Set Poster Frame	Posterframe festlegen
+	Open in Place	An Ort und Stelle öffnen
+	Open in New Tab	In neuem Tab öffnen
+	Open in New Window	In neuem Fenster öffnen
+	{n} items	{n} Elemente
+	Stack	Stapeln
+	Unstack	Stapel auflösen
+	Clip Size	Clipgröße
+	Larger	Größer
+	Smaller	Kleiner
+	Align to Grid	Am Raster ausrichten
+	Reset to Grid	Auf Raster zurücksetzen
+	Save Arrangement…	Anordnung speichern…
+	Restore Arrangement	Anordnung wiederherstellen
+	Delete Arrangement	Anordnung löschen
+	Drop media here to create sequence.	Zieh Medien hierher, um eine Sequenz zu erstellen.
+	Double-click a sequence in the Project panel to open it here.	Doppelklick auf eine Sequenz im Projekt-Bedienfeld öffnet sie hier.
+	Open Demo Project	Demoprojekt öffnen
+	Insert and overwrite sequences as nests or individual clips	Sequenzen als verschachtelte Sequenz oder einzelne Clips einfügen und überschreiben
+	Snap in Timeline (S)	In der Timeline einrasten (S)
+	Caption track options	Optionen für Untertitelspuren
+	Timeline Display Settings	Anzeigeeinstellungen der Timeline
+	Show Video Thumbnails	Video-Miniaturen anzeigen
+	Head	Anfang
+	Head and Tail	Anfang und Ende
+	Continuous	Fortlaufend
+	Show Audio Waveform	Audio-Wellenform anzeigen
+	Expand All Tracks	Alle Spuren erweitern
+	Minimize All Tracks	Alle Spuren minimieren
+	Unrendered: should play back in real time	Nicht gerendert: sollte in Echtzeit abspielen
+	Unrendered: render to play back in real time	Nicht gerendert: zum Abspielen in Echtzeit rendern
+	Rendered preview	Gerenderte Vorschau
+	✓ Enable	✓ Aktivieren
+	Unlink	Verknüpfung aufheben
+	(Default)	(Standard)
+	(RGB) Gamma	(RGB) Gamma
+	(RGB) Input Black Level	(RGB) Eingangsschwarzwert
+	(RGB) Input White Level	(RGB) Eingangsweißwert
+	(RGB) Output Black Level	(RGB) Ausgangsschwarzwert
+	(RGB) Output White Level	(RGB) Ausgangsweißwert
+	+ Cmd	+ Cmd
+	+ Opt	+ Opt
+	10 Bit Black Point	10-Bit-Schwarzpunkt
+	10 Bit White Point	10-Bit-Weißpunkt
+	105mm Prime	105-mm-Festbrennweite
+	29.97 fps Drop-Frame	29,97 fps Drop-Frame
+	29.97 fps Non Drop-Frame	29,97 fps Non-Drop-Frame
+	35mm Prime	35-mm-Festbrennweite
+	3D Roll	3D-Rollen
+	3D Rotate	3D-Drehen
+	3D Spin	3D-Wirbeln
+	3D Spinback	3D-Rückwirbel
+	4-Color Gradient	4-Farben-Verlauf
+	5.1 Media	5.1-Medien
+	5.1 Mixdown Type	5.1-Abmischtyp
+	50-300mm Zoom	50–300-mm-Zoom
+	59.94 fps Drop-Frame	59,94 fps Drop-Frame
+	59.94 fps Non Drop-Frame	59,94 fps Non-Drop-Frame
+	ASC CDL	ASC CDL
+	Accessible color contrast	Barrierefreier Farbkontrast
+	Action-Safe Margin	Sicherer Aktionsbereich
+	Active Monitor	Aktiver Monitor
+	Add	Hinzufügen
+	Add tracks automatically when editing source clips onto the Timeline	Beim Einfügen von Quellclips in die Timeline automatisch Spuren hinzufügen
+	Place files dropped onto the Timeline directly on the Timeline	In die Timeline gezogene Dateien direkt in der Timeline platzieren
+	1 file	1 Datei
+	{n} files	{n} Dateien
+	Additional Scale	Zusätzliche Skalierung
+	Additive Dissolve	Additive Blende
+	Additive Dissolve (Legacy)	Additive Blende (alt)
+	Adjust	Anpassen
+	Advanced	Erweitert
+	Aggressive	Aggressiv
+	Align and Transform	Ausrichten und Transformieren
+	All lines	Alle Zeilen
+	Allow Selection tool to choose Roll and Ripple trims without modifier key	Auswahlwerkzeug darf Rollen- und Ripple-Trimmen ohne Zusatztaste wählen
+	Allow current tool to change trim type of previously selected edit point	Aktuelles Werkzeug darf die Trimmart eines bereits ausgewählten Schnittpunkts ändern
+	Allow duplicate media during project import	Doppelte Medien beim Projektimport zulassen
+	Alpha Adjust	Alpha-Anpassung
+	Alpha Blurriness	Alpha-Unschärfe
+	Alpha Channel	Alphakanal
+	Alpha Glow	Alpha-Glühen
+	Always import embedded CEA-708 closed captions with wide aspect.	Eingebettete CEA-708-Untertitel immer im Breitformat importieren.
+	Always override audio tags	Audio-Tags immer überschreiben
+	Ambience	Umgebung
+	Ambience Intensity	Umgebungsintensität
+	Ambience Light Color	Farbe des Umgebungslichts
+	Amount of Noise	Rauschstärke
+	Amount to Decolor	Stärke der Entfärbung
+	Amount to Tint	Stärke der Tönung
+	Amplifier	Verstärker
+	Amplify	Verstärken
+	Amplitude	Amplitude
+	Amplitude and Compression	Amplitude und Kompression
+	Analog	Analog
+	Analog Delay	Analoges Delay
+	Analyze all imported media to search for visuals or audio	Alle importierten Medien analysieren, um nach Bild- oder Audioinhalten zu suchen
+	Anamorphic	Anamorph
+	Anchor	Anker
+	Anchor Point	Ankerpunkt
+	Angle	Winkel
+	Animation	Animation
+	Anti-aliasing Quality	Kantenglättungsqualität
+	Anti-flicker Filter	Flimmerfilter
+	Antialiasing for Best Quality	Kantenglättung für beste Qualität
+	Asymmetry	Asymmetrie
+	At Startup	Beim Start
+	At playback end, return to beginning when restarting playback	Am Wiedergabeende beim erneuten Abspielen zum Anfang zurückkehren
+	Attempt to force hardware to document sample rate	Versuchen, die Hardware auf die Abtastrate des Dokuments zu zwingen
+	Audio Codec	Audiocodec
+	Audio Duration	Audiodauer
+	Audio Effects	Audioeffekte
+	Audio Hardware	Audiohardware
+	Audio In Point	Audio-In-Punkt
+	Audio Info	Audioinformationen
+	Audio Out Point	Audio-Out-Punkt
+	Audio Samples	Audio-Samples
+	Audio Time Units	Audio-Zeiteinheiten
+	Audio Transition Default Duration	Standarddauer für Audioübergänge
+	Audio Transitions	Audioübergänge
+	Audio Usage	Audionutzung
+	Auto	Automatisch
+	Auto Align	Automatisch ausrichten
+	Auto Reframe	Automatisch neu framen
+	Auto Save	Automatisch speichern
+	Auto Save also saves the current project(s)	Automatisches Speichern speichert auch die aktuellen Projekte
+	Auto-tag audio types in the timeline	Audiotypen in der Timeline automatisch zuweisen
+	Auto-transcribe all imported clips	Alle importierten Clips automatisch transkribieren
+	Auto-transcribe only clips in sequences	Nur Clips in Sequenzen automatisch transkribieren
+	Automatch Time	Zeit für automatischen Abgleich
+	Automatic Click Remover	Automatischer Klickentferner
+	Automatically Hide Dependent Clips	Abhängige Clips automatisch ausblenden
+	Automatically Save Every	Automatisch speichern alle
+	Automatically delete cache files older than	Cachedateien automatisch löschen, die älter sind als
+	Automatically delete oldest cache files when cache exceeds	Älteste Cachedateien automatisch löschen, wenn der Cache größer wird als
+	Automatically refresh growing files	Wachsende Dateien automatisch aktualisieren
+	Automatically resume playback for growing files in Source Monitor	Wiedergabe wachsender Dateien im Quellmonitor automatisch fortsetzen
+	Automatically save projects	Projekte automatisch speichern
+	Automatically transcribe clips	Clips automatisch transkribieren
+	Automation Keyframe Optimization	Optimierung von Automations-Keyframes
+	Background Color	Hintergrundfarbe
+	Background Corner Radius	Eckenradius des Hintergrunds
+	Background Opacity	Deckkraft des Hintergrunds
+	Background Size	Größe des Hintergrunds
+	Background fill	Hintergrundfüllung
+	Balance	Balance
+	Balanced Voice	Ausgewogene Stimme
+	Band 1	Band 1
+	Band 2	Band 2
+	Band 3	Band 3
+	Band 4	Band 4
+	Band 5	Band 5
+	Band Pass	Bandpass
+	Band Slide	Bänder schieben
+	Band Stop	Bandsperre
+	Bandpass	Bandpass
+	Barn Doors	Scheunentor
+	Basic	Einfach
+	Basic 3D	Einfaches 3D
+	Basic Correction	Grundlegende Korrektur
+	Bass	Bass
+	Behind	Dahinter
+	Bessel	Bessel
+	Bevel Alpha	Alpha abschrägen
+	Bevel join	Abgeflachte Ecke
+	Binauralizer - Ambisonics	Binauralisierer – Ambisonics
+	Bins	Ablagen
+	Black	Schwarz
+	Black & White	Schwarzweiß
+	Black Input Level	Schwarzeingangspegel
+	Black and white	Schwarzweiß
+	Black and white with crushed blacks and strong contrast	Schwarzweiß mit abgesoffenen Schwarztönen und starkem Kontrast
+	Bleach Bypass	Bleach Bypass
+	Bleach-bypass style: desaturated with hard contrast	Bleach-Bypass-Stil: entsättigt mit hartem Kontrast
+	Blend	Mischen
+	Blend Mode	Mischmodus
+	Blend With Original	Mit Original mischen
+	Blending Mode	Mischmodus
+	Block Dissolve	Blockauflösung
+	Block Height	Blockhöhe
+	Block Motion	Blockbewegung
+	Block Size	Blockgröße
+	Block Width	Blockbreite
+	Blocks	Blöcke
+	Blue Blurriness	Unschärfe Blau
+	Blue Curve	Kurve Blau
+	Blue Offset	Versatz Blau
+	Blue Power	Potenz Blau
+	Blue Slope	Steigung Blau
+	Blue-Blue	Blau-Blau
+	Blue-Const	Blau-Konst.
+	Blue-Green	Blau-Grün
+	Blue-Red	Blau-Rot
+	Blur & Sharpen	Weich- und Scharfzeichnen
+	Blur Amount	Stärke der Weichzeichnung
+	Blur Angle	Winkel der Weichzeichnung
+	Blur Dimensions	Weichzeichnungsrichtung
+	Blur Dissolve	Weichzeichnende Blende
+	Blur Layer	Weichzeichnungsebene
+	Blur Length	Länge der Weichzeichnung
+	Blurriness	Unschärfe
+	Bokeh Blur	Bokeh-Weichzeichner
+	Boost	Anhebung
+	Border	Rand
+	Border Color	Randfarbe
+	Border Width	Randbreite
+	Borders	Ränder
+	Bottom Center	Unten Mitte
+	Bottom Left	Unten links
+	Bottom Right	Unten rechts
+	Bounce	Abprallen
+	Branching	Verzweigung
+	Bright	Strahlend
+	Bright Air	Helle Luft
+	Bright Studio	Helles Studio
+	Brightness & Contrast	Helligkeit und Kontrast
+	British Stack	British Stack
+	Brush Hardness	Pinselhärte
+	Brush Opacity	Pinseldeckkraft
+	Brush Position	Pinselposition
+	Brush Size	Pinselgröße
+	Brush Spacing (secs)	Pinselabstand (s)
+	Brush Strokes	Pinselstriche
+	Bubbles	Blasen
+	Bulge	Wölbung
+	Bulge Smoother	Wölbungsglättung
+	Bump Height	Reliefhöhe
+	Burn Alpha	Alpha brennen
+	Burn Chroma	Chroma brennen
+	Burn Color	Farbe brennen
+	Butt cap	Flaches Ende
+	Butterworth	Butterworth
+	CEA-608	CEA-608
+	CEA-708	CEA-708
+	Cache analysis results for re-use	Analyseergebnisse zur Wiederverwendung zwischenspeichern
+	Camera Angle	Kamerawinkel
+	Camera Blur	Kamera-Weichzeichner
+	Camera Shake	Kamerawackeln
+	Capitalisation	Groß-/Kleinschreibung
+	Cathedral	Kathedrale
+	Cell Pattern	Zellmuster
+	Center Channel Pan	Panorama des Center-Kanals
+	Center Gradient	Verlauf zur Mitte
+	Center Input	Center-Eingang
+	Center Out	Von der Mitte nach außen
+	Center Point (Latitude)	Mittelpunkt (Breitengrad)
+	Center Point (Longitude)	Mittelpunkt (Längengrad)
+	Center Split	Mittelteilung
+	Center of Sphere	Kugelmittelpunkt
+	Cents	Cent
+	Change to Color	In Farbe ändern
+	Changes are copied in the background a moment after each edit. If FilmCraft quits unexpectedly, they are offered the next time it starts.	Änderungen werden kurz nach jeder Bearbeitung im Hintergrund kopiert. Wird FilmCraft unerwartet beendet, werden sie beim nächsten Start angeboten.
+	Channel	Kanal
+	Channel Blur	Kanal-Weichzeichner
+	Channel Mix	Kanalmischung
+	Channel Mixer	Kanalmixer
+	Chaos	Chaos
+	Chebyshev	Tschebyscheff
+	Checker Wipe	Schachbrett-Wischblende
+	Checkerboard	Schachbrett
+	Chinese	Chinesisch
+	Choke	Verengen
+	Chorus	Chorus
+	Chorus/Flanger	Chorus/Flanger
+	Chroma	Chroma
+	Chroma Leak	Chroma-Leck
+	Chromatic Aberration (Blue)	Chromatische Aberration (Blau)
+	Chromatic Aberration (Green)	Chromatische Aberration (Grün)
+	Chromatic Aberration (Red)	Chromatische Aberration (Rot)
+	Cineon Converter	Cineon-Konverter
+	Circle	Kreis
+	Clarity	Klarheit
+	Clean Combo	Clean-Combo
+	Clean Up Noisy Dialogue	Verrauschte Dialoge bereinigen
+	Clear Muddiness	Dumpfheit entfernen
+	Client	Kunde
+	Clip Level	Clippegel
+	Clipping	Übersteuerung
+	Clock Wipe	Uhr-Wischblende
+	Clock Wipe (Legacy)	Uhr-Wischblende (alt)
+	Clockwise	Im Uhrzeigersinn
+	Clone	Klonen
+	Closed Captions	Untertitel (Closed Captions)
+	Color & Alpha	Farbe und Alpha
+	Color 1	Farbe 1
+	Color 2	Farbe 2
+	Color 3	Farbe 3
+	Color 4	Farbe 4
+	Color Balance	Farbbalance
+	Color Burn	Farbig nachbelichten
+	Color Channel	Farbkanal
+	Color Correction	Farbkorrektur
+	Color Distortion	Farbverzerrung
+	Color Dodge	Farbig abwedeln
+	Color Emboss	Farbprägen
+	Color Key	Farb-Key
+	Color Pass	Farbe durchlassen
+	Color Replace	Farbe ersetzen
+	Color Space	Farbraum
+	Color Theme	Farbschema
+	Color To Leave	Beizubehaltende Farbe
+	Color Tolerance	Farbtoleranz
+	Color Wheels & Match	Farbräder und Abgleich
+	Colorize	Färben
+	Columns	Spalten
+	Comment	Kommentar
+	Complexity	Komplexität
+	Composite In Back	Dahinter zusammensetzen
+	Composite In Front	Davor zusammensetzen
+	Composite Using	Zusammensetzen mit
+	Composite on Original	Über Original zusammensetzen
+	Compound Blur	Zusammengesetzte Weichzeichnung
+	Compression Before Clipping	Kompression vor dem Clipping
+	Constant Gain	Konstante Verstärkung
+	Constant Power	Konstante Leistung
+	Conversion Type	Konvertierungsart
+	Convolution Reverb	Faltungshall
+	Cool Blue	Kühles Blau
+	Cool, desaturated and punchy	Kühl, entsättigt und kräftig
+	Core Width	Kernbreite
+	Corner	Ecke
+	Corner Pin	Eckpunkte
+	Count	Anzahl
+	Counter-clockwise	Gegen den Uhrzeigersinn
+	Crash Recovery	Absturzwiederherstellung
+	Crawl Left	Nach links laufen
+	Crawl Right	Nach rechts laufen
+	Create folder for imported projects	Ordner für importierte Projekte erstellen
+	Creative	Kreativ
+	Crop	Zuschneiden
+	Crop Less <-> Smooth More	Weniger zuschneiden <-> Stärker glätten
+	Cross Displacement	Kreuzverschiebung
+	Cross Dissolve	Weiche Blende
+	Cross Dissolve (Legacy)	Weiche Blende (alt)
+	Cross Zoom	Kreuzzoom
+	Cross Zoom (Legacy)	Kreuzzoom (alt)
+	Crossfade	Überblendung
+	Crossovers	Übergangsfrequenzen
+	Crystallize	Kristallisieren
+	Crystals	Kristalle
+	Cube Spin	Würfeldrehung
+	Curl Radius	Rollradius
+	Current Time	Aktuelle Zeit
+	Cursor	Cursor
+	Curvature	Krümmung
+	Curve	Kurve
+	Curves	Kurven
+	Custom	Benutzerdefiniert
+	Custom Color	Benutzerdefinierte Farbe
+	Cutoff	Grenzfrequenz
+	Cyan-teal shadows and warm highlights with a little more contrast	Cyan-grünliche Tiefen und warme Lichter mit etwas mehr Kontrast
+	Cycle (in Revolutions)	Zyklus (in Umdrehungen)
+	Cycle Evolution	Zyklische Entwicklung
+	Damping	Dämpfung
+	Damping HF	Höhendämpfung
+	Damping LF	Tiefendämpfung
+	Darken	Abdunkeln
+	Darker Color	Dunklere Farbe
+	Date Created	Erstellungsdatum
+	Date Modified	Änderungsdatum
+	Day for night: darker, cooler and less saturated	Day for Night: dunkler, kühler und weniger gesättigt
+	DeEsser	De-Esser
+	DeHummer	Brummentferner
+	DeNoise	Entrauscher
+	DeReverb	Hallentferner
+	Decay	Abklingen
+	Decay Time (RT60)	Abklingzeit (RT60)
+	Default Audio Tracks	Standard-Audiospuren
+	Default Emoji font	Standard-Emoji-Schrift
+	Default Media Scaling	Standard-Medienskalierung
+	Default Output	Standardausgang
+	Default closed caption font	Standardschrift für Closed Captions
+	Default language	Standardsprache
+	Default paragraph direction	Standard-Absatzrichtung
+	Default subtitle and text font	Standardschrift für Untertitel und Text
+	Delay	Delay
+	Delay 1	Delay 1
+	Delay 2	Delay 2
+	Delay 3	Delay 3
+	Delay 4	Delay 4
+	Delay and Echo	Delay und Echo
+	Delete files older than	Dateien löschen, die älter sind als
+	Delete oldest files when the cache exceeds	Älteste Dateien löschen, wenn der Cache größer wird als
+	Delete…	Löschen…
+	Depth	Tiefe
+	Desaturate	Entsättigen
+	Description	Beschreibung
+	Detail Amplitude	Detailamplitude
+	Detail Level	Detailgrad
+	Detailed Analysis	Detaillierte Analyse
+	Device Class	Geräteklasse
+	Dialogue	Dialog
+	Diamond	Raute
+	Difference	Differenz
+	Dimensions	Abmessungen
+	Dimmed	Abgedunkelt
+	Dip to Black	Über Schwarz blenden
+	Dip to Black (Legacy)	Über Schwarz blenden (alt)
+	Dip to Color	Über Farbe blenden
+	Dip to White	Über Weiß blenden
+	Dip to White (Legacy)	Über Weiß blenden (alt)
+	Direction	Richtung
+	Directional	Gerichtet
+	Directional Blur	Richtungsunschärfe
+	Directional Blur (Legacy)	Richtungsunschärfe (alt)
+	Disable video output when in the background	Videoausgabe im Hintergrund deaktivieren
+	Disperse	Streuen
+	Displacement	Verschiebung
+	Display Color Management	Farbmanagement der Anzeige
+	Display Color Settings	Farbeinstellungen der Anzeige
+	Display out of sync indicators for unlinked clips	Asynchronitätsanzeige für nicht verknüpfte Clips anzeigen
+	Dissolve	Auflösen
+	Dissolve Blocks	Auflösungsblöcke
+	Distance	Abstand
+	Distance to Image	Abstand zum Bild
+	Distort	Verzerren
+	Distortion	Verzerrung
+	Distortion Complexity	Komplexität der Verzerrung
+	Distortion Rate	Geschwindigkeit der Verzerrung
+	Distortion Type	Verzerrungsart
+	Divide	Dividieren
+	Do not delete cache files automatically	Cachedateien nicht automatisch löschen
+	Don't label speakers	Sprecher nicht kennzeichnen
+	Double-click	Doppelklick
+	Draft decoding at reduced playback resolution (H.264: faster, some frames less filtered)	Entwurfsdekodierung bei reduzierter Wiedergabeauflösung (H.264: schneller, manche Frames weniger gefiltert)
+	Drive	Drive
+	Drop Shadow	Schlagschatten
+	Dry	Dry
+	Dry Out	Dry-Ausgang
+	Dry Up a Roomy Voice	Hallige Stimme trockener machen
+	Duck Deep Under Dialogue	Stark unter Dialog absenken
+	Duck Under Dialogue	Unter Dialog absenken
+	Duck Under Voice and Effects	Unter Stimme und Effekte absenken
+	Ducking	Ducking
+	Dutch	Niederländisch
+	Dynamic Link	Dynamic Link
+	Dynamics Processing	Dynamikbearbeitung
+	Early Reflections	Frühe Reflexionen
+	Earthquake	Erdbeben
+	Ease In and Out	Ease In und Ease Out
+	Easing	Easing
+	Echo	Echo
+	Echo Glow	Echo-Glühen
+	Echo Operator	Echo-Operator
+	Echo Time (seconds)	Echozeit (Sekunden)
+	Echoes	Echos
+	Edge Color	Kantenfarbe
+	Edge Feather	Weiche Kante
+	Edge Glow	Kantenglühen
+	Edge Sharpness	Kantenschärfe
+	Edge Softness	Kantenweichheit
+	Edge Thickness	Kantenstärke
+	Edge Thin	Kante verdünnen
+	Edge Threshold	Kantenschwellenwert
+	Edge Type	Kantentyp
+	Edge Width	Kantenbreite
+	Elliptical	Elliptisch
+	Emboss	Prägen
+	Enable HSL Secondary	HSL-Sekundär aktivieren
+	Enable Mercury Transmit	Mercury Transmit aktivieren
+	Enable ProRes hardware accelerated encoding, if available	Hardwarebeschleunigte ProRes-Kodierung aktivieren, falls verfügbar
+	Enable clip and XMP metadata linking	Verknüpfung von Clip- und XMP-Metadaten aktivieren
+	Enable developer mode	Entwicklermodus aktivieren
+	Enable hardware accelerated decoding (requires restart)	Hardwarebeschleunigte Dekodierung aktivieren (Neustart erforderlich)
+	Enable language auto-detection	Automatische Spracherkennung aktivieren
+	Enable proxies	Proxys aktivieren
+	End Color	Endfarbe
+	End Point	Endpunkt
+	End of Ramp	Ende des Verlaufs
+	Error	Fehler
+	Evolution	Entwicklung
+	Evolution Options	Entwicklungsoptionen
+	Exciter Amount	Exciter-Stärke
+	Exciter Mode	Exciter-Modus
+	Exclusion	Ausschluss
+	Exponential Fade	Exponentielle Blende
+	Extended Dynamic Range Monitoring	Überwachung mit erweitertem Dynamikumfang
+	FFT Filter	FFT-Filter
+	Fade	Blende
+	Fade Out	Ausblenden
+	Faded Matte	Verblasster Matte-Look
+	Falloff	Abfall
+	Far Away	Weit entfernt
+	Fast	Schnell
+	Faster Motion	Schnellere Bewegung
+	Feedback	Feedback
+	Feedback 1	Feedback 1
+	Feedback 2	Feedback 2
+	Feedback 3	Feedback 3
+	Feedback 4	Feedback 4
+	Feet + Frames 16mm	Fuß + Frames 16 mm
+	Feet + Frames 35mm	Fuß + Frames 35 mm
+	Female	Weiblich
+	File Size	Dateigröße
+	Fill Background	Hintergrund füllen
+	Fill Color	Füllfarbe
+	Fill Left with Right	Links mit rechts füllen
+	Fill Point	Füllpunkt
+	Fill Right with Left	Rechts mit links füllen
+	Fill Selector	Füllauswahl
+	Film Dissolve	Filmblende
+	Film Dissolve (Legacy)	Filmblende (alt)
+	Film Roll	Filmrolle
+	Filter	Filter
+	Filter Frequency	Filterfrequenz
+	Filter Resonance	Filterresonanz
+	Filter and EQ	Filter und EQ
+	Final Delay	Letztes Delay
+	Find Edges	Kanten finden
+	Flanger	Flanger
+	Flare	Lichtreflex
+	Flare Brightness	Helligkeit des Lichtreflexes
+	Flare Center	Mitte des Lichtreflexes
+	Flare Color	Farbe des Lichtreflexes
+	Flash	Aufblitzen
+	Flicker	Flackern
+	Flickers	Flackern
+	Flip Motion	Klappbewegung
+	Flip Over	Umklappen
+	Float	Gleitkomma
+	Focus	Fokus
+	Focus Blur	Fokusunschärfe
+	Focus Point	Fokuspunkt
+	Focus Shape	Fokusform
+	Focus Size	Fokusgröße
+	Fold Motion	Faltbewegung
+	Foldback	Foldback
+	For color management parameters, go to the Settings tab in the Lumetri Color panel.	Die Parameter für das Farbmanagement findest du auf dem Reiter „Einstellungen“ des Bedienfelds „Lumetri-Farbe“.
+	Format	Format
+	Four Scopes (RGB, 8 bit)	Vier Scopes (RGB, 8 Bit)
+	Four Scopes (YUV, float, no clamp)	Vier Scopes (YUV, Gleitkomma, unbegrenzt)
+	Fractal Influence	Fraktaler Einfluss
+	Fractal Type	Fraktaltyp
+	Frame	Frame
+	Frame Color	Rahmenfarbe
+	Frame Count	Anzahl der Frames
+	Frame Layout	Frame-Layout
+	Frame Rate	Framerate
+	Frame Width	Rahmenbreite
+	Frame cache for monitors and thumbnails	Frame-Cache für Monitore und Miniaturen
+	Frames	Frames
+	Framing	Bildausschnitt
+	French	Französisch
+	Frequency	Frequenz
+	From	Von
+	From East	Von Osten
+	From North	Von Norden
+	From South	Von Süden
+	From West	Von Westen
+	From the Left	Von links
+	From the Right	Von rechts
+	Front + LFE	Front + LFE
+	Front + Rear	Front + Surround
+	Front + Rear + LFE	Front + Surround + LFE
+	Front Only	Nur Front
+	Fuzz	Fuzz
+	GB	GB
+	Gamma	Gamma
+	Gamma Correction	Gammakorrektur
+	Gamut Warning	Gamutwarnung
+	Gamut Warning Color	Farbe der Gamutwarnung
+	Gap	Lücke
+	Gap Color	Lückenfarbe
+	Gaussian Blur	Gaußscher Weichzeichner
+	Gaussian Blur (Legacy)	Gaußscher Weichzeichner (alt)
+	General	Allgemein
+	Generate	Erzeugen
+	Generate Timecode	Timecode erzeugen
+	Generate waveforms and conform audio using multithreading	Wellenformen erzeugen und Audio angleichen mit mehreren Threads
+	Generate waveforms automatically during import	Wellenformen beim Import automatisch erzeugen
+	German	Deutsch
+	Ghosts	Geisterbilder
+	Glass	Glas
+	Glint	Glitzern
+	Glitch	Glitch
+	Glow	Glühen
+	Glow Brightness	Helligkeit des Glühens
+	Glow Color	Farbe des Glühens
+	Glow Only	Nur Glühen
+	Glow Radius	Radius des Glühens
+	Glow Saturation	Sättigung des Glühens
+	Glow Width	Breite des Glühens
+	Golden Hour	Goldene Stunde
+	Good	Gut
+	Gradient	Farbverlauf
+	Gradient End	Verlaufsende
+	Gradient Layer	Verlaufsebene
+	Gradient Placement	Verlaufsplatzierung
+	Gradient Scatter	Verlaufsstreuung
+	Gradient Shape	Verlaufsform
+	Gradient Start	Verlaufsanfang
+	Gradient Wipe	Verlaufswischblende
+	Gradient Wipe (Legacy)	Verlaufswischblende (alt)
+	Grain Size	Korngröße
+	Graphic Equalizer (10 Bands)	Grafischer Equalizer (10 Bänder)
+	Graphic Equalizer (20 Bands)	Grafischer Equalizer (20 Bänder)
+	Graphic Equalizer (30 Bands)	Grafischer Equalizer (30 Bänder)
+	Graphics	Grafiken
+	Green Blurriness	Unschärfe Grün
+	Green Curve	Kurve Grün
+	Green Offset	Versatz Grün
+	Green Power	Potenz Grün
+	Green Slope	Steigung Grün
+	Green-Blue	Grün-Blau
+	Green-Const	Grün-Konst.
+	Green-Green	Grün-Grün
+	Green-Red	Grün-Rot
+	Grid	Raster
+	Grow	Ausdehnen
+	Growing Files	Wachsende Dateien
+	Grunge	Grunge
+	Grunge & Distort	Grunge und Verzerrung
+	GuitarSuite	GuitarSuite
+	HDR Graphics White (Nits)	HDR-Grafikweiß (Nits)
+	HLS Vectorscope + Histogram	HLS-Vektorskop + Histogramm
+	HSL Secondary	HSL-Sekundär
+	Hard	Hart
+	Hard Clip	Hartes Clipping
+	Hard Light	Hartes Licht
+	Hard Limiter	Harter Limiter
+	Hard Mix	Hart mischen
+	Hardware decoding	Hardwaredekodierung
+	Hardware decoding: Auto uses the system's video decoder (VideoToolbox on macOS, Media Foundation on Windows, VA-API or NVDEC for H.264 and HEVC on Linux) for the streams it supports, and FilmCraft's own decoder for everything else or if the hardware fails. Media that is already open keeps its decoder until it is reopened.	Hardwaredekodierung: „Automatisch“ verwendet den Videodecoder des Systems (VideoToolbox unter macOS, Media Foundation unter Windows, VA-API oder NVDEC für H.264 und HEVC unter Linux) für die Streams, die er unterstützt, und den eigenen Decoder von FilmCraft für alles andere oder wenn die Hardware versagt. Bereits geöffnete Medien behalten ihren Decoder, bis sie erneut geöffnet werden.
+	Head Size	Kopfgröße
+	Heart	Herz
+	Height	Höhe
+	Hexagon	Sechseck
+	Hide Back Face	Rückseite ausblenden
+	High	Hoch
+	High Cutoff	Obere Grenzfrequenz
+	High Frequency Cut	Höhenschnitt
+	High Frequency Damping	Höhendämpfung
+	High Pass	Hochpass
+	High Shelf	High-Shelf
+	High Shelf Gain	High-Shelf-Verstärkung
+	High contrast with held highlights and deep shadows	Hoher Kontrast mit gehaltenen Lichtern und tiefen Schatten
+	Highlight	Glanzlicht
+	Highlight Blue Balance	Blaubalance der Lichter
+	Highlight Brightness	Helligkeit der Lichter
+	Highlight Color	Hervorhebungsfarbe
+	Highlight Green Balance	Grünbalance der Lichter
+	Highlight Red Balance	Rotbalance der Lichter
+	Highlight Rolloff	Lichter-Roll-off
+	Highlight Threshold	Schwellenwert der Lichter
+	Highlight Tint	Tönung der Lichter
+	Highlights Lightness	Lichter: Helligkeit
+	Highpass	Hochpass
+	Hindi	Hindi
+	Hindi digits	Hindi-Ziffern
+	Horizontal 16:9	Horizontal 16:9
+	Horizontal Alignment	Horizontale Ausrichtung
+	Horizontal Blocks	Horizontale Blöcke
+	Horizontal Decentering	Horizontale Dezentrierung
+	Horizontal Displacement	Horizontale Verschiebung
+	Horizontal Flip	Horizontal spiegeln
+	Horizontal Margin	Horizontaler Rand
+	Horizontal and Vertical	Horizontal und vertikal
+	Hue Center	Farbtonmitte
+	Hue Tolerance	Farbtontoleranz
+	I/O Buffer Size	E/A-Puffergröße
+	Ignore Alpha	Alpha ignorieren
+	Image Control	Bildsteuerung
+	Immersive Video	Immersives Video
+	Import numbered stills as image sequences	Nummerierte Standbilder als Bildsequenzen importieren
+	Impulse	Impuls
+	In a Room	In einem Raum
+	In the Media Cache	Im Mediencache
+	In the project	Im Projekt
+	In/Out Duration	Dauer In bis Out
+	Include captions on import	Untertitel beim Import einschließen
+	Incoming	Eingehend
+	Indeterminate Media Timebase	Unbestimmte Medien-Zeitbasis
+	Initial Delay	Anfangs-Delay
+	Inner	Innen
+	Inner Radius	Innenradius
+	Input Boost	Eingangsanhebung
+	Inset	Einsatz
+	Inside	Innen
+	Inside Color	Innenfarbe
+	Inter	Inter
+	Interior Room Tone	Raumton (innen)
+	Internal Black Point	Interner Schwarzpunkt
+	Internal White Point	Interner Weißpunkt
+	Interpolation	Interpolation
+	Intersect	Schnittmenge
+	Inverse Falloff	Umgekehrter Abfall
+	Invert	Umkehren
+	Invert Alpha	Alpha umkehren
+	Invert Blur	Weichzeichnung umkehren
+	Invert Fill	Füllung umkehren
+	Invert Gradient	Verlauf umkehren
+	Invert Left	Links umkehren
+	Invert Right	Rechts umkehren
+	Iris Box	Iris (Rechteck)
+	Iris Cross	Iris (Kreuz)
+	Iris Diamond	Iris (Raute)
+	Iris Radius	Irisradius
+	Iris Rotation	Irisdrehung
+	Iris Round	Iris (rund)
+	Iris Shape	Irisform
+	Italian	Italienisch
+	Japanese	Japanisch
+	JetBrains Mono	JetBrains Mono
+	Join Through Edits	Durchgehende Schnitte zusammenfügen
+	Ripple Trim In	Ripple-Trimmen am In-Punkt
+	Ripple Trim Out	Ripple-Trimmen am Out-Punkt
+	Roll Edit	Rollen-Bearbeitung
+	Trim In	In-Punkt trimmen
+	Trim Out	Out-Punkt trimmen
+	Kaleidoscope	Kaleidoskop
+	Keep a recovery copy of unsaved changes	Wiederherstellungskopie nicht gespeicherter Änderungen behalten
+	Key Color	Key-Farbe
+	Keying	Keying
+	Korean	Koreanisch
+	Label Defaults	Standard-Farbmarkierungen
+	Label speakers	Sprecher kennzeichnen
+	Labels	Farbmarkierungen
+	Large Hall	Große Halle
+	Large Trim Offset	Großer Trimmversatz
+	Large Volume Adjustment	Große Lautstärkeanpassung
+	Latch	Latch
+	Layer Name	Ebenenname
+	Layers	Ebenen
+	Leave Color	Farbe beibehalten
+	Left - Left	Links – links
+	Left - Right	Links – rechts
+	Left channel to device output	Linker Kanal auf Geräteausgang
+	Left to Right	Von links nach rechts
+	Left to right	Von links nach rechts
+	Legacy	Alte Versionen
+	Length	Länge
+	Lens Blur	Objektivunschärfe
+	Lens Distortion	Objektivverzerrung
+	Lens Flare	Blendenfleck
+	Lens Type	Objektivtyp
+	Level 1	Ebene 1
+	Level 2	Ebene 2
+	Level 3	Ebene 3
+	Level 4	Ebene 4
+	Levels	Tonwerte
+	Lifted blacks, softer contrast, muted colour	Angehobene Schwarztöne, weicherer Kontrast, gedämpfte Farben
+	Light 1	Licht 1
+	Light 2	Licht 2
+	Light 3	Licht 3
+	Light 4	Licht 4
+	Light 5	Licht 5
+	Light Angle	Lichtwinkel
+	Light Color	Lichtfarbe
+	Light Intensity	Lichtintensität
+	Light Leak	Lichteinfall
+	Light Leaks	Lichteinfälle
+	Light Sweep	Lichtschweif
+	Light Type	Lichtart
+	Lighten	Aufhellen
+	Lighter Color	Hellere Farbe
+	Lighting Effects	Beleuchtungseffekte
+	Lightning	Blitz
+	Lights & Blurs	Licht und Weichzeichnung
+	Lights & Glows	Licht und Glühen
+	Line Thickness	Linienstärke
+	Linear Burn	Linear nachbelichten
+	Linear Dodge (Add)	Linear abwedeln (Addieren)
+	Linear Light	Lineares Licht
+	Linear Ramp	Linearer Verlauf
+	Linear Wipe	Lineare Wischblende
+	Linear Wipe (Legacy)	Lineare Wischblende (alt)
+	Linear keyframe thinning	Lineares Ausdünnen von Keyframes
+	Linear to Log	Linear zu Log
+	Liquid Distortion	Flüssige Verzerrung
+	Local Projects	Lokale Projekte
+	Location	Speicherort
+	Log Note	Protokollnotiz
+	Log to Linear	Log zu Linear
+	Log to Log	Log zu Log
+	Logo Cutout	Logo-Aussparung
+	Long Shadow	Langer Schatten
+	Look-Ahead Time	Vorausschauzeit
+	Loudness	Lautheit
+	Loudness Maximizer	Lautheitsmaximierer
+	Loudness Meter	Lautheitsmesser
+	Louver	Lamellen
+	Low	Niedrig
+	Low Frequency Cut	Tiefenschnitt
+	Low Pass	Tiefpass
+	Low Shelf	Low-Shelf
+	Low Shelf Gain	Low-Shelf-Verstärkung
+	Lower Left	Unten links
+	Lower Right	Unten rechts
+	Lowpass	Tiefpass
+	Luma	Luma
+	Luma Curve	Luma-Kurve
+	Luma Fade	Luma-Blende
+	Luma Key	Luma-Key
+	Luma Source	Luma-Quelle
+	Luma and Chroma	Luma und Chroma
+	Lumetri Presets	Lumetri-Vorgaben
+	Luminance	Luminanz
+	Luminance Threshold	Luminanzschwellenwert
+	Luminosity	Luminanz
+	MB	MB
+	Magnify	Vergrößern
+	Magnify (Legacy)	Vergrößern (alt)
+	Maintain pitch while shuttling	Tonhöhe beim Shuttlen beibehalten
+	Major Radius	Großer Radius
+	Male	Männlich
+	Map Black To	Schwarz zuordnen zu
+	Map White To	Weiß zuordnen zu
+	Maps full-range levels into 16–235 (video range) with a luma curve	Bildet Pegel des vollen Bereichs mit einer Luma-Kurve auf 16–235 (Videobereich) ab
+	Mask Only	Nur Maske
+	Master Amplitude	Gesamtamplitude
+	Mastering	Mastering
+	Match frame sets in point	Quellbild finden setzt In-Punkt
+	Matte	Matte
+	Matte Alpha	Matte-Alpha
+	Matte Cleanup	Matte-Bereinigung
+	Matte Generation	Matte-Erzeugung
+	Matte Luma	Matte-Luma
+	Maximum	Maximum
+	Maximum Amplitude	Maximale Amplitude
+	Maximum Block Size	Maximale Blockgröße
+	Maximum Blur	Maximale Weichzeichnung
+	Maximum Project Versions	Maximale Anzahl an Projektversionen
+	Maximum Reduction	Maximale Absenkung
+	Maximum Scale	Maximale Skalierung
+	Media	Medien
+	Media Analysis	Medienanalyse
+	Media Analysis & Transcription	Medienanalyse und Transkription
+	Media Cache	Mediencache
+	Media Cache Database	Mediencache-Datenbank
+	Media Cache Files	Mediencache-Dateien
+	Media Cache Management	Mediencache-Verwaltung
+	Media Duration	Mediendauer
+	Media End	Medienende
+	Media Time	Medienzeit
+	Media Timecode	Medien-Timecode
+	Media Type	Medientyp
+	Media analysis and transcriptions will be cached in the Media Cache folder. Reanalysis won't be required if the media is imported into another project on this computer.	Medienanalysen und Transkriptionen werden im Mediencache-Ordner zwischengespeichert. Wird das Medium auf diesem Computer in ein anderes Projekt importiert, ist keine neue Analyse nötig.
+	Median	Median
+	Medium Room	Mittlerer Raum
+	Memory	Arbeitsspeicher
+	Metadata & Timecode Burn-in	Metadaten und Timecode einbrennen
+	Method	Methode
+	Metrics Kerning	Metrische Unterschneidung
+	Mid	Mitten
+	Mid Point	Mittelpunkt
+	Midtone Blue Balance	Blaubalance der Mitteltöne
+	Midtone Green Balance	Grünbalance der Mitteltöne
+	Midtone Red Balance	Rotbalance der Mitteltöne
+	Midtones Lightness	Mitteltöne: Helligkeit
+	Minimum	Minimum
+	Minimum time	Mindestzeit
+	Minimum time interval thinning	Ausdünnen nach Mindestzeitabstand
+	Minor Radius	Kleiner Radius
+	Mirror	Spiegeln
+	Mirror Alternate	Abwechselnd spiegeln
+	Missing font replacement	Ersatz für fehlende Schriften
+	Miter join	Spitze Ecke
+	Miter limit	Gehrungsgrenze
+	Mixed Crystals	Gemischte Kristalle
+	Mode	Modus
+	Modern High Gain	Moderner High-Gain
+	Modulation	Modulation
+	Modulation Rate	Modulationsrate
+	Mono Media	Mono-Medien
+	Monochrome	Monochrom
+	Monochrome toned cyan-blue	Monochrom, cyanblau getönt
+	Monochrome toned warm brown	Monochrom, warmbraun getönt
+	Monoscopic	Monoskopisch
+	Monospace only	Nur dicktengleiche Schriften
+	More colour in the less saturated areas	Mehr Farbe in weniger gesättigten Bereichen
+	Morph Cut	Morph-Schnitt
+	Mosaic	Mosaik
+	Mosaic (Legacy)	Mosaik (alt)
+	Motion Blur	Bewegungsunschärfe
+	Motion Camera	Kamerabewegung
+	Motion Preset	Bewegungsvorgabe
+	Motion Tween	Bewegungs-Tween
+	Move	Verschieben
+	Movie	Film
+	Movie (audio and video)	Film (Audio und Video)
+	Multiband Compressor	Multiband-Kompressor
+	Multichannel Mono Media	Mehrkanal-Mono-Medien
+	Multiply	Multiplizieren
+	Multitap Delay	Multitap-Delay
+	Music	Musik
+	Mute input during timeline recording	Eingang während der Timeline-Aufnahme stummschalten
+	Name	Name
+	Narrow	Schmal
+	Neon Color	Neonfarbe
+	Neon Wipe	Neon-Wischblende
+	Next to original media files	Neben den Original-Mediendateien
+	Night	Nacht
+	No Motion	Keine Bewegung
+	No Scroll	Kein Bildlauf
+	No plugins are installed. Changes will take effect the next time you start FilmCraft.	Es sind keine Plug-ins installiert. Änderungen werden beim nächsten Start von FilmCraft wirksam.
+	Noise	Rauschen
+	Noise & Grain	Rauschen und Körnung
+	Noise (Legacy)	Rauschen (alt)
+	Noise Level	Rauschpegel
+	Noise Reduction/Restoration	Rauschunterdrückung/Restaurierung
+	Noise Type	Rauschtyp
+	Non-Additive Dissolve	Nicht-additive Blende
+	Normal	Normal
+	Notch 1	Notch 1
+	Notch 2	Notch 2
+	Notch 3	Notch 3
+	Notch 4	Notch 4
+	Notch 5	Notch 5
+	Notch 6	Notch 6
+	Notch Filter	Notch-Filter
+	Notch Width	Notch-Breite
+	Number Of Echoes	Anzahl der Echos
+	Number of Harmonics	Anzahl der Obertöne
+	Obsolete	Veraltet
+	Octagon	Achteck
+	Offset	Versatz
+	Offset (Turbulence)	Versatz (Turbulenz)
+	Offset From	Versatz von
+	Offset To	Versatz bis
+	Omni	Omni
+	On	An
+	On Original Image	Auf Originalbild
+	On Transparent	Auf Transparenz
+	Open Air	Freiluft
+	Open Most Recent	Zuletzt verwendetes öffnen
+	Open in new window	In neuem Fenster öffnen
+	Open in place	An Ort und Stelle öffnen
+	Open new tab	Neuen Tab öffnen
+	Opens up the shadows	Hellt die Tiefen auf
+	Order	Reihenfolge
+	Orientation	Ausrichtung
+	Outer	Außen
+	Outgoing	Ausgehend
+	Output	Ausgang
+	Output Mapping	Ausgangszuordnung
+	Outside	Außen
+	Outside Color	Außenfarbe
+	Overflow	Überlauf
+	Overlay	Überlagern
+	Overshoot	Überschwingen
+	Page Peel	Seite ablösen
+	Page Scroll	Seite rollen
+	Page Turn	Seite umblättern
+	Paint Bucket	Farbeimer
+	Paint On Black	Auf Schwarz malen
+	Paint On Original Image	Auf Originalbild malen
+	Paint On Transparent	Auf Transparenz malen
+	Paint On White	Auf Weiß malen
+	Paint Style	Malstil
+	Paint Surface	Malfläche
+	Pan (Y Axis)	Schwenk (Y-Achse)
+	Panel Wipe	Feld-Wischblende
+	Panels	Bedienfelder
+	Panner - Ambisonics	Panner – Ambisonics
+	Parade	Parade
+	Parade (RGB)	Parade (RGB)
+	Parametric Equalizer	Parametrischer Equalizer
+	Passband Ripple	Welligkeit im Durchlassbereich
+	Path	Pfad
+	Path Points	Pfadpunkte
+	Pause Media Encoder queue during playback	Media-Encoder-Warteschlange während der Wiedergabe anhalten
+	Peak Frequency	Spitzenfrequenz
+	Peak Gain	Spitzenverstärkung
+	Pedestal	Schwarzabhebung
+	Pentagon	Fünfeck
+	Per line	Pro Zeile
+	Percent Blur	Weichzeichnung in Prozent
+	Perspective	Perspektive
+	Phase Difference	Phasendifferenz
+	Phaser	Phaser
+	Phone Call	Telefonanruf
+	Phosphor	Phosphor
+	Phosphor Color	Phosphorfarbe
+	Photocopy	Fotokopie
+	Photocopy Color	Fotokopie-Farbe
+	Pillow	Kissen
+	Pin All	Alle anheften
+	Pin Horizontal	Horizontal anheften
+	Pin Light	Lichtpunkt
+	Pin Vertical	Vertikal anheften
+	Pinning	Anheften
+	Pitch Shifter	Tonhöhenverschiebung
+	Plate	Platte
+	Plateau Wipe	Plateau-Wischblende
+	Plateaus	Plateaus
+	Plates	Platten
+	Play after rendering previews	Nach dem Rendern der Vorschau abspielen
+	Play audio while scrubbing in Source and Program Monitors	Audio beim Scrubben in Quell- und Programmmonitor abspielen
+	Playback	Wiedergabe
+	Playhead position determines trim monitor loop playback	Die Abspielposition bestimmt die Schleifenwiedergabe im Trimmmonitor
+	Plugins	Plug-ins
+	Podcast Voice	Podcast-Stimme
+	Point 1	Punkt 1
+	Point 1 Color	Farbe Punkt 1
+	Point 1 Latitude	Breitengrad Punkt 1
+	Point 1 Longitude	Längengrad Punkt 1
+	Point 2	Punkt 2
+	Point 2 Color	Farbe Punkt 2
+	Point 2 Latitude	Breitengrad Punkt 2
+	Point 2 Longitude	Längengrad Punkt 2
+	Point 3	Punkt 3
+	Point 3 Color	Farbe Punkt 3
+	Point 3 Latitude	Breitengrad Punkt 3
+	Point 3 Longitude	Längengrad Punkt 3
+	Point 4	Punkt 4
+	Point 5	Punkt 5
+	Point 6	Punkt 6
+	Point 7	Punkt 7
+	Point 8	Punkt 8
+	Points	Punkte
+	Policy	Richtlinie
+	Pop Motion	Aufspringende Bewegung
+	Portuguese	Portugiesisch
+	Position & Rotation	Position und Drehung
+	Position Amount	Positionsstärke
+	Position, Scale & Rotation	Position, Skalierung und Drehung
+	Position, Scale, Rotation	Position, Skalierung, Drehung
+	Posterize	Tontrennung
+	Posterize Time	Zeitliche Tontrennung
+	Pre-Delay	Pre-Delay
+	Prefix	Präfix
+	Presence Lift	Präsenzanhebung
+	Preserve Luminosity	Luminanz erhalten
+	Preserve Scale	Skalierung erhalten
+	ProcAmp	ProcAmp
+	Projecting cap	Überstehendes Ende
+	Projects	Projekte
+	Pull Motion	Ziehbewegung
+	Pulls highlights and whites down	Senkt Lichter und Weißtöne ab
+	Push	Wegschieben
+	Push (Legacy)	Wegschieben (alt)
+	Q	Q
+	RAM reserved for other applications	Für andere Programme reservierter Arbeitsspeicher
+	RGB	RGB
+	RGB Split	RGB-Trennung
+	RGB-White	RGB-Weiß
+	Radial	Radial
+	Radial Blur	Radialer Weichzeichner
+	Radial Ramp	Radialer Verlauf
+	Radial Wipe	Radiale Wischblende
+	Radial Wipe (Legacy)	Radiale Wischblende (alt)
+	Radio Announcer	Radiosprecher
+	Radio Voice	Radiostimme
+	Radius	Radius
+	Ramp	Verlauf
+	Ramp Shape	Verlaufsform
+	Random	Zufällig
+	Random Seed	Zufallsstartwert
+	Range	Bereich
+	Ray	Strahl
+	Ray Color	Strahlfarbe
+	Ray Length	Strahllänge
+	Rays	Strahlen
+	Rays Only	Nur Strahlen
+	Read	Lesen
+	Rec. 2100	Rec. 2100
+	Rec. 601	Rec. 601
+	Rec. 709	Rec. 709
+	Red Blurriness	Unschärfe Rot
+	Red Curve	Kurve Rot
+	Red Offset	Versatz Rot
+	Red Power	Potenz Rot
+	Red Slope	Steigung Rot
+	Red-Blue	Rot-Blau
+	Red-Const	Rot-Konst.
+	Red-Green	Rot-Grün
+	Red-Red	Rot-Rot
+	Reduce Axis	Achse reduzieren
+	Reduce Interlace Flicker	Zeilenflimmern reduzieren
+	Reflected	Gespiegelt
+	Reflection Angle	Spiegelungswinkel
+	Reflection Center	Spiegelungsmitte
+	Refraction	Brechung
+	Reframe Offset	Versatz beim Neu-Framen
+	Reframe Zoom	Zoom beim Neu-Framen
+	Refresh growing Files Every	Wachsende Dateien aktualisieren alle
+	Relaxed	Entspannt
+	Release Time	Release-Zeit
+	Relief	Relief
+	Remaining	Verbleibend
+	Remove Fringe	Farbsaum entfernen
+	Render Edit in Audition files to:	In Audition bearbeitete Dateien rendern nach:
+	Render audio when rendering video	Beim Rendern von Video auch Audio rendern
+	Repair	Reparieren
+	Repeat Edge Pixels	Randpixel wiederholen
+	Replace Color	Farbe ersetzen
+	Replace With Clip From Source Monitor	Durch Clip aus dem Quellmonitor ersetzen
+	Replicate	Replizieren
+	Responsive Design - Position	Responsive Design – Position
+	Responsive Design - Time	Responsive Design – Zeit
+	Restore open sequences when opening projects	Geöffnete Sequenzen beim Öffnen von Projekten wiederherstellen
+	Result	Ergebnis
+	Retro	Retro
+	Reveal Nested Sequence	Verschachtelte Sequenz anzeigen
+	Reveal Original Image	Originalbild anzeigen
+	Reveal in Project	Im Projekt anzeigen
+	Reverb Amount	Hallanteil
+	Reverse	Rückwärts
+	Right - Left	Rechts – links
+	Right - Right	Rechts – rechts
+	Right channel to device output	Rechter Kanal auf Geräteausgang
+	Right to left	Von rechts nach links
+	Ripple trim adds edits to keep both sides of trim in sync	Ripple-Trimmen fügt Schnitte hinzu, damit beide Seiten synchron bleiben
+	Roll (Z Axis)	Rollen (Z-Achse)
+	Room Size	Raumgröße
+	Rotation Amount	Drehungsstärke
+	Roughen	Aufrauen
+	Roughen Color	Raue Farbe
+	Roughen Edges	Kanten aufrauen
+	Round cap	Abgerundetes Ende
+	Round join	Abgerundete Ecke
+	Rounded Crop	Abgerundeter Zuschnitt
+	Rows	Zeilen
+	Russian	Russisch
+	Rusty	Rostig
+	Rusty Color	Rostfarbe
+	SFX	Soundeffekte
+	Sample Rate	Abtastrate
+	Saturation at 50 %	Sättigung bei 50 %
+	Save .cfa and .pek media cache files next to original media files when possible	.cfa- und .pek-Mediencachedateien nach Möglichkeit neben den Originalmedien speichern
+	Scale (Degrees)	Skalierung (Grad)
+	Scale Amount	Skalierungsstärke
+	Scale From	Skalieren von
+	Scale Height	Höhe skalieren
+	Scale Match	Skalierung angleichen
+	Scale To	Skalieren auf
+	Scale Width	Breite skalieren
+	Scale to frame size	Auf Bildgröße skalieren
+	Scan Lines	Abtastzeilen
+	Scene	Szene
+	Scientific Filter	Wissenschaftlicher Filter
+	Scratch disk location for Captured Audio	Speicherort des Arbeitslaufwerks für aufgenommenes Audio
+	Screen	Umgekehrt multiplizieren
+	Seconds	Sekunden
+	Segments	Segmente
+	Semi-tones	Halbtöne
+	Sequence Name	Sequenzname
+	Sequence Timecode	Sequenz-Timecode
+	Set focus on the Timeline when performing Insert/Overwrite edits	Bei Einfügen/Überschreiben den Fokus auf die Timeline setzen
+	Set to frame size	An Bildgröße anpassen
+	Setting	Einstellung
+	Shadow Angle	Schattenwinkel
+	Shadow Blue Balance	Blaubalance der Tiefen
+	Shadow Blur	Schattenweichzeichnung
+	Shadow Color	Schattenfarbe
+	Shadow Distance	Schattenabstand
+	Shadow Green Balance	Grünbalance der Tiefen
+	Shadow Only	Nur Schatten
+	Shadow Opacity	Schattendeckkraft
+	Shadow Red Balance	Rotbalance der Tiefen
+	Shadow Size	Schattengröße
+	Shadow Tint	Tönung der Tiefen
+	Shadows Lightness	Tiefen: Helligkeit
+	Shake	Schütteln
+	Shape Dissolve	Formblende
+	Shape Flow	Formfluss
+	Shape Size	Formgröße
+	Shapes	Formen
+	Shard Size	Splittergröße
+	Sharp Colors	Scharfe Farben
+	Sharpen Amount	Stärke der Scharfzeichnung
+	Shift Center To	Mitte verschieben nach
+	Shift clips that overlap trim point during ripple trimming	Clips, die den Trimmpunkt überlappen, beim Ripple-Trimmen verschieben
+	Shot	Einstellung (Shot)
+	Show "Project:" and "Bin:" in Project panel tab	„Projekt:“ und „Ablage:“ im Reiter des Projekt-Bedienfelds anzeigen
+	Show Clip Mismatch Warning dialog	Warnung bei nicht passendem Clip anzeigen
+	Show Event Indicator	Ereignisanzeige anzeigen
+	Show Focus Area	Fokusbereich anzeigen
+	Show Home	Startseite anzeigen
+	Show Mask Tracker Preview	Vorschau der Maskenverfolgung anzeigen
+	Show Only Noise	Nur Rauschen anzeigen
+	Show Open Dialog	Öffnen-Dialog anzeigen
+	Show Project Load Error Dialog	Fehlerdialog beim Laden von Projekten anzeigen
+	Show Rich Tool Tips	Ausführliche QuickInfos anzeigen
+	Show Tool Tips	QuickInfos anzeigen
+	Show Workspace Reset Warning dialog on double click	Bei Doppelklick Warnung zum Zurücksetzen des Arbeitsbereichs anzeigen
+	Show system compatibility issues at startup	Systemkompatibilitätsprobleme beim Start anzeigen
+	Shrink	Verkleinern
+	Shutter Angle	Verschlusswinkel
+	Similarity	Ähnlichkeit
+	Simple Notch Filter	Einfacher Notch-Filter
+	Simple Parametric EQ	Einfacher parametrischer EQ
+	Simple Text	Einfacher Text
+	Single-band Compressor	Einband-Kompressor
+	Sinusoidal	Sinusförmig
+	Skew	Neigen
+	Skew Axis	Neigungsachse
+	Slats	Latten
+	Slice	Scheibe
+	Slices	Scheiben
+	Slide	Schieben
+	Slide (Legacy)	Schieben (alt)
+	Slope	Steigung
+	Slow	Langsam
+	Slower Motion	Langsamere Bewegung
+	Small Room	Kleiner Raum
+	Smart Limit	Intelligente Begrenzung
+	Smart Tools	Intelligente Werkzeuge
+	Smart quotes	Typografische Anführungszeichen
+	Smooth	Glatt
+	Smooth Motion	Gleichmäßige Bewegung
+	Smooth Scroll	Sanfter Bildlauf
+	Smoothness	Glätte
+	Snap playhead in Timeline when Snap is enabled	Abspielposition in der Timeline einrasten, wenn Einrasten aktiviert ist
+	Soft	Weich
+	Soft Clamp	Weiches Begrenzen
+	Soft Edges (Best Quality)	Weiche Kanten (beste Qualität)
+	Soft Light	Weiches Licht
+	Soft Wipe	Weiche Wischblende
+	Soften Harshness	Härte mildern
+	Softness	Weichheit
+	Solarize	Solarisation
+	Solid Colors	Volltonfarben
+	Source Point	Quellpunkt
+	Source Text	Quelltext
+	Spacer	Abstandhalter
+	Spanish	Spanisch
+	Speaker Angle	Lautsprecherwinkel
+	Speaker Labeling	Sprecherkennzeichnung
+	Special	Spezial
+	Special Effects	Spezialeffekte
+	Speech model	Sprachmodell
+	Speed	Geschwindigkeit
+	Spherize	Kugelisieren
+	Spiky	Spitz
+	Spill	Farbüberstrahlung
+	Spill Suppression	Unterdrückung der Farbüberstrahlung
+	Spin	Wirbeln
+	Spin Direction	Drehrichtung
+	Spin Motion	Drehbewegung
+	Split	Teilen
+	Split (Legacy)	Teilen (alt)
+	Spotlight	Spotlicht
+	Spread	Ausbreitung
+	Spring Motion	Federnde Bewegung
+	Square	Quadrat
+	Square (Width Only)	Quadrat (nur Breite)
+	Square 1:1	Quadratisch 1:1
+	Stabilization	Stabilisierung
+	Stabilize Only	Nur stabilisieren
+	Stabilize, Crop	Stabilisieren, zuschneiden
+	Stabilize, Crop, Auto-scale	Stabilisieren, zuschneiden, automatisch skalieren
+	Stabilize, Synthesize Edges	Stabilisieren, Kanten synthetisieren
+	Stages	Stufen
+	Star	Stern
+	Star Wipe	Stern-Wischblende
+	Start Angle	Startwinkel
+	Start Color	Startfarbe
+	Start Point	Startpunkt
+	Start at 0	Bei 0 beginnen
+	Start at 1	Bei 1 beginnen
+	Start of Ramp	Anfang des Verlaufs
+	Start with an Empty Project	Mit leerem Projekt beginnen
+	Starting Intensity	Anfangsintensität
+	Static Plates	Statische Platten
+	Step forward/back many	Weit vorwärts/rückwärts
+	Stereo Expand	Stereoerweiterung
+	Stereo Expander	Stereo-Expander
+	Stereo Imagery	Stereobild
+	Stereo Media	Stereo-Medien
+	Stereo Phasing	Stereo-Phasing
+	Stereoscopic - Over/Under	Stereoskopisch – übereinander
+	Stereoscopic - Side by Side	Stereoskopisch – nebeneinander
+	Still	Standbild
+	Still Image Default Duration	Standarddauer für Standbilder
+	Stone Church	Steinkirche
+	Stopband Attenuation	Sperrbereichsdämpfung
+	Straight Color	Direkte Farbe
+	Strength	Stärke
+	Stretch	Strecken
+	Stretch Gradient to Fit	Verlauf einpassen
+	Stretch Map to Fit	Map einpassen
+	Stretch Width or Height	Breite oder Höhe strecken
+	Stretch Wipe	Streck-Wischblende
+	Stretch to Fit Frame	Auf Bild strecken
+	Stripe	Streifen
+	Stripes	Streifen
+	Strobe Color	Stroboskopfarbe
+	Strobe Duration (secs)	Stroboskopdauer (s)
+	Strobe Light	Stroboskoplicht
+	Strobe Period (secs)	Stroboskopperiode (s)
+	Stroke 2 Color	Farbe Kontur 2
+	Stroke 2 Type	Typ Kontur 2
+	Stroke 2 Width	Breite Kontur 2
+	Stroke Angle	Strichwinkel
+	Stroke Color	Konturfarbe
+	Stroke Density	Strichdichte
+	Stroke Length	Strichlänge
+	Stroke Length (secs)	Strichlänge (s)
+	Stroke Only	Nur Kontur
+	Stroke Randomness	Strichzufälligkeit
+	Stroke Type	Konturtyp
+	Stroke Width	Konturbreite
+	Stroke line cap	Linienende der Kontur
+	Stroke line join	Linienverbindung der Kontur
+	Studio Reverb	Studiohall
+	Stylize	Stilisieren
+	Subclip End	Subclip-Ende
+	Subclip Start	Subclip-Anfang
+	Subspace Warp	Subspace-Verkrümmung
+	Subtitle	Untertitel
+	Subtract	Subtrahieren
+	Sum multichannel outputs to mono in Source Monitor	Mehrkanalausgänge im Quellmonitor zu Mono summieren
+	Super Narrow	Extrem schmal
+	Surface Gloss	Oberflächenglanz
+	Surface Material	Oberflächenmaterial
+	Surround Reverb	Surround-Hall
+	Swap	Tauschen
+	Swap Channels	Kanäle tauschen
+	Swivel	Schwenken
+	Synthetic	Synthetisch
+	TV Power	TV ein/aus
+	Tape	Band
+	Tape Name	Bandname
+	Tape/Tube	Band/Röhre
+	Target Aspect	Zielseitenverhältnis
+	Target Color	Zielfarbe
+	Target Field of View	Ziel-Sichtfeld
+	Target Loudness	Ziellautheit
+	Teal & Orange	Petrol und Orange
+	Telephone	Telefon
+	Teletext	Teletext
+	Template Properties	Vorlageneigenschaften
+	Text Animator	Text-Animator
+	Text Color	Textfarbe
+	The media cache holds render previews of unsaved projects and other files FilmCraft can recreate. Deleting them is always safe; FilmCraft rebuilds them as needed.	Der Mediencache enthält gerenderte Vorschauen nicht gespeicherter Projekte und andere Dateien, die FilmCraft neu erstellen kann. Sie zu löschen ist immer unbedenklich; FilmCraft erzeugt sie bei Bedarf neu.
+	Thickness	Dicke
+	Tile Gradient	Gekachelter Verlauf
+	Tilt	Neigung
+	Tilt (X Axis)	Neigung (X-Achse)
+	Time	Zeit
+	Time and Pitch	Zeit und Tonhöhe
+	Timecode Conversion	Timecode-Umrechnung
+	Timeline Mouse Scrolling	Bildlauf der Timeline mit der Maus
+	Timeline Playback Auto-Scrolling	Automatischer Bildlauf der Timeline bei der Wiedergabe
+	Tint Color	Tönungsfarbe
+	To	Bis
+	Tolerance	Toleranz
+	Tone	Ton
+	Top Center	Oben Mitte
+	Top Left	Oben links
+	Top Right	Oben rechts
+	Touch	Touch
+	Track Matte Key	Spurmaske-Key
+	Transcription	Transkription
+	Transcription preferences	Transkriptionseinstellungen
+	Transform	Transformieren
+	Transformers	Transformer
+	Transience	Transienten
+	Transition Completion	Übergangsfortschritt
+	Transition Softness	Weichheit des Übergangs
+	Transparency	Transparenz
+	Trash	Papierkorb
+	Travel Motion	Reisebewegung
+	Treble	Höhen
+	Triangle	Dreieck
+	Trim	Trimmen
+	Tube	Röhre
+	Tube-modeled Compressor	Röhrenkompressor
+	Tubular	Röhrenförmig
+	Turbulent	Turbulent
+	Turbulent Displace	Turbulentes Versetzen
+	Turbulent Sharp	Turbulent scharf
+	Turbulent Smooth	Turbulent weich
+	Turbulent Smoother	Turbulent weicher
+	Tweed	Tweed
+	Twirl	Strudel
+	Twirl (Legacy)	Strudel (alt)
+	Twirl Center	Strudelmitte
+	Twirl Radius	Strudelradius
+	Twist	Verdrehung
+	Twist Smoother	Verdrehungsglättung
+	Typewriter	Schreibmaschine
+	Ultra Key	Ultra Key
+	Uniform Scale	Gleichmäßige Skalierung
+	Uniform Spacing	Gleichmäßiger Abstand
+	Unsharp Mask	Unscharf maskieren
+	Update it at least every	Mindestens aktualisieren alle
+	Update timeline dynamically during ripple edits.	Timeline während Ripple-Bearbeitungen dynamisch aktualisieren.
+	Upper Frequency	Obere Frequenz
+	Upper Left	Oben links
+	Upper Right	Oben rechts
+	Use Color Noise	Farbrauschen verwenden
+	Use End Color	Endfarbe verwenden
+	Use File	Datei verwenden
+	Use Glow Color	Glühfarbe verwenden
+	Use Media Source	Medienquelle verwenden
+	Use Tint Color	Tönungsfarbe verwenden
+	Utility	Hilfsmittel
+	VHS Damage	VHS-Schaden
+	VR Blur	VR-Weichzeichner
+	VR Chroma Leaks	VR-Chroma-Lecks
+	VR Chromatic Aberrations	VR-Chromatische Aberrationen
+	VR Color Gradients	VR-Farbverläufe
+	VR De-Noise	VR-Entrauschen
+	VR Digital Glitch	VR-Digitaler Glitch
+	VR Fractal Noise	VR-Fraktales Rauschen
+	VR Glow	VR-Glühen
+	VR Gradient Wipe	VR-Verlaufswischblende
+	VR Iris Wipe	VR-Iris-Wischblende
+	VR Light Leaks	VR-Lichteinfälle
+	VR Light Rays	VR-Lichtstrahlen
+	VR Mobius Zoom	VR-Möbius-Zoom
+	VR Plane to Sphere	VR-Ebene zu Kugel
+	VR Projection	VR-Projektion
+	VR Random Blocks	VR-Zufällige Blöcke
+	VR Rotate Sphere	VR-Kugel drehen
+	VR Sharpen	VR-Scharfzeichnen
+	VR Spherical Blur	VR-Kugelförmige Weichzeichnung
+	Validate Content Credentials on import	Content Credentials beim Import überprüfen
+	Vectorscope (YUV)	Vektorskop (YUV)
+	Vectorscope + Waveform YC	Vektorskop + Wellenform YC
+	Vectorscope HLS	Vektorskop HLS
+	Vectorscope YUV	Vektorskop YUV
+	Venetian Blinds	Jalousie
+	Vertical 4:5	Vertikal 4:5
+	Vertical 9:16	Vertikal 9:16
+	Vertical Alignment	Vertikale Ausrichtung
+	Vertical Blocks	Vertikale Blöcke
+	Vertical Decentering	Vertikale Dezentrierung
+	Vertical Displacement	Vertikale Verschiebung
+	Vertical Flip	Vertikal spiegeln
+	Vertical Margin	Vertikaler Rand
+	Very Narrow	Sehr schmal
+	Video 1	Video 1
+	Video 2	Video 2
+	Video 3	Video 3
+	Video 4	Video 4
+	Video 5	Video 5
+	Video 6	Video 6
+	Video 7	Video 7
+	Video 8	Video 8
+	Video Codec	Videocodec
+	Video Duration	Videodauer
+	Video Effects	Videoeffekte
+	Video In Point	Video-In-Punkt
+	Video Info	Videoinformationen
+	Video Limiter	Videobegrenzer
+	Video Out Point	Video-Out-Punkt
+	Video Transition Default Duration	Standarddauer für Videoübergänge
+	Video Transitions	Videoübergänge
+	Video Usage	Videonutzung
+	Vignette	Vignette
+	Vivid Light	Lebhaftes Licht
+	Vocal Booth	Sprecherkabine
+	Vocal Enhancer	Stimmverbesserer
+	Voice	Stimme
+	Voice in a Hall	Stimme in einer Halle
+	Volumetric Rays	Volumetrische Strahlen
+	Warm Film	Warmer Film
+	Warm Room	Warmer Raum
+	Warm Voice	Warme Stimme
+	Warm print stock with gentle roll-off	Warmes Kopiermaterial mit sanftem Roll-off
+	Warm, soft late-afternoon light	Warmes, weiches Licht am späten Nachmittag
+	Warning	Warnung
+	Warp Stabilizer	Verkrümmungsstabilisierung
+	Wave	Welle
+	Wave Height	Wellenhöhe
+	Wave Speed	Wellengeschwindigkeit
+	Wave Warp	Wellenverkrümmung
+	Wave Width	Wellenbreite
+	Waveform	Wellenform
+	Waveform (Luma)	Wellenform (Luma)
+	Waveform (RGB)	Wellenform (RGB)
+	Wavelength	Wellenlänge
+	Wet	Wet
+	Wet Out	Wet-Ausgang
+	When Opening a Project	Beim Öffnen eines Projekts
+	Whip	Reißschwenk
+	Whip (Legacy)	Reißschwenk (alt)
+	Whisper base (balanced)	Whisper base (ausgewogen)
+	Whisper small (most accurate)	Whisper small (am genauesten)
+	Whisper tiny (fastest)	Whisper tiny (am schnellsten)
+	White	Weiß
+	White Input Level	Weißeingangspegel
+	White Is High	Weiß ist hoch
+	Wide Outdoor	Weite Außenumgebung
+	Widener	Verbreiterer
+	Width	Breite
+	Wiggle	Wackeln
+	Wipe	Wischblende
+	Wipe Angle	Wischwinkel
+	Wonder Glow	Wunderglühen
+	Wrap Back	Zurückfalten
+	Write	Schreiben
+	Write XMP ID to files on import	XMP-ID beim Import in Dateien schreiben
+	Write clip markers to XMP	Clipmarker in XMP schreiben
+	Write-on	Einschreiben
+	X Rotation	X-Drehung
+	Y Rotation	Y-Drehung
+	YC	YC
+	YC no Chroma	YC ohne Chroma
+	YUV	YUV
+	Yellow-green highlights and blue-lifted shadows from crossed channel curves	Gelbgrüne Lichter und bläulich angehobene Tiefen durch gekreuzte Kanalkurven
+	Z Position	Z-Position
+	Z Rotation	Z-Drehung
+	Zoom	Zoom
+	Zoom Amount	Zoomstärke
+	Zoom Blur	Zoom-Weichzeichner
+	Zoom Strength	Zoomintensität
+	days	Tage
+	frames	Frames
+	milliseconds	Millisekunden
+	minute(s)	Minute(n)
+	second(s)	Sekunde(n)
+	seconds	Sekunden
+	Create Search Bin	Suchablage erstellen
+	Edit Offline File	Offline-Datei bearbeiten
+	Source Settings	Quelleinstellungen
+	Update Metadata	Metadaten aktualisieren
+	Automate To Sequence	Automatisch in Sequenz einfügen
+	Scene Edit Detection	Szenenschnitterkennung
+	Analyze	Analysieren
+	Normalize Mix Track	Mix-Spur normalisieren
+	Simplify Sequence	Sequenz vereinfachen
+	Simplify	Vereinfachen
+	Transcribe Sequence	Sequenz transkribieren
+	Save as Template	Als Vorlage speichern
+	Flash Cue Marker	Flash-Cue-Marker
+	System Compatibility Report	Systemkompatibilitätsbericht
+	no GPU adapter: the CPU compositor is used	kein GPU-Adapter: der CPU-Compositor wird verwendet
+	Avid Log Exchange	Avid Log Exchange
+	FilmCraft Project	FilmCraft-Projekt
+	{name} Selection.fcproj	{name} Auswahl.fcproj
+	{name} (Simplified)	{name} (vereinfacht)
+	Find in:	Suchen in:
+	Find:	Suchen:
+	Search:	Suche:
+	Clip Names and Markers	Clipnamen und Marker
+	Match:	Übereinstimmung:
+	All	Alle
+	Any	Beliebige
+	Case Sensitive	Groß-/Kleinschreibung beachten
+	Scratch Disks	Arbeitslaufwerke
+	Ingest Settings	Ingest-Einstellungen
+	Captured and Generated:	Aufgenommen und erzeugt:
+	Video Previews:	Videovorschauen:
+	Audio Previews:	Audiovorschauen:
+	Project Auto Save:	Automatische Projektspeicherung:
+	Same as Project	Wie Projekt
+	Path: {path}	Pfad: {path}
+	Transcode	Transkodieren
+	Copy and Create Proxies	Kopieren und Proxys erstellen
+	Action:	Aktion:
+	Destination:	Ziel:
+	Next to the media	Neben den Medien
+	Video Rendering and Playback	Videorendering und -wiedergabe
+	Renderer:	Renderer:
+	Display Format:	Anzeigeformat:
+	Milliseconds	Millisekunden
+	Capture	Aufnahme
+	Capture Format:	Aufnahmeformat:
+	Action and Title Safe Areas	Sichere Aktions- und Titelbereiche
+	Title Safe Area	Sicherer Titelbereich
+	Action Safe Area	Sicherer Aktionsbereich
+	Total Duration	Gesamtdauer
+	Average Data Rate	Durchschnittliche Datenrate
+	Colour	Farbe
+	{codec} · {rate} Hz · {n} channel(s)	{codec} · {rate} Hz · {n} Kanal/Kanäle
+	Media Name:	Medienname:
+	Scene:	Szene:
+	Shot/Take:	Einstellung/Take:
+	Log Note:	Protokollnotiz:
+	Codec: {codec}	Codec: {codec}
+	Write the metadata of the selected clip(s) ({n}) to XMP files next to their media?	Metadaten der ausgewählten Clips ({n}) in XMP-Dateien neben ihren Medien schreiben?
+	Existing XMP files written by other applications are left unchanged.	Vorhandene XMP-Dateien anderer Programme bleiben unverändert.
+	To {name}	In {name}
+	Ordering:	Reihenfolge:
+	Sort Order	Sortierreihenfolge
+	Selection Order	Auswahlreihenfolge
+	Placement:	Platzierung:
+	Sequentially	Nacheinander
+	At Unnumbered Markers	An nicht nummerierten Markern
+	Method:	Methode:
+	Insert Edit	Einfügen
+	Overwrite Edit	Überschreiben
+	Clip Overlap:	Clipüberlappung:
+	Frames per Still:	Frames pro Standbild:
+	Transitions	Übergänge
+	Apply Default Audio Transition	Standard-Audioübergang anwenden
+	Apply Default Video Transition	Standard-Videoübergang anwenden
+	Ignore Options	Ignorieren-Optionen
+	Ignore Audio	Audio ignorieren
+	Ignore Video	Video ignorieren
+	Apply a cut at each detected cut point	An jedem erkannten Schnittpunkt einen Schnitt setzen
+	Create a bin of subclips from each detected cut point	Aus jedem erkannten Schnittpunkt eine Ablage mit Subclips erstellen
+	Create a clip marker at each detected cut point	An jedem erkannten Schnittpunkt einen Clipmarker setzen
+	Sensitivity:	Empfindlichkeit:
+	Normalize Mix Track to:	Mix-Spur normalisieren auf:
+	Disabled clips	Deaktivierte Clips
+	Empty tracks	Leere Spuren
+	Gaps	Lücken
+	Video effects	Videoeffekte
+	Audio effects	Audioeffekte
+	Text (graphics and captions)	Text (Grafiken und Untertitel)
+	Clips	Clips
+	Move clips to the lowest track possible	Clips auf die niedrigstmögliche Spur verschieben
+	Keep:	Behalten:
+	Video and Audio	Video und Audio
+	Video Only	Nur Video
+	Audio Only	Nur Audio
+	Language:	Sprache:
+	Audio on track {t}	Audio auf Spur {t}
+	Audio analysis:	Audioanalyse:
+	Recognize when different speakers are talking	Erkennen, wenn verschiedene Personen sprechen
+	Template Name:	Vorlagenname:
+	Comments:	Kommentare:
+	 (unavailable)	 (nicht verfügbar)
+	Decoders	Decoder
+	Containers	Container
+	Export formats	Exportformate
+	Match {n} of {total}	Treffer {n} von {total}
+	Saved template {path}	Vorlage gespeichert: {path}
+	Scene Edit Detection: analysing in the background (see Progress)	Szenenschnitterkennung: Analyse läuft im Hintergrund (siehe Fortschritt)
+	Delete Search Bin	Suchablage löschen
+	 (removed from {list})	 (aus {list} entfernt)
+	{key} can't be used as a shortcut	{key} kann nicht als Tastenkürzel verwendet werden
+	Keyboard Shortcuts	Tastenkürzel
+	{active} (modified)	{active} (geändert)
+	Loaded “{name}”	„{name}“ geladen
+	My Shortcuts	Meine Tastenkürzel
+	Deleted preset “{active}”	Vorgabe „{active}“ gelöscht
+	Export…	Exportieren…
+	Exported to {path}	Exportiert nach {path}
+	Export: no file chosen (agents: shortcuts.export {path})	Exportieren: keine Datei gewählt (Agenten: shortcuts.export {path})
+	Imported “{name}”	„{name}“ importiert
+	Import: no file chosen (agents: shortcuts.import {path})	Importieren: keine Datei gewählt (Agenten: shortcuts.import {path})
+	Keyboard: US (macOS)	Tastatur: US (macOS)
+	Keyboard: US	Tastatur: US
+	Save preset as:	Vorgabe speichern als:
+	Commands:	Befehle:
+	{panel} Panel	Bedienfeld {panel}
+	Application shortcuts work whatever panel has focus	Anwendungs-Tastenkürzel funktionieren unabhängig davon, welches Bedienfeld den Fokus hat
+	Panel shortcuts override application shortcuts while that panel has focus	Bedienfeld-Tastenkürzel haben Vorrang vor Anwendungs-Tastenkürzeln, solange das Bedienfeld den Fokus hat
+	Modifier held / selected	Zusatztaste gedrückt/ausgewählt
+	Search commands or keys	Befehle oder Tasten suchen
+	Selected: {command}	Ausgewählt: {command}
+	Command	Befehl
+	Shortcut	Tastenkürzel
+	Type a shortcut… (Esc cancels)	Tastenkürzel drücken… (Esc bricht ab)
+	Add another shortcut	Weiteres Tastenkürzel hinzufügen
+	No matching commands	Keine passenden Befehle
+	Key:	Taste:
+	Modifiers	Zusatztasten
+	Nothing is assigned to this key	Dieser Taste ist nichts zugewiesen
+	Click a key on the keyboard to see its shortcuts	Klick auf eine Taste der Tastatur, um ihre Tastenkürzel zu sehen
+	Assign {key} to {command}	{key} {command} zuweisen
+	Conflict: {key} is assigned to {commands} ({ctx})	Konflikt: {key} ist {commands} zugewiesen ({ctx})
+	 and 	 und 
+	Click a command's Shortcut cell and press keys to assign it; + adds another shortcut.	Klick in die Tastenkürzel-Zelle eines Befehls und drück die Tasten, um es zuzuweisen; + fügt ein weiteres Tastenkürzel hinzu.
+	Cleared {n} shortcut(s) of {command}	{n} Tastenkürzel von {command} entfernt
+	No export preset named `{name}`	Keine Exportvorgabe namens `{name}`
+	Open a sequence to export	Öffne eine Sequenz, um sie zu exportieren
+	Destinations	Ziele
+	Media File	Mediendatei
+	Queue ({n})	Warteschlange ({n})
+	Send exports here with Send to Queue, then start the queue.	Schick Exporte mit „An Warteschlange senden“ hierher und starte dann die Warteschlange.
+	Ready	Bereit
+	Encoding {n}%	Kodierung {n} %
+	Start Queue	Warteschlange starten
+	Stop	Stopp
+	Clear Finished	Abgeschlossene entfernen
+	Not supported by FilmCraft's encoders yet	Von den Encodern in FilmCraft noch nicht unterstützt
+	Sequence name	Sequenzname
+	Folder	Ordner
+	Preset	Vorgabe
+	More presets…	Weitere Vorgaben…
+	Multiplexer	Multiplexer
+	The sequence has no caption track.	Die Sequenz hat keine Untertitelspur.
+	Export Options	Exportoptionen
+	Burn Captions Into Video	Untertitel ins Video einbrennen
+	Create Sidecar File	Begleitdatei erstellen
+	File Format	Dateiformat
+	SubRip Subtitle (.srt)	SubRip-Untertitel (.srt)
+	WebVTT (.vtt)	WebVTT (.vtt)
+	Title	Titel
+	Creator	Urheber
+	Copyright	Copyright
+	Image	Bild
+	Frame Size	Bildgröße
+	Match Source	Wie Quelle
+	Field Order	Halbbildreihenfolge
+	Aspect	Seitenverhältnis
+	Profile	Profil
+	Bitrate Encoding	Bitratenkodierung
+	Target Bitrate	Zielbitrate
+	Adaptive ({bpp} bits per pixel)	Adaptiv ({bpp} Bit pro Pixel)
+	Maximum Bitrate	Maximale Bitrate
+	Quality (CRF)	Qualität (CRF)
+	Key Frame Distance	Keyframe-Abstand
+	Quality	Qualität
+	Render at Maximum Depth	Mit maximaler Bittiefe rendern
+	Use Maximum Render Quality	Maximale Renderqualität verwenden
+	Export Audio	Audio exportieren
+	Audio Format	Audioformat
+	Uncompressed (PCM)	Unkomprimiert (PCM)
+	Match Source ({seq_sr} Hz)	Wie Quelle ({seq_sr} Hz)
+	Channels	Kanäle
+	Audio Bitrate	Audiobitrate
+	Sample Size	Samplegröße
+	16 bit	16 Bit
+	24 bit	24 Bit
+	32 bit	32 Bit
+	32 bit float	32 Bit Gleitkomma
+	FLAC stores whole-number samples only	FLAC speichert nur ganzzahlige Samples
+	MXF export writes integer PCM only	Der MXF-Export schreibt nur ganzzahliges PCM
+	Size / Opacity	Größe/Deckkraft
+	Image Overlay	Bildüberlagerung
+	PNG or JPEG file	PNG- oder JPEG-Datei
+	Name Overlay	Namensüberlagerung
+	Timecode Overlay	Timecode-Überlagerung
+	Luma Min / Max	Luma min./max.
+	Loudness Normalization	Lautheitsnormalisierung
+	True Peak Limit	True-Peak-Grenze
+	Audio only	Nur Audio
+	Scaling	Skalierung
+	Scale To Fit	Einpassend skalieren
+	Scale To Fill	Füllend skalieren
+	Stretch To Fill	Füllend strecken
+	Summary	Zusammenfassung
+	Sequence, {w}x{h}, {fps} fps, {rate} Hz	Sequenz, {w}x{h}, {fps} fps, {rate} Hz
+	Estimated file size: {size}	Geschätzte Dateigröße: {size}
+	Send to Queue	An Warteschlange senden
+	Exporting {path}	{path} wird exportiert
+	Added to the export queue	Zur Exportwarteschlange hinzugefügt
+	Preset Manager	Vorgabenmanager
+	Search presets	Vorgaben suchen
+	Favorites only	Nur Favoriten
+	Show in the Preset menu	Im Vorgabenmenü anzeigen
+	User	Benutzer
+	Save current settings as:	Aktuelle Einstellungen speichern als:
+	Export presets	Exportvorgaben
+	Import: no file chosen (agents: export.presets.import {path})	Importieren: keine Datei gewählt (Agenten: export.presets.import {path})
+	Export: no file chosen (agents: export.presets.export {path, names})	Exportieren: keine Datei gewählt (Agenten: export.presets.export {path, names})
+	Quick Export: open a sequence first	Schnellexport: öffne zuerst eine Sequenz
+	File Name & Location	Dateiname und Speicherort
+	Quick Export: {path}	Schnellexport: {path}
+	Graphics problem: switched to software compositing	Grafikproblem: auf Software-Compositing umgeschaltet
+	GPU acceleration is unavailable; preview renders on the CPU	GPU-Beschleunigung ist nicht verfügbar; die Vorschau wird auf der CPU gerendert
+	Exporting	Export läuft
+	Click to select, or click in empty space and drag to marquee select. Use Shift, Opt, and Cmd for other options.	Klicken zum Auswählen oder in einen leeren Bereich klicken und ziehen für eine Rahmenauswahl. Umschalt, Wahl und Cmd bieten weitere Optionen.
+	Click to select all clips to the right in all tracks. Shift-click for a single track.	Klicken wählt alle Clips rechts davon auf allen Spuren aus. Umschalt+Klick für eine einzelne Spur.
+	Click to select all clips to the left in all tracks. Shift-click for a single track.	Klicken wählt alle Clips links davon auf allen Spuren aus. Umschalt+Klick für eine einzelne Spur.
+	Drag an edit point to ripple trim; later clips move to keep the gap closed.	Zieh einen Schnittpunkt für Ripple-Trimmen; spätere Clips rücken nach, sodass keine Lücke entsteht.
+	Drag an edit point to roll it: the out of one clip and the in of the next move together.	Zieh einen Schnittpunkt zum Rollen: Out des einen und In des nächsten Clips bewegen sich gemeinsam.
+	Drag an edge to change the clip's speed so it fills the new duration.	Zieh eine Kante, um die Geschwindigkeit des Clips so zu ändern, dass er die neue Dauer füllt.
+	Drag the edge of a music clip to remix it to the new duration at musically matching beats.	Zieh die Kante eines Musikclips, um ihn an musikalisch passenden Schlägen auf die neue Dauer zu remixen.
+	Click to split a clip. Shift-click to split all tracks.	Klicken teilt einen Clip. Umschalt+Klick teilt alle Spuren.
+	Drag a clip to slip its source in/out without moving it.	Zieh einen Clip, um sein Quell-In/-Out zu verschieben, ohne ihn zu bewegen (Slip).
+	Drag a clip to slide it between its neighbours.	Zieh einen Clip, um ihn zwischen seinen Nachbarn zu verschieben (Slide).
+	Drag to scroll the timeline.	Ziehen scrollt die Timeline.
+	Click to zoom in; Opt-click to zoom out.	Klicken vergrößert; Wahl+Klick verkleinert.
+	FilmCraft hit an error	In FilmCraft ist ein Fehler aufgetreten
+	Details: {path}	Details: {path}
+	Opened {url}	{url} geöffnet
+	(empty)	(leer)
+	Step Back 1 Frame	1 Frame zurück
+	Step Forward 1 Frame	1 Frame vor
+	Match Playhead	An Abspielposition angleichen
+	Gang to Program	Mit Programm koppeln
+	AAC Audio	AAC-Audio
+	AAC Audio 48 kHz 320 kbps	AAC-Audio 48 kHz 320 kbit/s
+	MPEG-4 audio (.m4a), stereo 48 kHz AAC-LC at 320 kbps	MPEG-4-Audio (.m4a), Stereo 48 kHz AAC-LC mit 320 kbit/s
+	AIFF	AIFF
+	AIFF 48 kHz 16-bit	AIFF 48 kHz 16 Bit
+	AIFF, stereo 48 kHz 16-bit PCM	AIFF, Stereo 48 kHz 16-Bit-PCM
+	FLAC	FLAC
+	FLAC 48 kHz 24-bit	FLAC 48 kHz 24 Bit
+	FLAC, stereo 48 kHz 24-bit, lossless	FLAC, Stereo 48 kHz 24 Bit, verlustfrei
+	FLAC (lossless)	FLAC (verlustfrei)
+	Compression Level	Kompressionsstufe
+	0 fastest, 8 smallest	0 am schnellsten, 8 am kleinsten
+	APV	APV
+	APV 422-10	APV 422-10
+	APV 422-12	APV 422-12
+	Anamorphic 2:1 (2.0)	Anamorph 2:1 (2,0)
+	Animated GIF	Animiertes GIF
+	Animated GIF 640×360	Animiertes GIF 640×360
+	Apple ProRes	Apple ProRes
+	Apple ProRes 422	Apple ProRes 422
+	Apple ProRes 422 HQ	Apple ProRes 422 HQ
+	Apple ProRes 422 LT	Apple ProRes 422 LT
+	Apple ProRes 422 Proxy	Apple ProRes 422 Proxy
+	Apple ProRes 4444	Apple ProRes 4444
+	Apple ProRes 4444 with Alpha	Apple ProRes 4444 mit Alpha
+	Apple ProRes 4444 XQ	Apple ProRes 4444 XQ
+	Application	Anwendung
+	Apply Guide Template	Hilfslinienvorlage anwenden
+	Auto Save Now	Jetzt automatisch speichern
+	Auto-Match Loudness	Lautheit automatisch angleichen
+	Avid DNxHR	Avid DNxHR
+	Avid DNxHR HQ	Avid DNxHR HQ
+	Avid DNxHR LB	Avid DNxHR LB
+	Avid DNxHR SQ	Avid DNxHR SQ
+	Avid-style OP-Atom: DNxHR HQ picture file plus one 24-bit 48 kHz PCM file per channel (_A1, _A2…)	OP-Atom im Avid-Stil: DNxHR-HQ-Bilddatei plus eine PCM-Datei mit 24 Bit und 48 kHz pro Kanal (_A1, _A2…)
+	BMP	BMP
+	BMP Sequence	BMP-Sequenz
+	Baseline	Baseline
+	Begin Text Editing for a Graphic Layer	Textbearbeitung für eine Grafikebene beginnen
+	Begins With	Beginnt mit
+	Blur In	Weich einblenden
+	Blur Out	Weich ausblenden
+	Brightens inside a feathered circular mask	Hellt das Innere einer weichen kreisförmigen Maske auf
+	Broadcast	Broadcast
+	CBR	CBR
+	Cancel Dynamic Trim	Dynamisches Trimmen abbrechen
+	Cancel Queued Export	Export in Warteschlange abbrechen
+	Center Left	Mitte links
+	Center Right	Mitte rechts
+	Center align text	Text zentrieren
+	Change Mask	Maske ändern
+	Clear All Events	Alle Ereignisse löschen
+	Clear Edit Point Selection	Auswahl der Schnittpunkte aufheben
+	Clear Finished Exports	Abgeschlossene Exporte entfernen
+	Clear Poster Frame	Posterframe entfernen
+	Close Bin	Ablage schließen
+	Close Sequence	Sequenz schließen
+	Contains	Enthält
+	Cut to Camera 1	Auf Kamera 1 schneiden
+	Cut to Camera 2	Auf Kamera 2 schneiden
+	Cut to Camera 3	Auf Kamera 3 schneiden
+	Cut to Camera 4	Auf Kamera 4 schneiden
+	Cut to Camera 5	Auf Kamera 5 schneiden
+	Cut to Camera 6	Auf Kamera 6 schneiden
+	Cut to Camera 7	Auf Kamera 7 schneiden
+	Cut to Camera 8	Auf Kamera 8 schneiden
+	Cut to Camera 9	Auf Kamera 9 schneiden
+	D1/DV NTSC (0.9091)	D1/DV NTSC (0,9091)
+	D1/DV PAL (1.0940)	D1/DV PAL (1,0940)
+	DVCPRO HD (1.5)	DVCPRO HD (1,5)
+	Darkens outside a feathered oval mask	Dunkelt den Bereich außerhalb einer weichen ovalen Maske ab
+	Decrease Audio Tracks Height	Höhe der Audiospuren verringern
+	Decrease Clip Volume	Cliplautstärke verringern
+	Decrease Clip Volume Many	Cliplautstärke stark verringern
+	Decrease Font Size by Five Units	Schriftgröße um fünf Einheiten verkleinern
+	Decrease Font Size by One Unit	Schriftgröße um eine Einheit verkleinern
+	Decrease Leading by Five Units	Zeilenabstand um fünf Einheiten verringern
+	Decrease Leading by One Unit	Zeilenabstand um eine Einheit verringern
+	Decrease Video Tracks Height	Höhe der Videospuren verringern
+	Delete Captions	Untertitel löschen
+	Delete Graphic Layer	Grafikebene löschen
+	Delete Guide Template	Hilfslinienvorlage löschen
+	Delete Media Cache Files	Mediencache-Dateien löschen
+	Discard Unsaved Changes	Nicht gespeicherte Änderungen verwerfen
+	Does Not Contain	Enthält nicht
+	Download Speech Model	Sprachmodell herunterladen
+	Dynamic Trim Stop	Dynamisches Trimmen stoppen
+	Edit Caption Text	Untertiteltext bearbeiten
+	Ellipse Tool	Ellipsenwerkzeug
+	Ends With	Endet mit
+	Entire Source	Gesamte Quelle
+	EssentialSound	Essential Sound
+	Export Frame	Frame exportieren
+	Extend Next Edit To Playhead	Nächsten Schnitt bis zur Abspielposition erweitern
+	Extend Previous Edit To Playhead	Vorherigen Schnitt bis zur Abspielposition erweitern
+	Extend Selected Edit to Playhead	Ausgewählten Schnitt bis zur Abspielposition erweitern
+	Extend Selection Down	Auswahl nach unten erweitern
+	Extend Selection Left	Auswahl nach links erweitern
+	Extend Selection Right	Auswahl nach rechts erweitern
+	Extend Selection Up	Auswahl nach oben erweitern
+	Fade In	Einblenden
+	Gaussian Blur from 0 to 60 over the last second	Gaußscher Weichzeichner von 0 bis 60 in der letzten Sekunde
+	Gaussian Blur from 60 to 0 over the first second	Gaußscher Weichzeichner von 60 bis 0 in der ersten Sekunde
+	Generate Ducking Keyframes	Ducking-Keyframes erzeugen
+	Go to Next Edit Point	Zum nächsten Schnittpunkt gehen
+	Go to Next Edit Point on Any Track	Zum nächsten Schnittpunkt auf einer beliebigen Spur gehen
+	Go to Previous Edit Point	Zum vorherigen Schnittpunkt gehen
+	Go to Previous Edit Point on Any Track	Zum vorherigen Schnittpunkt auf einer beliebigen Spur gehen
+	Go to Selected Clip End	Zum Ende des ausgewählten Clips gehen
+	Go to Selected Clip Start	Zum Anfang des ausgewählten Clips gehen
+	Go to Sequence End	Zum Sequenzende gehen
+	Go to Sequence Start	Zum Sequenzanfang gehen
+	H.264	H.264
+	AV1	AV1
+	H.264 1920×1080 for video sharing sites, VBR 1 pass, 16 Mbps	H.264 1920×1080 für Videoportale, VBR 1 Durchgang, 16 Mbit/s
+	H.264 1920×1080, VBR 1 pass, 20 Mbps target, AAC 320 kbps	H.264 1920×1080, VBR 1 Durchgang, Ziel 20 Mbit/s, AAC 320 kbit/s
+	H.264 1920×1080, VBR 2 pass, 18 Mbps	H.264 1920×1080, VBR 2 Durchgänge, 18 Mbit/s
+	H.264 3840×2160 for video sharing sites, VBR 1 pass, 45 Mbps	H.264 3840×2160 für Videoportale, VBR 1 Durchgang, 45 Mbit/s
+	H.264 3840×2160, VBR 1 pass, 60 Mbps target, AAC 320 kbps	H.264 3840×2160, VBR 1 Durchgang, Ziel 60 Mbit/s, AAC 320 kbit/s
+	H.264 3840×2160, VBR 2 pass, 50 Mbps	H.264 3840×2160, VBR 2 Durchgänge, 50 Mbit/s
+	H.264 9:16 portrait for short-form social video, scaled to fill, 12 Mbps	H.264 9:16 hochkant für kurze Social-Media-Videos, füllend skaliert, 12 Mbit/s
+	H.264 at the sequence's frame size and rate; 0.05 bits per pixel	H.264 mit Bildgröße und Framerate der Sequenz; 0,05 Bit pro Pixel
+	H.264 at the sequence's frame size and rate; 0.1 bits per pixel	H.264 mit Bildgröße und Framerate der Sequenz; 0,1 Bit pro Pixel
+	H.264 at the sequence's frame size and rate; bitrate adapts to the frame size (0.2 bits per pixel)	H.264 mit Bildgröße und Framerate der Sequenz; die Bitrate passt sich der Bildgröße an (0,2 Bit pro Pixel)
+	HD Anamorphic 1080 (1.333)	HD anamorph 1080 (1,333)
+	Hand Tool	Handwerkzeug
+	High Quality 1080p HD	Hohe Qualität 1080p HD
+	High Quality 2160p 4K	Hohe Qualität 2160p 4K
+	Image Sequence	Bildsequenz
+	Increase Audio Tracks Height	Höhe der Audiospuren vergrößern
+	Increase Clip Volume	Cliplautstärke erhöhen
+	Increase Clip Volume Many	Cliplautstärke stark erhöhen
+	Increase Font Size by Five Units	Schriftgröße um fünf Einheiten vergrößern
+	Increase Font Size by One Unit	Schriftgröße um eine Einheit vergrößern
+	Increase Leading by Five Units	Zeilenabstand um fünf Einheiten vergrößern
+	Increase Leading by One Unit	Zeilenabstand um eine Einheit vergrößern
+	Increase Video Tracks Height	Höhe der Videospuren vergrößern
+	Large blocks resolving to the picture over the first second	Große Blöcke, die sich in der ersten Sekunde zum Bild auflösen
+	Left align text	Text linksbündig
+	Looping GIF, 640×360 at 15 fps	GIF in Schleife, 640×360 mit 15 fps
+	Lower First	Unteres Halbbild zuerst
+	Lumetri	Lumetri
+	MXF OP-Atom	MXF OP-Atom
+	MXF OP-Atom DNxHR (Avid)	MXF OP-Atom DNxHR (Avid)
+	MXF OP1a	MXF OP1a
+	MXF OP1a DNxHR HQ	MXF OP1a DNxHR HQ
+	MXF OP1a H.264	MXF OP1a H.264
+	MXF OP1a ProRes 422 HQ	MXF OP1a ProRes 422 HQ
+	MXF OP1a, DNxHR HQ (8-bit 4:2:2), 24-bit 48 kHz PCM, start timecode	MXF OP1a, DNxHR HQ (8 Bit 4:2:2), PCM 24 Bit 48 kHz, Start-Timecode
+	MXF OP1a, H.264 High long GOP (0.3 bits per pixel), 24-bit 48 kHz PCM	MXF OP1a, H.264 High Long-GOP (0,3 Bit pro Pixel), PCM 24 Bit 48 kHz
+	MXF OP1a, ProRes 422 HQ, 24-bit 48 kHz PCM, start timecode	MXF OP1a, ProRes 422 HQ, PCM 24 Bit 48 kHz, Start-Timecode
+	Main	Main
+	Mark In (Hover Scrub)	In-Punkt setzen (Hover-Scrubbing)
+	Mark Out (Hover Scrub)	Out-Punkt setzen (Hover-Scrubbing)
+	Masks	Masken
+	Match Source – Adaptive High Bitrate	Wie Quelle – adaptive hohe Bitrate
+	Match Source – Adaptive Low Bitrate	Wie Quelle – adaptive niedrige Bitrate
+	Match Source – Adaptive Medium Bitrate	Wie Quelle – adaptive mittlere Bitrate
+	Matches	Entspricht
+	Maximize or Restore Active Frame	Aktiven Rahmen maximieren oder wiederherstellen
+	Maximize or Restore Frame Under Cursor	Rahmen unter dem Cursor maximieren oder wiederherstellen
+	Media Browser Settings	Medienbrowser-Einstellungen
+	MediaBrowser	Medienbrowser
+	MediaCache	Mediencache
+	Merge Captions	Untertitel zusammenführen
+	Mixer	Mischpult
+	Mosaic In	Mosaik-Einblendung
+	Move All Audio Targets Down	Alle Audioziele nach unten verschieben
+	Move All Audio Targets Up	Alle Audioziele nach oben verschieben
+	Move All Video Targets Down	Alle Videoziele nach unten verschieben
+	Move All Video Targets Up	Alle Videoziele nach oben verschieben
+	Move Selection Down	Auswahl nach unten bewegen
+	Move Selection End	Auswahl ans Ende bewegen
+	Move Selection Home	Auswahl an den Anfang bewegen
+	Move Selection Left	Auswahl nach links bewegen
+	Move Selection Page Down	Auswahl eine Seite nach unten bewegen
+	Move Selection Page Up	Auswahl eine Seite nach oben bewegen
+	Move Selection Right	Auswahl nach rechts bewegen
+	Move Selection Up	Auswahl nach oben bewegen
+	Multi-Camera Record On/Off Toggle	Mehrkamera-Aufnahme ein/aus
+	Multicam	Mehrkamera
+	Navigate to End of Segment	Zum Segmentende gehen
+	Navigate to Next Line	Zur nächsten Zeile gehen
+	Navigate to Next Word	Zum nächsten Wort gehen
+	Navigate to Previous Line	Zur vorherigen Zeile gehen
+	Navigate to Previous Word	Zum vorherigen Wort gehen
+	Navigate to Start of Segment	Zum Segmentanfang gehen
+	Navigation	Navigation
+	Next Multi-Camera Page	Nächste Mehrkamera-Seite
+	Nudge Clip Selection Down	Clipauswahl nach unten versetzen
+	Nudge Clip Selection Left Five Frames	Clipauswahl um fünf Frames nach links versetzen
+	Nudge Clip Selection Left One Frame	Clipauswahl um einen Frame nach links versetzen
+	Nudge Clip Selection Right Five Frames	Clipauswahl um fünf Frames nach rechts versetzen
+	Nudge Clip Selection Right One Frame	Clipauswahl um einen Frame nach rechts versetzen
+	Nudge Clip Selection Up	Clipauswahl nach oben versetzen
+	Nudge Selected Object down by five	Ausgewähltes Objekt um fünf nach unten versetzen
+	Nudge Selected Object down by one	Ausgewähltes Objekt um eins nach unten versetzen
+	Nudge Selected Object to left by five	Ausgewähltes Objekt um fünf nach links versetzen
+	Nudge Selected Object to left by one	Ausgewähltes Objekt um eins nach links versetzen
+	Nudge Selected Object to right by five	Ausgewähltes Objekt um fünf nach rechts versetzen
+	Nudge Selected Object to right by one	Ausgewähltes Objekt um eins nach rechts versetzen
+	Nudge Selected Object up by five	Ausgewähltes Objekt um fünf nach oben versetzen
+	Nudge Selected Object up by one	Ausgewähltes Objekt um eins nach oben versetzen
+	Nudge Volume +1dB	Lautstärke +1 dB
+	Nudge Volume +3dB	Lautstärke +3 dB
+	Nudge Volume -1dB	Lautstärke −1 dB
+	Nudge Volume -3dB	Lautstärke −3 dB
+	Numbered BMP stills (24-bit)	Nummerierte BMP-Standbilder (24 Bit)
+	JPEG	JPEG
+	Targa	Targa
+	DPX	DPX
+	JPEG Sequence	JPEG-Sequenz
+	Targa Sequence	Targa-Sequenz
+	DPX Sequence	DPX-Sequenz
+	Numbered JPEG stills (quality 90)	Nummerierte JPEG-Standbilder (Qualität 90)
+	Numbered Targa stills (24-bit, uncompressed)	Nummerierte Targa-Standbilder (24 Bit, unkomprimiert)
+	Numbered DPX stills (10-bit RGB)	Nummerierte DPX-Standbilder (10 Bit RGB)
+	OpenEXR	OpenEXR
+	OpenEXR Sequence	OpenEXR-Sequenz
+	Numbered OpenEXR stills (half float, linear, uncompressed)	Nummerierte OpenEXR-Standbilder (Half Float, linear, unkomprimiert)
+	Numbered PNG stills at the sequence's frame size	Nummerierte PNG-Standbilder in der Bildgröße der Sequenz
+	Numbered TIFF stills (RGB, 8-bit)	Nummerierte TIFF-Standbilder (RGB, 8 Bit)
+	Opacity 0 → 100 % over the first second	Deckkraft 0 → 100 % in der ersten Sekunde
+	Opacity 100 → 0 % over the last second	Deckkraft 100 → 0 % in der letzten Sekunde
+	Open Bin	Ablage öffnen
+	Open Search	Suche öffnen
+	PNG	PNG
+	PNG Sequence	PNG-Sequenz
+	Panel	Bedienfeld
+	Pen Tool	Zeichenstift-Werkzeug
+	PiP 35% Upper Right	Bild-im-Bild 35 % oben rechts
+	Picture-in-picture: 35 % scale in the upper right	Bild-im-Bild: 35 % Skalierung oben rechts
+	Play Around	Um Position herum abspielen
+	Play In to Out with Preroll/Postroll	Von In bis Out mit Vor- und Nachlauf abspielen
+	Play from Playhead to Out Point	Von der Abspielposition bis zum Out-Punkt abspielen
+	Play/Stop	Wiedergabe/Stopp
+	Previous Multi-Camera Page	Vorherige Mehrkamera-Seite
+	Progressive	Progressiv
+	ProjectPanel	Projekt-Bedienfeld
+	QuickTime (Motion JPEG)	QuickTime (Motion JPEG)
+	QuickTime, APV 422-10 (10-bit 4:2:2), 24-bit 48 kHz PCM	QuickTime, APV 422-10 (10 Bit 4:2:2), PCM 24 Bit 48 kHz
+	QuickTime, APV 422-12 (12-bit 4:2:2), 24-bit 48 kHz PCM	QuickTime, APV 422-12 (12 Bit 4:2:2), PCM 24 Bit 48 kHz
+	QuickTime, DNxHR HQ (8-bit 4:2:2), 24-bit 48 kHz PCM	QuickTime, DNxHR HQ (8 Bit 4:2:2), PCM 24 Bit 48 kHz
+	QuickTime, DNxHR LB (8-bit 4:2:2), 24-bit 48 kHz PCM	QuickTime, DNxHR LB (8 Bit 4:2:2), PCM 24 Bit 48 kHz
+	QuickTime, DNxHR SQ (8-bit 4:2:2), 24-bit 48 kHz PCM	QuickTime, DNxHR SQ (8 Bit 4:2:2), PCM 24 Bit 48 kHz
+	QuickTime, ProRes 422 HQ, 24-bit 48 kHz PCM	QuickTime, ProRes 422 HQ, PCM 24 Bit 48 kHz
+	QuickTime, ProRes 422 LT, 24-bit 48 kHz PCM	QuickTime, ProRes 422 LT, PCM 24 Bit 48 kHz
+	QuickTime, ProRes 422 Proxy, 24-bit 48 kHz PCM	QuickTime, ProRes 422 Proxy, PCM 24 Bit 48 kHz
+	QuickTime, ProRes 4444 (4:4:4), 24-bit 48 kHz PCM	QuickTime, ProRes 4444 (4:4:4), PCM 24 Bit 48 kHz
+	QuickTime, ProRes 4444 (4:4:4) with alpha channel, 24-bit 48 kHz PCM	QuickTime, ProRes 4444 (4:4:4) mit Alphakanal, PCM 24 Bit 48 kHz
+	QuickTime, ProRes 4444 XQ (4:4:4), 24-bit 48 kHz PCM	QuickTime, ProRes 4444 XQ (4:4:4), PCM 24 Bit 48 kHz
+	QuickTime, ProRes 422, 24-bit 48 kHz PCM	QuickTime, ProRes 422, PCM 24 Bit 48 kHz
+	Rate Stretch Tool	Ratendehnungswerkzeug
+	Razor Tool	Rasierklingen-Werkzeug
+	Rectangle Tool	Rechteckwerkzeug
+	Remix Tool	Remix-Werkzeug
+	Right align text	Text rechtsbündig
+	Ripple Edit Tool	Ripple-Werkzeug
+	Ripple Trim Next Edit to Playhead	Nächsten Schnitt per Ripple bis zur Abspielposition trimmen
+	Ripple Trim Previous Edit to Playhead	Vorherigen Schnitt per Ripple bis zur Abspielposition trimmen
+	Rolling Edit Tool	Rollen-Werkzeug
+	Select Camera 1	Kamera 1 auswählen
+	Select Camera 2	Kamera 2 auswählen
+	Select Camera 3	Kamera 3 auswählen
+	Select Camera 4	Kamera 4 auswählen
+	Select Camera 5	Kamera 5 auswählen
+	Select Camera 6	Kamera 6 auswählen
+	Select Camera 7	Kamera 7 auswählen
+	Select Camera 8	Kamera 8 auswählen
+	Select Camera 9	Kamera 9 auswählen
+	Select Clip at Playhead	Clip an der Abspielposition auswählen
+	Select Find Box	Suchfeld auswählen
+	Select Next Clip	Nächsten Clip auswählen
+	Select Next Panel	Nächstes Bedienfeld auswählen
+	Select Previous Clip	Vorherigen Clip auswählen
+	Select Previous Panel	Vorheriges Bedienfeld auswählen
+	Select to Next Line	Bis zur nächsten Zeile auswählen
+	Select to Next Word	Bis zum nächsten Wort auswählen
+	Select to Previous Line	Bis zur vorherigen Zeile auswählen
+	Select to Previous Word	Bis zum vorherigen Wort auswählen
+	Select to Segment End	Bis zum Segmentende auswählen
+	Select to Segment Start	Bis zum Segmentanfang auswählen
+	Selection Tool	Auswahlwerkzeug
+	Set Comparison Reference	Vergleichsreferenz festlegen
+	Set Creative Look	Kreativen Look festlegen
+	Set Input LUT	Eingabe-LUT festlegen
+	Set Project Panel View	Ansicht des Projekt-Bedienfelds festlegen
+	Show Next Screen	Nächsten Bildschirm anzeigen
+	Show Previous Screen	Vorherigen Bildschirm anzeigen
+	Show Program Transcript	Programmtranskript anzeigen
+	Shuttle Left	Shuttle links
+	Shuttle Right	Shuttle rechts
+	Shuttle Slow Left	Shuttle langsam links
+	Shuttle Slow Right	Shuttle langsam rechts
+	Shuttle Stop	Shuttle stopp
+	Slide Clip Selection Left Five Frames	Clipauswahl um fünf Frames nach links verschieben (Slide)
+	Slide Clip Selection Left One Frame	Clipauswahl um einen Frame nach links verschieben (Slide)
+	Slide Clip Selection Right Five Frames	Clipauswahl um fünf Frames nach rechts verschieben (Slide)
+	Slide Clip Selection Right One Frame	Clipauswahl um einen Frame nach rechts verschieben (Slide)
+	Slide Tool	Slide-Werkzeug
+	Slip Clip Selection Left Five Frames	Inhalt der Clipauswahl um fünf Frames nach links verschieben (Slip)
+	Slip Clip Selection Left One Frame	Inhalt der Clipauswahl um einen Frame nach links verschieben (Slip)
+	Slip Clip Selection Right Five Frames	Inhalt der Clipauswahl um fünf Frames nach rechts verschieben (Slip)
+	Slip Clip Selection Right One Frame	Inhalt der Clipauswahl um einen Frame nach rechts verschieben (Slip)
+	Slip Tool	Slip-Werkzeug
+	Social Vertical 1080×1920	Social Media hochkant 1080×1920
+	Soft Vignette	Weiche Vignette
+	Source In/Out	Quell-In/-Out
+	Split Caption	Untertitel teilen
+	Square Pixels (1.0)	Quadratische Pixel (1,0)
+	Stack Clips	Clips stapeln
+	Start Export Queue	Exportwarteschlange starten
+	Start Voice-over Recording	Voice-over-Aufnahme starten
+	Step Back Five Frames	Fünf Frames zurück
+	Step Back One Frame	Einen Frame zurück
+	Step Forward Five Frames	Fünf Frames vor
+	Step Forward One Frame	Einen Frame vor
+	Stop Export Queue	Exportwarteschlange stoppen
+	Stop Multi-Camera Recording	Mehrkamera-Aufnahme stoppen
+	Stop Voice-over Recording	Voice-over-Aufnahme stoppen
+	Sync Voice-over Capture	Voice-over-Aufnahme synchronisieren
+	TIFF	TIFF
+	TIFF Sequence	TIFF-Sequenz
+	TextPanel	Text-Bedienfeld
+	Thumbnail Size Next	Nächste Miniaturgröße
+	Thumbnail Size Previous	Vorherige Miniaturgröße
+	Toggle All Audio Targets	Alle Audioziele ein/aus
+	Toggle All Source Audio	Gesamtes Quellaudio ein/aus
+	Toggle All Source Video	Gesamtes Quellvideo ein/aus
+	Toggle All Video Targets	Alle Videoziele ein/aus
+	Toggle Audio During Scrubbing	Audio beim Scrubben ein/aus
+	Toggle Full Screen	Vollbild ein/aus
+	Toggle Mute for All Targeted Audio Tracks	Stummschaltung für alle Ziel-Audiospuren ein/aus
+	Toggle Solo for All Targeted Audio Tracks	Solo für alle Ziel-Audiospuren ein/aus
+	Toggle Source/Program Monitor Focus	Fokus zwischen Quell- und Programmmonitor wechseln
+	Toggle Target Audio 1	Audioziel 1 ein/aus
+	Toggle Target Audio 2	Audioziel 2 ein/aus
+	Toggle Target Audio 3	Audioziel 3 ein/aus
+	Toggle Target Audio 4	Audioziel 4 ein/aus
+	Toggle Target Audio 5	Audioziel 5 ein/aus
+	Toggle Target Audio 6	Audioziel 6 ein/aus
+	Toggle Target Audio 7	Audioziel 7 ein/aus
+	Toggle Target Audio 8	Audioziel 8 ein/aus
+	Toggle Target Video 1	Videoziel 1 ein/aus
+	Toggle Target Video 2	Videoziel 2 ein/aus
+	Toggle Target Video 3	Videoziel 3 ein/aus
+	Toggle Target Video 4	Videoziel 4 ein/aus
+	Toggle Target Video 5	Videoziel 5 ein/aus
+	Toggle Target Video 6	Videoziel 6 ein/aus
+	Toggle Target Video 7	Videoziel 7 ein/aus
+	Toggle Target Video 8	Videoziel 8 ein/aus
+	Toggle Track Output for All Targeted Video Tracks	Spurausgabe für alle Ziel-Videospuren ein/aus
+	Toggle Trim Type	Trimmart wechseln
+	Toggle View	Ansicht wechseln
+	Track Select Backward Tool	Werkzeug „Spur rückwärts auswählen“
+	Track Select Forward Tool	Werkzeug „Spur vorwärts auswählen“
+	Track Selected Mask	Ausgewählte Maske verfolgen
+	Trim Next Edit to Playhead	Nächsten Schnitt bis zur Abspielposition trimmen
+	Trim Previous Edit to Playhead	Vorherigen Schnitt bis zur Abspielposition trimmen
+	Trimming	Trimmen
+	Type Tool	Textwerkzeug
+	Unstack Clips	Clipstapel auflösen
+	Upper First	Oberes Halbbild zuerst
+	VBR, 1 pass	VBR, 1 Durchgang
+	VBR, 2 pass	VBR, 2 Durchgänge
+	CRF (constant quality)	CRF (konstante Qualität)
+	Vimeo 1080p Full HD	Vimeo 1080p Full HD
+	Vimeo 2160p 4K Ultra HD	Vimeo 2160p 4K Ultra HD
+	Voice-over Record	Voice-over-Aufnahme
+	Voiceover	Voice-over
+	WAV, stereo 48 kHz 16-bit PCM	WAV, Stereo 48 kHz 16-Bit-PCM
+	WAV, stereo 48 kHz 24-bit PCM	WAV, Stereo 48 kHz 24-Bit-PCM
+	Warm Tint	Warme Tönung
+	Warm highlights, brown shadows	Warme Lichter, braune Tiefen
+	Waveform Audio	Waveform Audio
+	Waveform Audio 48 kHz 16-bit	Waveform Audio 48 kHz 16 Bit
+	Waveform Audio 48 kHz 24-bit	Waveform Audio 48 kHz 24 Bit
+	Web & Social	Web und Social Media
+	Work Area	Arbeitsbereichsleiste
+	Write Automation	Automation schreiben
+	YouTube 1080p Full HD	YouTube 1080p Full HD
+	YouTube 2160p 4K Ultra HD	YouTube 2160p 4K Ultra HD
+	Zoom Program Monitor to 100%	Programmmonitor auf 100 % zoomen
+	Zoom Program Monitor to Fit	Programmmonitor einpassen
+	Zoom Source Monitor to 100%	Quellmonitor auf 100 % zoomen
+	Zoom Source Monitor to Fit	Quellmonitor einpassen
+	Zoom Tool	Zoomwerkzeug
+	with:	durch:
+	Interface Language	Sprache der Oberfläche
+	System Language	Systemsprache
+	Cinematic	Filmisch
+	Film Emulation	Filmemulation
+	Technical	Technisch
+	Teal Shadows, Warm Skin	Petrolfarbene Tiefen, warme Haut
+	Night Exterior	Nacht außen
+	Golden Dusk	Goldene Dämmerung
+	Steel Blue	Stahlblau
+	Hard Sun	Harte Sonne
+	Faded Print	Verblasste Kopie
+	Silver Retention	Silberrückhalt
+	Cross Processed	Crossentwicklung
+	Warm Negative	Warmes Negativ
+	Neutral Mono	Neutrales Mono
+	Hard Mono	Hartes Mono
+	Sepia Tone	Sepiaton
+	Cold Mono	Kaltes Mono
+	Lift Shadows	Tiefen anheben
+	Protect Highlights	Lichter schützen
+	Half Saturation	Halbe Sättigung
+	Boost Vibrance	Dynamik erhöhen
+	Legal Range Squeeze	Auf legalen Bereich stauchen
+	A boxed label with a round pointer; move the label and the pointer follows.	Ein Etikett im Kasten mit rundem Zeiger; verschiebst du das Etikett, folgt der Zeiger.
+	A rounded tag that fits its text, with a status dot.	Ein abgerundetes Tag, das sich an seinen Text anpasst, mit Statuspunkt.
+	A title on a rounded card with a soft shadow.	Ein Titel auf einer abgerundeten Karte mit weichem Schatten.
+	Accent Color	Akzentfarbe
+	Bar Color	Balkenfarbe
+	Box Color	Kastenfarbe
+	Box Opacity	Kastendeckkraft
+	Callout – Pointer	Callout – Zeiger
+	Callout – Tag	Callout – Tag
+	Callouts	Callouts
+	Credits	Abspann
+	Dot Color	Punktfarbe
+	Heading	Überschrift
+	Large centred title, accent rule and subtitle.	Großer zentrierter Titel, Akzentlinie und Untertitel.
+	Lower Third – Rule	Bauchbinde – Linie
+	Lower Third – Slab	Bauchbinde – Fläche
+	Lower Thirds	Bauchbinden
+	Name Color	Namensfarbe
+	Name Size	Namensgröße
+	Name and role on a coloured slab that widens with the name.	Name und Funktion auf einer farbigen Fläche, die mit dem Namen breiter wird.
+	Name over a thin rule that always matches the name's width.	Name über einer dünnen Linie, die immer so breit ist wie der Name.
+	Pointer Color	Zeigerfarbe
+	Role	Funktion
+	Rule Color	Linienfarbe
+	Show Dot	Punkt anzeigen
+	Show Role	Funktion anzeigen
+	Slab Color	Flächenfarbe
+	Tag Color	Tag-Farbe
+	Title Color	Titelfarbe
+	Title Size	Titelgröße
+	Title – Boxed	Titel – im Kasten
+	Title – Centered	Titel – zentriert
+	Titles	Titel
+	Select an item to preview it	Wähle ein Element aus, um eine Vorschau zu sehen
+	End Credits	Abspann
+	End Credits – Roll	Abspann – Rolltitel
+	Ticker – Crawl	Laufband – Laufschrift
+	Centred credits that roll up from below the frame and leave at the top.	Zentrierter Abspann, der von unterhalb des Bildes nach oben rollt und oben verschwindet.
+	A news-style line that crawls in from the right and leaves at the left.	Eine Zeile im Nachrichtenstil, die von rechts hereinläuft und links verschwindet.
+	out	Out
+	in	In
+	The language changed but could not be saved: {e}	Die Sprache wurde geändert, konnte aber nicht gespeichert werden: {e}
+	no Chinese font is installed on this system; the interface stays in English	auf diesem System ist keine chinesische Schrift installiert; die Oberfläche bleibt auf Englisch
+	no Korean font is installed on this system; the interface stays in English	Auf diesem System ist keine koreanische Schrift installiert; die Oberfläche bleibt auf Englisch
+	no Japanese font is installed on this system; the interface stays in English	auf diesem System ist keine japanische Schrift installiert; die Oberfläche bleibt auf Englisch
+	Show	Anzeigen
+	Sort	Sortieren
+	Reverse the order	Reihenfolge umkehren
+	Grab bag	Allerlei
+	Table	Tabelle
+	No contributor data was built into this copy.	In diese Kopie wurden keine Daten zu Mitwirkenden eingebaut.
+	No model credits were built into this copy.	In diese Kopie wurden keine Modell-Credits eingebaut.
+	Company	Firma
+	Model	Modell
+	Version	Version
+	Commits	Commits
+	% of all commits	% aller Commits
+	Lines +/−	Zeilen +/−
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	Audioausgabe fehlgeschlagen: Wiedergabe ohne Ton (prüfe Voreinstellungen > Audiohardware)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	Audioausgabe reagiert nicht: Wiedergabe ohne Ton (prüfe Voreinstellungen > Audiohardware)
+	Clip Speed / Duration	Clipgeschwindigkeit/-dauer
+	Speed:	Geschwindigkeit:
+	Reverse Speed	Rückwärts abspielen
+	Ripple Edit, Shifting Trailing Clips	Ripple-Bearbeitung, nachfolgende Clips verschieben
+	About	Über
+	Contributors	Mitwirkende
+	Models	Modelle
+	Main (8-bit)	Main (8 Bit)
+	Main 10 (10-bit, HDR)	Main 10 (10 Bit, HDR)
+	Main (8-bit; Main 10 for HDR sequences)	Main (8 Bit; Main 10 für HDR-Sequenzen)
+	Encoder	Encoder
+	Hardware (H.265 has no software encoder)	Hardware (für H.265 gibt es keinen Software-Encoder)
+	Hardware (AV1 has no software encoder)	Hardware (für AV1 gibt es keinen Software-Encoder)
+	Text Properties	Texteigenschaften
+	Text Box Height	Textfeldhöhe
+	Paragraph Text	Absatztext
+	Point Text	Punkttext
+	Text Layer Type	Art der Textebene
+	Text Styling	Textgestaltung
+	New Color Matte	Neue Farbfläche
+	Color Matte Color	Farbe der Farbfläche
+	Color:	Farbe:
+	 · {time} left	 · noch {time}
+	Discard take	Take verwerfen
+	Voice-over take discarded	Voice-over-Take verworfen
+	Binary assets added	Hinzugefügte Binärdateien
+	Binary assets removed	Entfernte Binärdateien
+	Deselect All Project Items	Auswahl aller Projektelemente aufheben
+	Display name	Anzeigename
+	First commit	Erster Commit
+	H.265 (HEVC)	H.265 (HEVC)
+	Last commit	Letzter Commit
+	Line delta	Zeilendifferenz
+	Lines added	Hinzugefügte Zeilen
+	Lines deleted	Gelöschte Zeilen
+	Merged PRs	Gemergte PRs
+	Name (A–Z)	Name (A–Z)
+	Real name	Echter Name
+	Select All Project Items	Alle Projektelemente auswählen
+	Username	Benutzername
+	Vertical Type Tool	Vertikales Textwerkzeug
+	Go to previous keyframe	Zum vorherigen Keyframe gehen
+	Go to next keyframe	Zum nächsten Keyframe gehen
+	Add keyframe	Keyframe hinzufügen
+	Remove keyframe	Keyframe entfernen
+	Turn on animation and add keyframe	Animation einschalten und Keyframe hinzufügen
+	Click to select, or click in empty space and drag to marquee select. Use Shift, Alt, and Ctrl for other options.	Klicken zum Auswählen oder in einen leeren Bereich klicken und ziehen für eine Rahmenauswahl. Umschalt, Alt und Strg bieten weitere Optionen.
+	Click to zoom in; Alt-click to zoom out.	Klicken vergrößert; Alt+Klick verkleinert.
+	Drag: move · Alt-click: smooth/corner · Ctrl-click: delete	Ziehen: verschieben · Alt+Klick: glatt/Ecke · Strg+Klick: löschen
+	Drag inward to round the corners	Nach innen ziehen, um die Ecken abzurunden
+	Include Alpha Channel	Alphakanal einschließen
+	Sequence Settings	Sequenzeinstellungen
+	Color Management	Farbmanagement
+	VR Properties	VR-Eigenschaften
+	Editing Mode:	Bearbeitungsmodus:
+	Timebase:	Zeitbasis:
+	Frame Size:	Bildgröße:
+	Pixel Aspect Ratio:	Pixel-Seitenverhältnis:
+	Fields:	Halbbilder:
+	Channel Format:	Kanalformat:
+	Number of Channels:	Anzahl der Kanäle:
+	Preview File Format:	Format der Vorschaudateien:
+	Working Color Space:	Arbeitsfarbraum:
+	Projection:	Projektion:
+	Layout:	Layout:
+	Captured View:	Aufgenommene Ansicht:
+	Video Previews	Videovorschauen
+	No Fields (Progressive Scan)	Keine Halbbilder (progressiv)
+	Custom ({ratio})	Benutzerdefiniert ({ratio})
+	{rate} frames/second	{rate} Frames/Sekunde
+	{rate} fps Drop-Frame Timecode	{rate} fps Drop-Frame-Timecode
+	{rate} fps Non Drop-Frame Timecode	{rate} fps Non-Drop-Frame-Timecode
+	{rate} fps Timecode	{rate} fps Timecode
+	horizontal	horizontal
+	vertical	vertikal
+	Scale motion effects proportionally when changing frame size	Bewegungseffekte beim Ändern der Bildgröße proportional skalieren
+	Maximum Bit Depth	Maximale Bittiefe
+	Maximum Render Quality	Maximale Renderqualität
+	Composite in Linear Color	In linearem Farbraum zusammensetzen
+	Auto Tone Map Media (HDR and log into SDR)	Automatisches Tone-Mapping für Medien (HDR und Log nach SDR)
+	Configure…	Konfigurieren…
+	Not supported in FilmCraft yet	In FilmCraft noch nicht unterstützt
+	FilmCraft always composites in linear light	FilmCraft setzt immer in linearem Licht zusammen
+	Loop marked range	Markierten Bereich in Schleife
+	Play Source	Quelle abspielen
+	Source Play/Stop	Quelle Wiedergabe/Stopp
+	Stop Source	Quelle stoppen
+	New Sequence	Neue Sequenz
+	Tracks	Spuren
+	tracks	Spuren
+	Clear Transition	Übergang entfernen
+	Set Transition Duration	Übergangsdauer festlegen
+	Active	Aktiv
+	Appearance Mode	Darstellungsmodus
+	Dark Theme	Dunkles Design
+	Light Theme	Helles Design
+	Sync with system	Mit System synchronisieren
+	UI Scale	Skalierung der Oberfläche
+	Auto (system)	Automatisch (System)
+	In	In
+	Out	Out
+	Fill Type	Füllungsart
+	Gradient Angle	Verlaufswinkel
+	Linear Gradient	Linearer Verlauf
+	Solid	Vollton
+	GPU Rendering	GPU-Rendering
+	Composite on the GPU when available	Auf der GPU zusammensetzen, wenn verfügbar
+	Text to Speech	Text zu Sprache
+	Edit Narration	Erzählung bearbeiten
+	Dock Panel	Bedienfeld andocken
+	Undock Panel	Bedienfeld abdocken
+	Docking Action	Andockaktion
+	Resize floating panel	Größe des schwebenden Bedienfelds ändern
+	Get Project Notes	Projektnotizen abrufen
+	Edit Project Notes	Projektnotizen bearbeiten
+	Notes for this project: to-dos, instructions, frame numbers… Saved with the project.	Notizen zu diesem Projekt: Aufgaben, Anweisungen, Framenummern… Werden mit dem Projekt gespeichert.
+	Use Effect Shutter Angle	Verschlusswinkel des Effekts verwenden
+	Appearance Settings…	Darstellungseinstellungen…
+	Add to favorites	Zu Favoriten hinzufügen
+	Remove from favorites	Aus Favoriten entfernen
+	Compression	Kompression
+	ZIP (1 scan line)	ZIP (1 Zeile)
+	ZIP (16 scan lines)	ZIP (16 Zeilen)
+	Safe graphics mode: {mode}	Sicherer Grafikmodus: {mode}
+	An earlier start failed with the default graphics. Updating the graphics driver usually fixes this.	Ein früherer Start mit der Standardgrafik ist fehlgeschlagen. Meist hilft es, den Grafiktreiber zu aktualisieren.
+	Use Default Graphics	Standardgrafik verwenden
+	The default graphics are used from the next start.	Die Standardgrafik wird ab dem nächsten Start verwendet.
+	DirectX 12 only	Nur DirectX 12
+	software rendering	Software-Rendering
+	Label Color Presets	Vorgaben für Markierungsfarben
+	{name} (Modified)	{name} (geändert)
+	Revert to the preset's colors and names	Auf die Farben und Namen der Vorgabe zurücksetzen
+	Import a preset file…	Vorgabedatei importieren…
+	Export the labels to a preset file…	Farbmarkierungen in eine Vorgabedatei exportieren…
+	Show the presets folder	Vorgabenordner anzeigen
+	Delete this preset	Diese Vorgabe löschen
+	Opens in your web browser: {url}	Wird in deinem Webbrowser geöffnet: {url}
+	Saves this session's log and shows it in your file manager.	Speichert das Protokoll dieser Sitzung und zeigt es in deinem Dateimanager.
+	Shows a report on this computer.	Zeigt einen Bericht über diesen Computer.
+	Shows the version, community links and credits in a FilmCraft window.	Zeigt Version, Community-Links und Credits in einem FilmCraft-Fenster.
+	Couldn't open your web browser	Dein Webbrowser konnte nicht geöffnet werden
+	Open this address in your browser yourself:	Öffne diese Adresse selbst in deinem Browser:
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0af8835d1..14eddb4f2 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -169,6 +169,9 @@
 	Hide All Caption Tracks	Ocultar todas las pistas de subtítulos
 	High Quality Playback	Reproducción de alta calidad
 	History	Historial
+	Delete Redoable Actions	Eliminar acciones que se pueden rehacer
+	Clear History	Borrar historial
+	Delete the dimmed actions after the current state? They cannot be redone.	¿Eliminar las acciones atenuadas posteriores al estado actual? No se podrán rehacer.
 	Import From	Importar desde
 	Import Image Sequence…	Importar secuencia de imágenes…
 	Import from Media Browser	Importar desde el navegador de medios
@@ -319,6 +322,7 @@
 	Show Active Caption Tracks Only	Mostrar solo pistas de subtítulos activas
 	Show All Caption Tracks	Mostrar todas las pistas de subtítulos
 	Show All Marker Colors	Mostrar todos los colores de marcador
+	Show Duplicate Frame Markers	Mostrar marcadores de fotogramas duplicados
 	Show Guides	Mostrar guías
 	Show Rulers	Mostrar reglas
 	Show Through Edits	Mostrar cortes continuos
@@ -344,6 +348,7 @@
 	Transcribe Sequence…	Transcribir secuencia…
 	Transcribe…	Transcribir…
 	Transcript	Transcripción
+	Transparency Grid	Cuadrícula de transparencia
 	Transparent Video…	Video transparente…
 	Trim Edit	Edición de recorte
 	Trim…	Recorte…
@@ -508,6 +513,10 @@
 	Reveal Sequence in Project	Mostrar secuencia en el proyecto
 	Video Thumbnails	Miniaturas de video
 	Audio Waveforms	Formas de onda de audio
+	Work Area Bar	Barra de área de trabajo
+	Start: {tc}	Inicio: {tc}
+	End: {tc}	Fin: {tc}
+	Duration: {tc}	Duración: {tc}
 	Delete Preset	Eliminar ajuste preestablecido
 	Export Preset…	Exportar ajuste preestablecido…
 	Import Presets…	Importar ajustes preestablecidos…
@@ -1266,6 +1275,7 @@
 	59.94 fps Non Drop-Frame	59,94 fps sin eliminación de fotogramas
 	ASC CDL	ASC CDL
 	Accessible color contrast	Contraste de color accesible
+	Animate zoom, scrolling and menus	Animar el zoom, el desplazamiento y los menús
 	Action-Safe Margin	Margen seguro de acción
 	Active Monitor	Monitor activo
 	Add	Añadir
@@ -3457,8 +3467,8 @@
 	Commits	Commits
 	% of all commits	% de todos los commits
 	Lines +/−	Líneas +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	La salida de audio ha fallado: se reproduce sin sonido (revisa Ajustes ▸ Hardware de audio)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	La salida de audio no responde: se reproduce sin sonido (revisa Ajustes ▸ Hardware de audio)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	La salida de audio ha fallado: se reproduce sin sonido (revisa Ajustes > Hardware de audio)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	La salida de audio no responde: se reproduce sin sonido (revisa Ajustes > Hardware de audio)
 	Clip Speed / Duration	Velocidad/duración del clip
 	Speed:	Velocidad:
 	Reverse Speed	Invertir velocidad
@@ -3610,3 +3620,11 @@
 	Shows the version, community links and credits in a FilmCraft window.	Muestra la versión, los enlaces de la comunidad y los créditos en una ventana de FilmCraft.
 	Couldn't open your web browser	No se pudo abrir el navegador web
 	Open this address in your browser yourself:	Abre esta dirección tú mismo en el navegador:
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	Restablecer zoom de la interfaz
+	Track Color	Color de pista
+	Open a sequence to search its graphics	Abre una secuencia para buscar en sus gráficos
+	No text graphics in this sequence. Add text with the Type tool.	Esta secuencia no tiene gráficos con texto. Añade texto con la herramienta Texto.
+	No matching text.	Ningún texto coincide.
+	H.265 (HEVC) needs a hardware encoder (NVENC on NVIDIA GPUs, VideoToolbox on macOS); none was found on this machine, and FilmCraft has no software H.265 encoder yet. Choose H.264 or ProRes instead.	H.265 (HEVC) necesita un codificador por hardware (NVENC en GPU NVIDIA, VideoToolbox en macOS); no se encontró ninguno en este equipo y FilmCraft aún no tiene un codificador H.265 por software. Elija H.264 o ProRes.
+	AV1 needs a hardware encoder; none was found on this machine, and FilmCraft has no software AV1 encoder yet.	AV1 necesita un codificador por hardware; no se encontró ninguno en este equipo y FilmCraft aún no tiene un codificador AV1 por software.
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 1075b0c15..8d00deec3 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -321,6 +321,7 @@
 	Show Active Caption Tracks Only	Afficher uniquement les pistes de sous-titres actives
 	Show All Caption Tracks	Afficher toutes les pistes de sous-titres
 	Show All Marker Colors	Afficher toutes les couleurs de marqueur
+	Show Duplicate Frame Markers	Afficher les marqueurs d'images en double
 	Show Guides	Afficher les repères
 	Show Rulers	Afficher les règles
 	Show Through Edits	Afficher les points de montage traversants
@@ -1266,6 +1267,7 @@
 	59.94 fps Non Drop-Frame	59,94 fps non-drop frame
 	ASC CDL	ASC CDL
 	Accessible color contrast	Contraste des couleurs accessible
+	Animate zoom, scrolling and menus	Animer le zoom, le défilement et les menus
 	Action-Safe Margin	Marge de sécurité de l'action
 	Active Monitor	Moniteur actif
 	Add	Ajouter
@@ -3436,8 +3438,8 @@
 	Commits	Commits
 	% of all commits	% de tous les commits
 	Lines +/−	Lignes +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	Échec de la sortie audio : lecture sans son (vérifiez Préférences ▸ Matériel audio)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	La sortie audio ne répond pas : lecture sans son (vérifiez Préférences ▸ Matériel audio)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	Échec de la sortie audio : lecture sans son (vérifiez Préférences > Matériel audio)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	La sortie audio ne répond pas : lecture sans son (vérifiez Préférences > Matériel audio)
 	Clip Speed / Duration	Vitesse/durée du clip
 	Speed:	Vitesse :
 	Reverse Speed	Vitesse inversée
@@ -3577,3 +3579,51 @@
 	Export the labels to a preset file…	Exporter les étiquettes dans un fichier de paramètre prédéfini…
 	Show the presets folder	Afficher le dossier des paramètres prédéfinis
 	Delete this preset	Supprimer ce paramètre prédéfini
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	Réinitialiser le zoom de l'interface
+	Track Color	Couleur de la piste
+	Open a sequence to search its graphics	Ouvrez une séquence pour rechercher dans ses graphiques
+	No text graphics in this sequence. Add text with the Type tool.	Aucun graphique avec du texte dans cette séquence. Ajoutez du texte avec l'outil Texte.
+	No matching text.	Aucun texte ne correspond.
+	Hide FilmCraft	Masquer FilmCraft
+	Hide Others	Masquer les autres
+	More transport controls	Autres commandes de lecture
+	A file dialog is already open	Une fenêtre de sélection de fichier est déjà ouverte
+	FLAC	FLAC
+	FLAC 48 kHz 24-bit	FLAC 48 kHz 24 bits
+	FLAC, stereo 48 kHz 24-bit, lossless	FLAC, stéréo 48 kHz 24 bits, sans perte
+	FLAC (lossless)	FLAC (sans perte)
+	Compression Level	Niveau de compression
+	0 fastest, 8 smallest	0 le plus rapide, 8 le plus compact
+	JPEG	JPEG
+	Targa	Targa
+	DPX	DPX
+	JPEG Sequence	Séquence JPEG
+	Targa Sequence	Séquence Targa
+	DPX Sequence	Séquence DPX
+	Numbered JPEG stills (quality 90)	Images fixes JPEG numérotées (qualité 90)
+	Numbered Targa stills (24-bit, uncompressed)	Images fixes Targa numérotées (24 bits, sans compression)
+	Numbered DPX stills (10-bit RGB)	Images fixes DPX numérotées (RVB 10 bits)
+	OpenEXR	OpenEXR
+	OpenEXR Sequence	Séquence OpenEXR
+	Numbered OpenEXR stills (half float, linear, uncompressed)	Images fixes OpenEXR numérotées (virgule flottante 16 bits, linéaire, sans compression)
+	Dock Panel	Ancrer le panneau
+	Undock Panel	Détacher le panneau
+	Docking Action	Action d'ancrage
+	Resize floating panel	Redimensionner le panneau flottant
+	Opens in your web browser: {url}	S'ouvre dans votre navigateur : {url}
+	Saves this session's log and shows it in your file manager.	Enregistre le journal de cette session et l'affiche dans votre gestionnaire de fichiers.
+	Shows a report on this computer.	Affiche un rapport sur cet ordinateur.
+	Shows the version, community links and credits in a FilmCraft window.	Affiche la version, les liens de la communauté et les crédits dans une fenêtre FilmCraft.
+	Couldn't open your web browser	Impossible d'ouvrir votre navigateur
+	Open this address in your browser yourself:	Ouvrez vous-même cette adresse dans votre navigateur :
+	Delete Redoable Actions	Supprimer les actions rétablissables
+	Clear History	Effacer l'historique
+	Delete the dimmed actions after the current state? They cannot be redone.	Supprimer les actions grisées qui suivent l'état actuel ? Elles ne pourront plus être rétablies.
+	Work Area Bar	Barre de zone de travail
+	Start: {tc}	Début : {tc}
+	End: {tc}	Fin : {tc}
+	Duration: {tc}	Durée : {tc}
+	H.265 (HEVC) needs a hardware encoder (NVENC on NVIDIA GPUs, VideoToolbox on macOS); none was found on this machine, and FilmCraft has no software H.265 encoder yet. Choose H.264 or ProRes instead.	H.265 (HEVC) nécessite un encodeur matériel (NVENC sur les GPU NVIDIA, VideoToolbox sur macOS) ; aucun n'a été trouvé sur cet ordinateur, et FilmCraft n'a pas encore d'encodeur H.265 logiciel. Choisissez plutôt H.264 ou ProRes.
+	AV1 needs a hardware encoder; none was found on this machine, and FilmCraft has no software AV1 encoder yet.	AV1 nécessite un encodeur matériel ; aucun n'a été trouvé sur cet ordinateur, et FilmCraft n'a pas encore d'encodeur AV1 logiciel.
+	Hardware decoding: Auto uses the system's video decoder (VideoToolbox on macOS, Media Foundation on Windows, VA-API for H.264 and HEVC on Linux) for the streams it supports, and FilmCraft's own decoder for everything else or if the hardware fails. Media that is already open keeps its decoder until it is reopened.	Décodage matériel : Auto utilise le décodeur vidéo du système (VideoToolbox sur macOS, Media Foundation sur Windows, VA-API pour H.264 et HEVC sous Linux) pour les flux qu'il prend en charge, et le décodeur de FilmCraft pour tout le reste ou en cas d'échec du matériel. Un média déjà ouvert garde son décodeur jusqu'à sa réouverture.
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 508a6e9d4..3d383b4f0 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -326,6 +326,7 @@
 	Show Active Caption Tracks Only	Tampilkan Hanya Trek Takarir Aktif
 	Show All Caption Tracks	Tampilkan Semua Trek Takarir
 	Show All Marker Colors	Tampilkan Semua Warna Penanda
+	Show Duplicate Frame Markers	Tampilkan Penanda Bingkai Duplikat
 	Show Guides	Tampilkan Garis Bantu
 	Show Rulers	Tampilkan Penggaris
 	Show Through Edits	Tampilkan Edit Tembus
@@ -1271,6 +1272,7 @@
 	59.94 fps Non Drop-Frame	59,94 fps Non Drop-Frame
 	ASC CDL	ASC CDL
 	Accessible color contrast	Kontras warna yang aksesibel
+	Animate zoom, scrolling and menus	Animasikan zoom, gulir, dan menu
 	Action-Safe Margin	Margin Aman Aksi
 	Active Monitor	Monitor Aktif
 	Add	Tambah
@@ -3453,8 +3455,8 @@
 	Commits	Commit
 	% of all commits	% dari semua commit
 	Lines +/−	Baris +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	Output audio gagal: memutar tanpa suara (periksa Pengaturan ▸ Perangkat Keras Audio)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	Output audio tidak merespons: memutar tanpa suara (periksa Pengaturan ▸ Perangkat Keras Audio)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	Output audio gagal: memutar tanpa suara (periksa Pengaturan > Perangkat Keras Audio)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	Output audio tidak merespons: memutar tanpa suara (periksa Pengaturan > Perangkat Keras Audio)
 	Clip Speed / Duration	Kecepatan / Durasi Klip
 	Speed:	Kecepatan:
 	Reverse Speed	Balik Kecepatan
@@ -3575,3 +3577,9 @@
 	Appearance Settings…	Pengaturan Tampilan…
 	Add to favorites	Tambahkan ke favorit
 	Remove from favorites	Hapus dari favorit
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	Atur Ulang Zoom Antarmuka
+	Track Color	Warna Trek
+	Open a sequence to search its graphics	Buka sekuens untuk mencari di grafisnya
+	No text graphics in this sequence. Add text with the Type tool.	Tidak ada grafis teks di sekuens ini. Tambahkan teks dengan alat Teks.
+	No matching text.	Tidak ada teks yang cocok.
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 22d47ccbd..81fb5d627 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -316,6 +316,7 @@
 	Show Active Caption Tracks Only	Mostra solo le tracce sottotitoli attive
 	Show All Caption Tracks	Mostra tutte le tracce sottotitoli
 	Show All Marker Colors	Mostra tutti i colori dei marcatori
+	Show Duplicate Frame Markers	Mostra marcatori dei fotogrammi duplicati
 	Show Guides	Mostra guide
 	Show Rulers	Mostra righelli
 	Show Through Edits	Mostra tagli passanti
@@ -1263,6 +1264,7 @@
 	59.94 fps Non Drop-Frame	59,94 fps non drop-frame
 	ASC CDL	ASC CDL
 	Accessible color contrast	Contrasto dei colori accessibile
+	Animate zoom, scrolling and menus	Anima zoom, scorrimento e menu
 	Action-Safe Margin	Margine di sicurezza azione
 	Active Monitor	Monitor attivo
 	Add	Aggiungi
@@ -3446,8 +3448,8 @@
 	Commits	Commit
 	% of all commits	% di tutti i commit
 	Lines +/−	Righe +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	Uscita audio non riuscita: riproduzione senza audio (controlla Impostazioni ▸ Hardware audio)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	L'uscita audio non risponde: riproduzione senza audio (controlla Impostazioni ▸ Hardware audio)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	Uscita audio non riuscita: riproduzione senza audio (controlla Impostazioni > Hardware audio)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	L'uscita audio non risponde: riproduzione senza audio (controlla Impostazioni > Hardware audio)
 	Clip Speed / Duration	Velocità / durata clip
 	Speed:	Velocità:
 	Reverse Speed	Velocità inversa
@@ -3601,3 +3603,9 @@
 	Shows the version, community links and credits in a FilmCraft window.	Mostra la versione, i link della community e i riconoscimenti in una finestra di FilmCraft.
 	Couldn't open your web browser	Impossibile aprire il browser web
 	Open this address in your browser yourself:	Apri tu questo indirizzo nel browser:
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	Reimposta zoom dell'interfaccia
+	Track Color	Colore traccia
+	Open a sequence to search its graphics	Apri una sequenza per cercare nelle sue grafiche
+	No text graphics in this sequence. Add text with the Type tool.	Nessuna grafica con testo in questa sequenza. Aggiungi testo con lo strumento Testo.
+	No matching text.	Nessun testo corrispondente.
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index b6a7fb8a2..e2b1c6702 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -171,6 +171,9 @@
 	Hide All Caption Tracks	すべてのキャプショントラックを非表示
 	High Quality Playback	高画質再生
 	History	履歴
+	Delete Redoable Actions	やり直し可能な操作を削除
+	Clear History	履歴を消去
+	Delete the dimmed actions after the current state? They cannot be redone.	現在の状態より後の淡色表示の操作を削除しますか？ 削除した操作はやり直せません。
 	Import From	読み込み元
 	Import Image Sequence…	連番画像を読み込み…
 	Import from Media Browser	メディアブラウザーから読み込み
@@ -320,6 +323,7 @@
 	Show Active Caption Tracks Only	アクティブなキャプショントラックのみ表示
 	Show All Caption Tracks	すべてのキャプショントラックを表示
 	Show All Marker Colors	すべての色のマーカーを表示
+	Show Duplicate Frame Markers	重複フレームマーカーを表示
 	Show Guides	ガイドを表示
 	Show Rulers	ルーラーを表示
 	Show Through Edits	スルー編集点を表示
@@ -345,6 +349,7 @@
 	Transcribe Sequence…	シーケンスを文字起こし…
 	Transcribe…	文字起こし…
 	Transcript	文字起こし
+	Transparency Grid	透明グリッド
 	Transparent Video…	透明ビデオ…
 	Trim Edit	トリム編集
 	Trim…	トリム…
@@ -505,6 +510,10 @@
 	Reveal Sequence in Project	プロジェクトでシーケンスを表示
 	Video Thumbnails	ビデオサムネイル
 	Audio Waveforms	オーディオ波形
+	Work Area Bar	ワークエリアバー
+	Start: {tc}	開始: {tc}
+	End: {tc}	終了: {tc}
+	Duration: {tc}	長さ: {tc}
 	Delete Preset	プリセットを削除
 	Export Preset…	プリセットを書き出し…
 	Import Presets…	プリセットを読み込み…
@@ -1260,6 +1269,7 @@
 	59.94 fps Non Drop-Frame	59.94 fps ノンドロップフレーム
 	ASC CDL	ASC CDL
 	Accessible color contrast	アクセシビリティに配慮したカラーコントラスト
+	Animate zoom, scrolling and menus	ズーム、スクロール、メニューをアニメーション表示
 	Action-Safe Margin	アクションセーフの余白
 	Active Monitor	アクティブなモニター
 	Add	加算
@@ -3442,8 +3452,8 @@
 	Commits	コミット
 	% of all commits	全コミットに占める割合 (%)
 	Lines +/−	行数 +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	オーディオ出力に失敗したため、無音で再生しています (「環境設定 ▸ オーディオハードウェア」を確認してください)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	オーディオ出力が応答しないため、無音で再生しています (「環境設定 ▸ オーディオハードウェア」を確認してください)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	オーディオ出力に失敗したため、無音で再生しています (「環境設定 > オーディオハードウェア」を確認してください)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	オーディオ出力が応答しないため、無音で再生しています (「環境設定 > オーディオハードウェア」を確認してください)
 	Clip Speed / Duration	クリップの速度 / 長さ
 	Speed:	速度:
 	Reverse Speed	逆再生する
@@ -3609,3 +3619,11 @@
 	Shows the version, community links and credits in a FilmCraft window.	バージョン、コミュニティへのリンク、クレジットを FilmCraft のウィンドウに表示します。
 	Couldn't open your web browser	ウェブブラウザーを開けませんでした
 	Open this address in your browser yourself:	このアドレスをご自身でブラウザーで開いてください：
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	インターフェイスのズームをリセット
+	Track Color	トラックカラー
+	Open a sequence to search its graphics	シーケンスを開くとグラフィックスを検索できます
+	No text graphics in this sequence. Add text with the Type tool.	このシーケンスにはテキストのグラフィックスがありません。文字ツールでテキストを追加してください。
+	No matching text.	一致するテキストはありません。
+	H.265 (HEVC) needs a hardware encoder (NVENC on NVIDIA GPUs, VideoToolbox on macOS); none was found on this machine, and FilmCraft has no software H.265 encoder yet. Choose H.264 or ProRes instead.	H.265 (HEVC) にはハードウェアエンコーダー（NVIDIA GPU の NVENC、macOS の VideoToolbox）が必要です。このマシンには見つからず、FilmCraft にはまだソフトウェアの H.265 エンコーダーがありません。代わりに H.264 または ProRes を選んでください。
+	AV1 needs a hardware encoder; none was found on this machine, and FilmCraft has no software AV1 encoder yet.	AV1 にはハードウェアエンコーダーが必要です。このマシンには見つからず、FilmCraft にはまだソフトウェアの AV1 エンコーダーがありません。
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 20341b9a6..e795ac9f3 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -76,6 +76,7 @@
 	About FilmCraft	FilmCraft 정보
 	Accent Color	강조 색상
 	Accessible color contrast	접근성 색상 대비
+	Animate zoom, scrolling and menus	확대/축소, 스크롤 및 메뉴 애니메이션
 	Action and Title Safe Areas	액션 및 제목 안전 영역
 	Action Safe Area	액션 안전 영역
 	Action-Safe Margin	액션 세이프 여백
@@ -271,8 +272,8 @@
 	Audio Options	오디오 옵션
 	Audio Out	오디오 출력
 	Audio Out Point	오디오 끝 표시(Out)
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	오디오 출력 실패: 소리 없이 재생 중 (설정 ▸ 오디오 하드웨어 확인)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	오디오 출력 응답 없음: 소리 없이 재생 중 (설정 ▸ 오디오 하드웨어 확인)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	오디오 출력 실패: 소리 없이 재생 중 (설정 > 오디오 하드웨어 확인)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	오디오 출력 응답 없음: 소리 없이 재생 중 (설정 > 오디오 하드웨어 확인)
 	Audio Previews:	오디오 미리 보기:
 	Audio Samples	오디오 샘플
 	Audio Time Units	오디오 시간 단위
@@ -2819,6 +2820,7 @@
 	Show Audio Waveform	오디오 파형 표시
 	Show Clip Mismatch Warning dialog	클립 불일치 경고 대화 상자 표시
 	Show clip names	클립 이름 표시
+	Show Duplicate Frame Markers	중복 프레임 마커 표시
 	Show Dot	점 표시
 	Show durations	길이 표시
 	Show Event Indicator	이벤트 표시기 표시
@@ -3596,3 +3598,9 @@
 	Shows the version, community links and credits in a FilmCraft window.	FilmCraft 창에 버전, 커뮤니티 링크, 제작진을 보여 줍니다.
 	Couldn't open your web browser	웹 브라우저를 열 수 없습니다
 	Open this address in your browser yourself:	이 주소를 브라우저에서 직접 여세요:
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	인터페이스 확대/축소 재설정
+	Track Color	트랙 색상
+	Open a sequence to search its graphics	그래픽을 검색하려면 시퀀스를 여세요
+	No text graphics in this sequence. Add text with the Type tool.	이 시퀀스에는 텍스트 그래픽이 없습니다. 문자 도구로 텍스트를 추가하세요.
+	No matching text.	일치하는 텍스트가 없습니다.
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 30443bf75..d3ccbaff3 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -6,8 +6,8 @@
 //!
 //! # Looking strings up
 //! - `tl!` with a string literal: that UI string in the language the UI is drawn in (see
-//!   [`set_current`]). Use it for every label, button, heading, tooltip and hint; the tests check
-//!   that each `tl!` literal has a Spanish translation.
+//!   [`set_current`]). Use it for every label, button, heading, tooltip and hint; `cargo xtask
+//!   i18n-report` lists the `tl!` literals each catalog lacks.
 //! - [`t`]: the same for a string that is not a literal (a name from a registry or a list).
 //! - [`tr_ctx`]: when one English word needs different translations (the Edit menu, the Edit button).
 //! - [`fmt`]: fill `{name}` placeholders after translating a template; translators may reorder them.
@@ -69,6 +69,26 @@ impl Language {
     pub const ALL: [Self; 13] =
         [Self::En, Self::Ja, Self::Es, Self::PtBr, Self::Uk, Self::ZhCn, Self::De, Self::Ru, Self::Fr, Self::Id, Self::Ko, Self::It, Self::Sv];
 
+    /// BCP 47 tag for AccessKit and the web IME's hidden input. Keep the persisted spelling
+    /// (`pt-br`, `zh-cn`) out of the protocol-facing value.
+    pub fn bcp47(self) -> &'static str {
+        match self {
+            Self::En => "en",
+            Self::Ja => "ja",
+            Self::Es => "es",
+            Self::PtBr => "pt-BR",
+            Self::Uk => "uk",
+            Self::ZhCn => "zh-CN",
+            Self::De => "de",
+            Self::Ru => "ru",
+            Self::Fr => "fr",
+            Self::Id => "id",
+            Self::It => "it",
+            Self::Ko => "ko",
+            Self::Sv => "sv",
+        }
+    }
+
     pub fn name(self) -> &'static str {
         match self {
             Self::En => "English",
@@ -258,7 +278,7 @@ pub fn fmt(template: &str, args: &[(&str, &str)]) -> String {
 const JAPANESE_SAMPLE: &str = "日本語ファイル編集あア";
 
 /// Installed families preferred for Japanese interface text, best first (Gothic / sans-serif faces
-/// read best at menu sizes). Any other installed face that covers [`JAPANESE_SAMPLE`] is used if
+/// read best at menu sizes). Any other installed face that covers `JAPANESE_SAMPLE` is used if
 /// none of these is present.
 const PREFERRED_JAPANESE: &[&str] = &[
     "Hiragino Sans",
@@ -297,13 +317,13 @@ pub fn system_japanese_font() -> Option<Arc<egui::FontData>> {
         // kept for the life of the process (one font, read once) so installing it again after a
         // theme change shares the bytes instead of copying the whole file
         let bytes: &'static [u8] = Box::leak(face.data()?.into_boxed_slice());
-        Some(Arc::new(egui::FontData { font: std::borrow::Cow::Borrowed(bytes), index: face.info.index, tweak: Default::default() }))
+        Some(Arc::new(egui::FontData::from_blob(Arc::new(bytes), face.info.index)))
     })
     .clone()
 }
 
 /// Whether the craft-fonts build input (empty unless built with `CRAFT_FONTS_DIR`) supplies a
-/// Japanese interface font: some craft-fonts face covers [`JAPANESE_SAMPLE`]. `theme::install` adds
+/// Japanese interface font: some craft-fonts face covers `JAPANESE_SAMPLE`. `theme::install` adds
 /// these faces to every font family, so nothing else needs installing (and no system scan runs).
 pub fn craft_japanese_font() -> bool {
     filmcraft_text::fonts::craft_japanese().next().is_some()
@@ -348,21 +368,30 @@ pub fn korean_font_available() -> bool {
 mod tests {
     use super::*;
 
+    /// The catalog file of a language (none for English, the source language).
+    fn catalog_text(l: Language) -> Option<&'static str> {
+        match l {
+            Language::En => None,
+            Language::Ja => Some(include_str!("ja.tsv")),
+            Language::Es => Some(include_str!("es.tsv")),
+            Language::PtBr => Some(include_str!("pt-br.tsv")),
+            Language::Uk => Some(include_str!("uk.tsv")),
+            Language::ZhCn => Some(include_str!("zh-cn.tsv")),
+            Language::De => Some(include_str!("de.tsv")),
+            Language::Ru => Some(include_str!("ru.tsv")),
+            Language::Fr => Some(include_str!("fr.tsv")),
+            Language::Id => Some(include_str!("id.tsv")),
+            Language::It => Some(include_str!("it.tsv")),
+            Language::Ko => Some(include_str!("ko.tsv")),
+            Language::Sv => Some(include_str!("sv.tsv")),
+        }
+    }
+
     #[test]
     fn catalogs_are_well_formed() {
-        for (code, text) in [
-            ("es", include_str!("es.tsv")),
-            ("ja", include_str!("ja.tsv")),
-            ("pt-br", include_str!("pt-br.tsv")),
-            ("uk", include_str!("uk.tsv")),
-            ("zh-cn", include_str!("zh-cn.tsv")),
-            ("de", include_str!("de.tsv")),
-            ("ru", include_str!("ru.tsv")),
-            ("fr", include_str!("fr.tsv")),
-            ("id", include_str!("id.tsv")),
-            ("it", include_str!("it.tsv")),
-            ("ko", include_str!("ko.tsv")),
-        ] {
+        for l in Language::ALL {
+            let Some(text) = catalog_text(l) else { continue };
+            let code = l.code();
             let (entries, errors) = catalog::parse_entries(text);
             assert!(errors.is_empty(), "{code}: {errors:?}");
             for (i, (ctx, en, tr)) in entries.iter().enumerate() {
@@ -374,80 +403,55 @@ mod tests {
                 assert_eq!(en.ends_with('…'), tr.ends_with('…'), "{code}: ellipsis differs in {en:?} → {tr:?}");
             }
         }
-        assert_eq!(Language::Es.tr("File"), "Archivo");
-        assert_eq!(Language::Ja.tr("File"), "ファイル");
-        assert_eq!(Language::En.tr("File"), "File");
-        assert_eq!(Language::Es.tr("mi video.mp4"), "mi video.mp4");
-        assert_eq!(Language::Ja.tr("日本語の文書.pdf"), "日本語の文書.pdf");
-        assert_eq!(Language::parse("es"), Some(Language::Es));
-        assert_eq!(Language::parse("xx"), None);
-        assert_eq!(Language::PtBr.tr("File"), "Arquivo");
-        assert_eq!(Language::PtBr.tr("meu video.mp4"), "meu video.mp4");
-        assert_eq!(Language::PtBr.name(), "Português (Brasil)");
-        assert_eq!(Language::Uk.name(), "Українська");
-        assert_eq!(Language::Uk.tr("File"), "Файл");
-        assert_eq!(Language::Uk.tr("мій кліп.mp4"), "мій кліп.mp4");
-        assert_eq!(Language::Uk.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::ZhCn.name(), "简体中文");
-        assert_eq!(Language::ZhCn.tr("File"), "文件");
-        assert_eq!(Language::ZhCn.tr("我的视频.mp4"), "我的视频.mp4");
-        assert_eq!(Language::De.tr("File"), "Datei");
-        assert_eq!(Language::De.tr("Save As…"), "Speichern unter…");
-        assert_eq!(Language::De.tr("Größe ändern.mp4"), "Größe ändern.mp4");
-        assert_eq!(Language::De.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::De.name(), "Deutsch");
-        assert_eq!(Language::parse("de"), Some(Language::De));
-        assert_eq!(Language::parse("de-DE"), None, "the preference stores the bare code");
-        assert_eq!(Language::Ru.name(), "Русский");
-        assert_eq!(Language::Ru.tr("File"), "Файл");
-        assert_eq!(Language::Ru.tr("мой клип.mp4"), "мой клип.mp4");
-        assert_eq!(Language::Ru.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::Fr.name(), "Français");
-        assert_eq!(Language::Fr.tr("File"), "Fichier");
-        assert_eq!(Language::Fr.tr("Save As…"), "Enregistrer sous…");
-        assert_eq!(Language::Fr.tr("Montage d'été.mp4"), "Montage d'été.mp4");
-        assert_eq!(Language::Fr.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::parse("fr"), Some(Language::Fr));
-        assert_eq!(Language::parse("fr-FR"), None, "the preference stores the bare code");
-        assert_eq!(Language::Id.name(), "Bahasa Indonesia");
-        assert_eq!(Language::Id.tr("File"), "Berkas");
-        assert_eq!(Language::Id.tr("Save As…"), "Simpan Sebagai…");
-        assert_eq!(Language::Id.tr("Liburan keluarga.mp4"), "Liburan keluarga.mp4");
-        assert_eq!(Language::Id.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::parse("id"), Some(Language::Id));
-        assert_eq!(Language::parse("id-ID"), None, "the preference stores the bare code");
-        assert_eq!(Language::It.name(), "Italiano");
-        assert_eq!(Language::It.tr("File"), "File");
-        assert_eq!(Language::It.tr("Save As…"), "Salva con nome…");
-        assert_eq!(Language::It.tr("Vacanze d'estate.mp4"), "Vacanze d'estate.mp4");
-        assert_eq!(Language::It.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::parse("it"), Some(Language::It));
-        assert_eq!(Language::parse("it-IT"), None, "the preference stores the bare code");
-        assert_eq!(Language::Sv.name(), "Svenska");
-        assert_eq!(Language::Sv.tr("File"), "Arkiv");
-        assert_eq!(Language::Sv.tr("Save As…"), "Spara som…");
-        assert_eq!(Language::Sv.tr("Sommarlov på Gotland.mp4"), "Sommarlov på Gotland.mp4");
-        assert_eq!(Language::Sv.tr("An untranslated label"), "An untranslated label");
-        assert_eq!(Language::parse("sv"), Some(Language::Sv));
-        assert_eq!(Language::parse("sv-SE"), None, "the preference stores the bare code");
+    }
+
+    #[test]
+    fn unknown_strings_pass_through_and_languages_round_trip() {
         for l in Language::ALL {
+            for text in ["An untranslated label", "mi video.mp4", "日本語の文書.pdf", "Größe ändern.mp4", "Montage d'été.mp4"] {
+                assert_eq!(l.tr(text), text, "{}", l.code());
+            }
             assert_eq!(Language::parse(l.code()), Some(l));
             let json = serde_json::to_string(&l).unwrap();
             assert_eq!(json, format!("\"{}\"", l.code()));
             assert_eq!(serde_json::from_str::<Language>(&json).unwrap(), l);
         }
+        assert_eq!(Language::En.tr("File"), "File");
+        assert_eq!(Language::parse("xx"), None);
+        for code in ["de-DE", "fr-FR", "id-ID", "it-IT", "sv-SE"] {
+            assert_eq!(Language::parse(code), None, "the preference stores the bare code");
+        }
+        // language names are always shown in their own language
+        for (l, name) in [
+            (Language::PtBr, "Português (Brasil)"),
+            (Language::Uk, "Українська"),
+            (Language::ZhCn, "简体中文"),
+            (Language::De, "Deutsch"),
+            (Language::Ru, "Русский"),
+            (Language::Fr, "Français"),
+            (Language::Id, "Bahasa Indonesia"),
+            (Language::It, "Italiano"),
+            (Language::Ko, "한국어"),
+            (Language::Sv, "Svenska"),
+        ] {
+            assert_eq!(l.name(), name);
+        }
         assert_eq!(fmt("{b} y {a}", &[("a", "1"), ("b", "2")]), "2 y 1");
         assert_eq!(fmt("{a} {zz}", &[("a", "1")]), "1 {zz}");
     }
 
     #[test]
     fn the_current_language_is_per_thread() {
+        // any entry the Spanish catalog has
+        let (entries, _) = catalog::parse_entries(include_str!("es.tsv"));
+        let Some((_, en, es)) = entries.into_iter().find(|(ctx, en, es)| ctx.is_empty() && en != es) else { return };
         set_current(Language::Es);
-        assert_eq!((current(), t("File")), (Language::Es, "Archivo"));
+        assert_eq!((current(), t(&en)), (Language::Es, es.as_str()));
         // another thread (another test) still draws in English
-        assert_eq!(std::thread::spawn(|| t("File").to_string()).join().ok().as_deref(), Some("File"));
+        let source = en.clone();
+        assert_eq!(std::thread::spawn(move || t(&source).to_string()).join().ok(), Some(en.clone()));
         set_current(Language::En);
-        assert_eq!(t("File"), "File");
+        assert_eq!(t(&en), en);
     }
 
     #[test]
@@ -457,170 +461,75 @@ mod tests {
         assert_eq!(fmt("{missing} y {unfinished", &[]), "{missing} y {unfinished");
     }
 
+    /// A search for a language's label finds the item, and so does its English name.
     #[test]
-    fn searches_match_spanish_labels_and_english_names() {
-        set_current(Language::Es);
-        assert!(matches_query("Gaussian Blur", "desenfoque"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        assert!(matches_query("Selection Tool", &"SELECCIÓN".to_lowercase()));
-        assert!(!matches_query("Gaussian Blur", "selección"));
+    fn searches_match_translated_labels_and_english_names() {
+        for l in Language::ALL {
+            set_current(l);
+            let blur = l.tr("Gaussian Blur").to_lowercase();
+            let selection = l.tr("Selection Tool").to_lowercase();
+            assert!(matches_query("Gaussian Blur", &blur), "{}: {blur}", l.code());
+            assert!(matches_query("Gaussian Blur", "gaussian"), "{}", l.code());
+            assert!(matches_query("Selection Tool", &selection), "{}: {selection}", l.code());
+            assert!(!matches_query("Gaussian Blur", &selection), "{}: {selection}", l.code());
+        }
         set_current(Language::En);
     }
 
+    /// `tl!` and `tlf!` take plain string literals: the catalog scan (`tl_literals`) reads no other kind.
     #[test]
-    fn spanish_translates_every_menu_label() {
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let mut missing: Vec<String> = Vec::new();
-        let mut need = |text: &str| {
-            if translatable(text) && !Language::Es.has(text) && !missing.iter().any(|m| m == text) {
-                missing.push(text.to_string());
-            }
-        };
-        for top in crate::menus::MENUS {
-            need(top);
-        }
-        for it in crate::menus::menu_items(&app) {
-            need(&it.label);
-            for p in &it.path {
-                need(p);
-            }
-        }
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated menu labels: {missing:#?}");
-    }
-
-    /// The core menus every other catalog must cover: the entries of the menus-only Ukrainian
-    /// catalog, which `ukrainian_entries_cover_the_original_menu_catalog` keeps to menu labels (and
-    /// the native macOS Settings menu). Brazilian Portuguese played this role while it was
-    /// menus-only.
-    fn core_menu_labels() -> Vec<String> {
-        let (entries, _) = catalog::parse_entries(include_str!("uk.tsv"));
-        entries.into_iter().map(|(_, en, _)| en).collect()
-    }
-
-    /// Brazilian Portuguese covers the whole interface (the Spanish catalog's entries and the native
-    /// macOS Settings menu), but, like Japanese and French, the tests require only the menus, so
-    /// strings added later show in English until they are translated. Every entry must still have a
-    /// Spanish counterpart: a renamed or removed source would otherwise leave a dead entry.
-    #[test]
-    fn portuguese_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("pt-br.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "Portuguese entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let mut missing: Vec<String> = Vec::new();
-        let mut need = |text: &str| {
-            if translatable(text) && Language::Es.has(text) && !Language::PtBr.has(text) && !missing.iter().any(|m| m == text) {
-                missing.push(text.to_string());
-            }
-        };
-        for top in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            need(top);
-        }
-        for it in crate::menus::menu_items(&app) {
-            need(&it.label);
-            for p in &it.path {
-                need(p);
-            }
-        }
-        for en in core_menu_labels() {
-            need(&en);
-        }
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated Portuguese menu labels: {missing:#?}");
-        // beyond the menus: panels, effects and their parameters, settings, status messages
-        for (en, pt) in [
-            ("File", "Arquivo"),
-            ("Settings", "Preferências"),
-            ("Gaussian Blur", "Desfoque gaussiano"),
-            ("Audio Track Mixer", "Misturador de faixas de áudio"),
-            ("Keyboard Shortcuts", "Atalhos de teclado"),
-            ("Playhead", "Cursor de reprodução"),
-        ] {
-            assert_eq!(Language::PtBr.tr(en), pt);
-        }
-        set_current(Language::PtBr);
-        assert!(matches_query("Gaussian Blur", "desfoque"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        set_current(Language::En);
-    }
-
-    /// Every `tl!`/`tlf!` literal outside test modules has a Spanish translation.
-    #[test]
-    fn spanish_translates_every_tl_literal() {
-        let mut missing = Vec::new();
+    fn tl_literals_are_plain_strings() {
         for (path, text) in sources() {
-            for lit in tl_literals(&text) {
-                if !Language::Es.has(&lit) && !missing.contains(&lit) {
-                    missing.push(lit);
-                }
-            }
             assert!(!text.contains("tl!(r") && !text.contains("tlf!(r"), "{path}: use a plain string literal in tl! and tlf!");
         }
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated tl! strings: {missing:#?}");
     }
 
-    /// The Simplified Chinese catalog is complete: every menu label and every `tl!` literal.
-    #[test]
-    fn chinese_translates_every_menu_label_and_tl_literal() {
+    /// Every string the interface translates: menu labels and paths (the native macOS app menu
+    /// included), `tl!`/`tlf!` literals, and names translated through `i18n::t`.
+    fn interface_strings() -> Vec<String> {
         let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let mut missing: Vec<String> = Vec::new();
-        let mut need = |text: &str| {
-            if translatable(text) && !Language::ZhCn.has(text) && !missing.iter().any(|m| m == text) {
-                missing.push(text.to_string());
-            }
-        };
-        for top in crate::menus::MENUS {
-            need(top);
+        let mut out = Vec::new();
+        for top in crate::menus::MENUS.into_iter().chain(["Audio"]).chain(crate::menus::NATIVE_APP_MENU) {
+            push(&mut out, top);
         }
         for it in crate::menus::menu_items(&app) {
-            need(&it.label);
-            for p in &it.path {
-                need(p);
-            }
+            push(&mut out, &it.label);
+            it.path.iter().for_each(|p| push(&mut out, p));
         }
         for (_, text) in sources() {
-            for lit in tl_literals(&text) {
-                need(&lit);
-            }
+            tl_literals(&text).iter().for_each(|lit| push(&mut out, lit));
         }
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated Chinese strings: {missing:#?}");
+        dynamic_names().iter().for_each(|n| push(&mut out, n));
+        out
     }
 
-    /// The Japanese catalog is complete: every menu label, every `tl!` literal and every name the
-    /// interface translates through `i18n::t`.
+    /// The missing-translations report. It always passes: a string a catalog lacks shows in
+    /// English. `cargo xtask ci` runs it with `--nocapture` so the list shows in the gate log
+    /// (`cargo xtask i18n-report` runs it alone). Per language it lists the interface strings the
+    /// catalog lacks, then the catalog entries whose source the interface no longer has (renamed
+    /// or removed strings, or names this scan doesn't enumerate).
     #[test]
-    fn japanese_translates_every_menu_label_tl_literal_and_name() {
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let mut missing: Vec<String> = Vec::new();
-        let mut need = |text: &str| {
-            if translatable(text) && !Language::Ja.has(text) && !missing.iter().any(|m| m == text) {
-                missing.push(text.to_string());
+    fn missing_translations_report() {
+        let strings = interface_strings();
+        println!("Missing translations ({} interface strings; each shows in English):", strings.len());
+        for l in Language::ALL {
+            let Some(text) = catalog_text(l) else { continue };
+            let code = l.code();
+            let mut missing: Vec<&str> = strings.iter().map(String::as_str).filter(|s| !l.has(s)).collect();
+            missing.sort_unstable();
+            println!("{code}: {} missing", missing.len());
+            for s in missing {
+                println!("  {code}: {s:?}");
             }
-        };
-        for top in crate::menus::MENUS {
-            need(top);
-        }
-        for it in crate::menus::menu_items(&app) {
-            need(&it.label);
-            for p in &it.path {
-                need(p);
+            let (entries, _) = catalog::parse_entries(text);
+            let unused: Vec<_> = entries.iter().filter(|(_, en, _)| translatable(en) && !strings.contains(en)).collect();
+            if !unused.is_empty() {
+                println!("{code}: {} entries without a source", unused.len());
+                for (ctx, en, _) in unused {
+                    println!("  {code}: {ctx:?} {en:?}");
+                }
             }
         }
-        for (_, text) in sources() {
-            for lit in tl_literals(&text) {
-                need(&lit);
-            }
-        }
-        for name in dynamic_names() {
-            need(&name);
-        }
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated Japanese strings: {missing:#?}");
     }
 
     /// Chinese switches and persists like the other languages when a Chinese face is available,
@@ -888,13 +797,6 @@ mod tests {
         out
     }
 
-    #[test]
-    fn spanish_translates_dynamic_names() {
-        let mut missing: Vec<String> = dynamic_names().into_iter().filter(|n| !Language::Es.has(n)).collect();
-        missing.sort();
-        assert!(missing.is_empty(), "untranslated names: {missing:#?}");
-    }
-
     #[test]
     fn tl_literals_are_found_and_unescaped() {
         let src = "a(tl!(\"Save\")); b(tl!(\"Say \\\"hi\\\"\\n\")); tl!(x); tlf!(\"{n} file(s)\", n);";
@@ -949,7 +851,7 @@ mod tests {
         // the menus are drawn in German, the language names in their own language
         let items = crate::menus::menu_items(&app);
         let label = |id: &str| items.iter().find(|it| it.id == id).map(|it| it.label.as_str());
-        assert_eq!(label("file.saveAs"), Some("Speichern unter…"));
+        assert_eq!(label("file.saveAs"), Some(Language::De.tr("Save As…")));
         assert_eq!(label("app.language.spanish"), Some("Español"));
         let saved = serde_json::to_string(&app.ui).unwrap();
         assert!(saved.contains("\"language\":\"de\""), "{saved}");
@@ -968,7 +870,7 @@ mod tests {
         }
         let items = crate::menus::menu_items(&app);
         let label = |id: &str| items.iter().find(|it| it.id == id).map(|it| it.label.as_str());
-        assert_eq!(label("file.saveAs"), Some("Enregistrer sous…"));
+        assert_eq!(label("file.saveAs"), Some(Language::Fr.tr("Save As…")));
         assert_eq!(label("app.language.german"), Some("Deutsch"));
         let saved = serde_json::to_string(&app.ui).unwrap();
         assert!(saved.contains("\"language\":\"fr\""), "{saved}");
@@ -985,7 +887,7 @@ mod tests {
         }
         let items = crate::menus::menu_items(&app);
         let label = |id: &str| items.iter().find(|it| it.id == id).map(|it| it.label.as_str());
-        assert_eq!(label("file.saveAs"), Some("Simpan Sebagai…"));
+        assert_eq!(label("file.saveAs"), Some(Language::Id.tr("Save As…")));
         assert_eq!(label("app.language.french"), Some("Français"));
         assert_eq!(label("app.language.indonesian"), Some("Bahasa Indonesia"));
         let saved = serde_json::to_string(&app.ui).unwrap();
@@ -1003,7 +905,7 @@ mod tests {
         }
         let items = crate::menus::menu_items(&app);
         let label = |id: &str| items.iter().find(|it| it.id == id).map(|it| it.label.as_str());
-        assert_eq!(label("file.saveAs"), Some("Salva con nome…"));
+        assert_eq!(label("file.saveAs"), Some(Language::It.tr("Save As…")));
         assert_eq!(label("app.language.indonesian"), Some("Bahasa Indonesia"));
         assert_eq!(label("app.language.italian"), Some("Italiano"));
         let saved = serde_json::to_string(&app.ui).unwrap();
@@ -1072,6 +974,9 @@ mod tests {
             assert_eq!(l(&[tag]), Language::It, "{tag}");
         }
         assert_eq!(l(&["it-CH", "de-CH", "fr-CH", "en"]), Language::It);
+        for tag in ["ko", "ko-KR", "ko_KR.UTF-8"] {
+            assert_eq!(l(&[tag]), Language::Ko, "{tag}");
+        }
         for none in [&["ita"][..], &["i"], &["-it"]] {
             assert_eq!(l(none), Language::En, "{none:?}");
         }
@@ -1129,216 +1034,6 @@ mod tests {
         set_current(Language::En);
     }
 
-    #[test]
-    fn ukrainian_entries_cover_the_original_menu_catalog() {
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let items = crate::menus::menu_items(&app);
-        let known = |text: &str| crate::menus::MENUS.contains(&text) || items.iter().any(|it| it.label == text || it.path.iter().any(|p| p == text));
-        let (entries, _) = catalog::parse_entries(include_str!("uk.tsv"));
-        for (_, en, _) in entries {
-            assert!(known(&en) || en == "Settings", "not a menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert_ne!(Language::Uk.tr(en), en, "untranslated Ukrainian menu: {en}");
-        }
-    }
-
-    /// German covers at least the core menus (`core_menu_labels`, the top-level menus and the native
-    /// macOS app menu); every entry must still be a menu label.
-    #[test]
-    fn german_entries_cover_the_original_menu_catalog() {
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let items = crate::menus::menu_items(&app);
-        let known = |text: &str| crate::menus::MENUS.contains(&text) || items.iter().any(|it| it.label == text || it.path.iter().any(|p| p == text));
-        let (entries, _) = catalog::parse_entries(include_str!("de.tsv"));
-        for (_, en, _) in entries {
-            assert!(known(&en) || crate::menus::NATIVE_APP_MENU.contains(&en.as_str()), "not a menu label: {en}");
-        }
-        for en in core_menu_labels() {
-            assert!(Language::De.has(&en), "missing German menu label: {en}");
-        }
-        // "Clip" and "Audio" are the same word in German, so check for an entry, not a change
-        for en in crate::menus::MENUS.into_iter().chain(["Audio"]).chain(crate::menus::NATIVE_APP_MENU) {
-            assert!(Language::De.has(en), "untranslated German menu: {en}");
-        }
-        assert_eq!(Language::De.tr("Settings"), "Voreinstellungen");
-        assert_eq!(Language::De.tr("Quit FilmCraft"), "FilmCraft beenden");
-    }
-
-    /// French covers the whole interface (the Spanish catalog's entries and the native macOS
-    /// Settings menu), but, like Japanese, the tests require only the core menus, so strings added
-    /// later show in English until they are translated. Every entry must still have a Spanish
-    /// counterpart: a renamed or removed source would otherwise leave a dead French entry.
-    #[test]
-    fn french_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("fr.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "French entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        for en in core_menu_labels() {
-            assert!(Language::Fr.has(&en), "missing French menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert!(Language::Fr.has(en), "untranslated French menu: {en}");
-        }
-        // beyond the menus: panels, effects and their parameters, settings, status messages
-        for (en, fr) in
-            [("Settings", "Préférences"), ("Gaussian Blur", "Flou gaussien"), ("Audio Track Mixer", "Mixeur de pistes audio"), ("Sequence", "Séquence")]
-        {
-            assert_eq!(Language::Fr.tr(en), fr);
-        }
-        set_current(Language::Fr);
-        assert!(matches_query("Gaussian Blur", "flou"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        set_current(Language::En);
-    }
-
-    /// Korean covers the whole interface (the Spanish catalog's entries and the native macOS
-    /// Settings menu); like French, the tests require the core menus, and every entry must still
-    /// have a Spanish counterpart so a renamed or removed source can't leave a dead Korean entry.
-    #[test]
-    fn korean_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("ko.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "Korean entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        for en in core_menu_labels() {
-            assert!(Language::Ko.has(&en), "missing Korean menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert!(Language::Ko.has(en), "untranslated Korean menu: {en}");
-        }
-        for (en, ko) in [("File", "파일"), ("Edit", "편집"), ("Sequence", "시퀀스"), ("Settings", "설정")] {
-            assert_eq!(Language::Ko.tr(en), ko);
-        }
-        assert_eq!(Language::Ko.name(), "한국어");
-        assert_eq!(Language::parse("ko"), Some(Language::Ko));
-        for tag in ["ko", "ko-KR", "ko_KR.UTF-8"] {
-            assert_eq!(Language::from_locales(&[tag.to_string()]), Language::Ko, "{tag}");
-        }
-    }
-
-    #[test]
-    fn russian_entries_cover_the_original_menu_catalog() {
-        let app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
-        let items = crate::menus::menu_items(&app);
-        let known = |text: &str| crate::menus::MENUS.contains(&text) || items.iter().any(|it| it.label == text || it.path.iter().any(|p| p == text));
-        let (entries, _) = catalog::parse_entries(include_str!("ru.tsv"));
-        for (_, en, _) in entries {
-            assert!(known(&en) || en == "Settings", "not a menu label: {en}");
-        }
-        for en in core_menu_labels() {
-            assert!(Language::Ru.has(&en), "missing Russian menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert_ne!(Language::Ru.tr(en), en, "untranslated Russian menu: {en}");
-        }
-    }
-
-    /// Indonesian covers the whole interface (the Spanish catalog's entries and the native macOS
-    /// Settings menu), but, like Japanese and French, the tests require only the core menus (the
-    /// menus-only Ukrainian catalog, the top-level menus and the native macOS Settings menu), so
-    /// strings added later show in English until they are translated. Every entry must still have a
-    /// Spanish counterpart: a renamed or removed source would otherwise leave a dead entry.
-    #[test]
-    fn indonesian_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("id.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "Indonesian entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        let (core, _) = catalog::parse_entries(include_str!("uk.tsv"));
-        for (_, en, _) in core {
-            assert!(Language::Id.has(&en), "missing Indonesian menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert!(Language::Id.has(en), "untranslated Indonesian menu: {en}");
-        }
-        // beyond the menus: panels, effects and their parameters, settings, status messages
-        for (en, id) in [
-            ("Settings", "Preferensi"),
-            ("Gaussian Blur", "Buram Gaussian"),
-            ("Audio Track Mixer", "Mixer Trek Audio"),
-            ("Sequence", "Sekuens"),
-            ("Playhead", "Kepala Putar"),
-        ] {
-            assert_eq!(Language::Id.tr(en), id);
-        }
-        set_current(Language::Id);
-        assert!(matches_query("Gaussian Blur", "buram"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        set_current(Language::En);
-    }
-
-    /// Italian covers the whole interface (the Spanish catalog's entries and the native macOS
-    /// Settings menu); like Indonesian, the tests require only the core menus, so strings added
-    /// later show in English until they are translated, and every entry must have a Spanish
-    /// counterpart.
-    #[test]
-    fn italian_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("it.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "Italian entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        let (core, _) = catalog::parse_entries(include_str!("uk.tsv"));
-        for (_, en, _) in core {
-            assert!(Language::It.has(&en), "missing Italian menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert!(Language::It.has(en), "untranslated Italian menu: {en}");
-        }
-        // beyond the menus: panels, effects and their parameters, settings, status messages
-        for (en, it) in [
-            ("Settings", "Impostazioni"),
-            ("Gaussian Blur", "Sfocatura gaussiana"),
-            ("Audio Track Mixer", "Mixer tracce audio"),
-            ("Sequence", "Sequenza"),
-            ("Playhead", "Indicatore di riproduzione"),
-        ] {
-            assert_eq!(Language::It.tr(en), it);
-        }
-        set_current(Language::It);
-        assert!(matches_query("Gaussian Blur", "sfocatura"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        set_current(Language::En);
-    }
-
-    /// Swedish covers the whole interface (the Spanish catalog's entries and the native macOS
-    /// Settings menu); like Italian, the tests require only the core menus, so strings added later
-    /// show in English until they are translated, and every entry must have a Spanish counterpart.
-    #[test]
-    fn swedish_covers_the_menus_and_has_no_dead_entries() {
-        let (entries, errors) = catalog::parse_entries(include_str!("sv.tsv"));
-        assert!(errors.is_empty(), "{errors:?}");
-        for (ctx, en, _) in &entries {
-            assert!(ctx.is_empty() && (Language::Es.has(en) || en == "Settings"), "Swedish entry without a Spanish one: {ctx:?} {en:?}");
-        }
-        let (core, _) = catalog::parse_entries(include_str!("uk.tsv"));
-        for (_, en, _) in core {
-            assert!(Language::Sv.has(&en), "missing Swedish menu label: {en}");
-        }
-        for en in crate::menus::MENUS.into_iter().chain(["Audio", "Settings"]) {
-            assert!(Language::Sv.has(en), "untranslated Swedish menu: {en}");
-        }
-        // beyond the menus: panels, effects and their parameters, settings, status messages
-        for (en, sv) in [
-            ("Settings", "Inställningar"),
-            ("Gaussian Blur", "Gaussisk oskärpa"),
-            ("Audio Track Mixer", "Ljudspårsmixer"),
-            ("Sequence", "Sekvens"),
-            ("Playhead", "Spelmarkör"),
-        ] {
-            assert_eq!(Language::Sv.tr(en), sv);
-        }
-        set_current(Language::Sv);
-        assert!(matches_query("Gaussian Blur", "oskärpa"));
-        assert!(matches_query("Gaussian Blur", "gaussian"));
-        set_current(Language::En);
-    }
-
     /// Every non-ASCII character of `text` renders with the bundled interface fonts, in every family.
     fn assert_bundled_fonts_cover(text: impl Iterator<Item = char>) {
         let ctx = egui::Context::default();
@@ -1391,6 +1086,16 @@ mod tests {
         assert_bundled_fonts_cover(alphabet.chars().chain(Language::Fr.name().chars()).chain(letters));
     }
 
+    #[test]
+    fn german_renders_with_bundled_fonts() {
+        let (entries, _) = catalog::parse_entries(include_str!("de.tsv"));
+        // every German letter and quotation mark, even ones no entry uses yet, and every letter,
+        // dash and ellipsis the entries use (symbols such as ✔ come from the English sources)
+        let alphabet = "ÄÖÜäöüß„“‚‘";
+        let letters = entries.iter().flat_map(|(_, _, de)| de.chars()).filter(|ch| ch.is_alphabetic() || "„“‚‘–—…".contains(*ch));
+        assert_bundled_fonts_cover(alphabet.chars().chain(Language::De.name().chars()).chain(letters));
+    }
+
     #[test]
     fn indonesian_renders_with_bundled_fonts() {
         let (entries, _) = catalog::parse_entries(include_str!("id.tsv"));
@@ -1440,9 +1145,11 @@ mod tests {
         output.textures_delta.clear();
         ctx.fonts_mut(|fonts| {
             // every theme family falls back to the craft-fonts (when built with them; no system
-            // font is added then) or to the system Japanese font
+            // font is added then) or to the system Japanese font. Installed right-to-left faces
+            // (`rtl::install`) come after every other fallback by design, so they are left out.
             for family in crate::theme::font_families() {
-                let stack = fonts.definitions().families.get(&family).cloned().unwrap_or_default();
+                let mut stack = fonts.definitions().families.get(&family).cloned().unwrap_or_default();
+                stack.retain(|n| !crate::rtl::is_system_face(n));
                 if craft {
                     assert!(stack.last().is_some_and(|n| n.starts_with("craft:")), "{family:?}: {stack:?}");
                     assert!(!stack.iter().any(|n| n == JAPANESE_FONT), "{family:?}: {stack:?}");
@@ -1463,3 +1170,20 @@ mod tests {
         });
     }
 }
+
+#[cfg(test)]
+mod bcp47_tests {
+    use super::Language;
+
+    /// Protocol-facing BCP 47 tags use `pt-BR`/`zh-CN`; every tag is non-empty ASCII.
+    #[test]
+    fn accesskit_tags_use_protocol_spelling() {
+        assert_eq!(Language::En.bcp47(), "en");
+        assert_eq!(Language::PtBr.bcp47(), "pt-BR");
+        assert_eq!(Language::ZhCn.bcp47(), "zh-CN");
+        for language in Language::ALL {
+            let tag = language.bcp47();
+            assert!(!tag.is_empty() && tag.is_ascii(), "{tag:?}");
+        }
+    }
+}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index aeb0e0691..ea7642c52 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -323,6 +323,7 @@
 	Show Active Caption Tracks Only	Mostrar apenas faixas de legendas ativas
 	Show All Caption Tracks	Mostrar todas as faixas de legendas
 	Show All Marker Colors	Mostrar todas as cores de marcador
+	Show Duplicate Frame Markers	Mostrar marcadores de quadros duplicados
 	Show Guides	Mostrar guias
 	Show Rulers	Mostrar réguas
 	Show Through Edits	Mostrar edições contíguas
@@ -1268,6 +1269,7 @@
 	59.94 fps Non Drop-Frame	59,94 fps sem drop-frame
 	ASC CDL	ASC CDL
 	Accessible color contrast	Contraste de cores acessível
+	Animate zoom, scrolling and menus	Animar zoom, rolagem e menus
 	Action-Safe Margin	Margem de segurança de ação
 	Active Monitor	Monitor ativo
 	Add	Adicionar
@@ -3450,8 +3452,8 @@
 	Commits	Commits
 	% of all commits	% de todos os commits
 	Lines +/−	Linhas +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	A saída de áudio falhou: reproduzindo sem som (verifique Preferências ▸ Hardware de áudio)
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	A saída de áudio não está respondendo: reproduzindo sem som (verifique Preferências ▸ Hardware de áudio)
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	A saída de áudio falhou: reproduzindo sem som (verifique Preferências > Hardware de áudio)
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	A saída de áudio não está respondendo: reproduzindo sem som (verifique Preferências > Hardware de áudio)
 	Clip Speed / Duration	Velocidade/duração do clipe
 	Speed:	Velocidade:
 	Reverse Speed	Inverter velocidade
@@ -3578,3 +3580,9 @@
 
 # The native macOS application menu (Settings…).
 	Settings	Preferências
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	Redefinir zoom da interface
+	Track Color	Cor da trilha
+	Open a sequence to search its graphics	Abra uma sequência para pesquisar nos gráficos dela
+	No text graphics in this sequence. Add text with the Type tool.	Esta sequência não tem gráficos com texto. Adicione texto com a ferramenta Texto.
+	No matching text.	Nenhum texto corresponde.
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 08bf8c076..a0c4e2494 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -310,6 +310,7 @@
 	Show Active Caption Tracks Only	Показать только активные дорожки субтитров
 	Show All Caption Tracks	Показать все дорожки субтитров
 	Show All Marker Colors	Показать все цвета маркеров
+	Show Duplicate Frame Markers	Показать маркеры повторяющихся кадров
 	Show Guides	Показать направляющие
 	Show Rulers	Показать линейки
 	Show Through Edits	Показать сквозные склейки
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 99033017b..c2f119d21 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -311,6 +311,7 @@
 	Show Active Caption Tracks Only	Показати лише активні доріжки субтитрів
 	Show All Caption Tracks	Показати всі доріжки субтитрів
 	Show All Marker Colors	Показати всі кольори маркерів
+	Show Duplicate Frame Markers	Показати маркери повторюваних кадрів
 	Show Guides	Показати напрямні
 	Show Rulers	Показати лінійки
 	Show Through Edits	Показати розрізи без зміни кадру
diff --git a/crates/ui-egui/src/i18n/zh-cn.tsv b/crates/ui-egui/src/i18n/zh-cn.tsv
index 066279eef..dc3ee65ef 100644
--- a/crates/ui-egui/src/i18n/zh-cn.tsv
+++ b/crates/ui-egui/src/i18n/zh-cn.tsv
@@ -164,6 +164,9 @@
 	Hide All Caption Tracks	隐藏所有字幕轨道
 	High Quality Playback	高质量播放
 	History	历史记录
+	Delete Redoable Actions	删除可重做的操作
+	Clear History	清除历史记录
+	Delete the dimmed actions after the current state? They cannot be redone.	删除当前状态之后显示为灰色的操作？删除后将无法重做。
 	Import From	导入来源
 	Import Image Sequence…	导入图像序列…
 	Import from Media Browser	从媒体浏览器导入
@@ -314,6 +317,7 @@
 	Show Active Caption Tracks Only	仅显示活动字幕轨道
 	Show All Caption Tracks	显示所有字幕轨道
 	Show All Marker Colors	显示所有标记颜色
+	Show Duplicate Frame Markers	显示重复帧标记
 	Show Guides	显示参考线
 	Show Rulers	显示标尺
 	Show Through Edits	显示贯通编辑
@@ -339,6 +343,7 @@
 	Transcribe Sequence…	转录序列…
 	Transcribe…	转录…
 	Transcript	转录文稿
+	Transparency Grid	透明网格
 	Transparent Video…	透明视频…
 	Trim Edit	修剪编辑
 	Trim…	修剪…
@@ -499,6 +504,10 @@
 	Reveal Sequence in Project	在项目面板中显示序列
 	Video Thumbnails	视频缩略图
 	Audio Waveforms	音频波形
+	Work Area Bar	工作区域栏
+	Start: {tc}	开始：{tc}
+	End: {tc}	结束：{tc}
+	Duration: {tc}	持续时间：{tc}
 	Delete Preset	删除预设
 	Export Preset…	导出预设…
 	Import Presets…	导入预设…
@@ -1254,6 +1263,7 @@
 	59.94 fps Non Drop-Frame	59.94 fps 非掉帧
 	ASC CDL	ASC CDL
 	Accessible color contrast	无障碍颜色对比度
+	Animate zoom, scrolling and menus	缩放、滚动和菜单使用动画
 	Action-Safe Margin	动作安全边距
 	Active Monitor	活动监视器
 	Add	添加
@@ -3436,8 +3446,8 @@
 	Commits	提交
 	% of all commits	占全部提交的比例
 	Lines +/−	代码行 +/−
-	Audio output failed: playing without sound (check Settings ▸ Audio Hardware)	音频输出失败：无声播放（请检查设置 ▸ 音频硬件）
-	Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)	音频输出无响应：无声播放（请检查设置 ▸ 音频硬件）
+	Audio output failed: playing without sound (check Settings > Audio Hardware)	音频输出失败：无声播放（请检查设置 > 音频硬件）
+	Audio output is not responding: playing without sound (check Settings > Audio Hardware)	音频输出无响应：无声播放（请检查设置 > 音频硬件）
 	Clip Speed / Duration	剪辑速度 / 时长
 	Speed:	速度：
 	Reverse Speed	反转速度
@@ -3585,3 +3595,11 @@
 	Shows the version, community links and credits in a FilmCraft window.	在 FilmCraft 窗口中显示版本、社区链接和致谢。
 	Couldn't open your web browser	无法打开网页浏览器
 	Open this address in your browser yourself:	请自行在浏览器中打开此地址：
+# View > Reset Interface Zoom (#2253).
+	Reset Interface Zoom	重置界面缩放
+	Track Color	轨道颜色
+	Open a sequence to search its graphics	打开序列以搜索其中的图形
+	No text graphics in this sequence. Add text with the Type tool.	此序列中没有文本图形。请用文字工具添加文本。
+	No matching text.	没有匹配的文本。
+	H.265 (HEVC) needs a hardware encoder (NVENC on NVIDIA GPUs, VideoToolbox on macOS); none was found on this machine, and FilmCraft has no software H.265 encoder yet. Choose H.264 or ProRes instead.	H.265 (HEVC) 需要硬件编码器（NVIDIA GPU 上的 NVENC、macOS 上的 VideoToolbox）；本机未找到，且 FilmCraft 尚无软件 H.265 编码器。请改选 H.264 或 ProRes。
+	AV1 needs a hardware encoder; none was found on this machine, and FilmCraft has no software AV1 encoder yet.	AV1 需要硬件编码器；本机未找到，且 FilmCraft 尚无软件 AV1 编码器。
diff --git a/crates/ui-egui/src/ime_reset.rs b/crates/ui-egui/src/ime_reset.rs
new file mode 100644
index 000000000..ec1e2336d
--- /dev/null
+++ b/crates/ui-egui/src/ime_reset.rs
@@ -0,0 +1,556 @@
+//! Ordered admission for the Program monitor's interrupted input method.
+//!
+//! A reset request is not an acknowledgement. Geometry/focus/output loss retires the local
+//! token, and a later actual custom descriptor requests a fresh fence even for the same caret.
+
+use std::sync::Arc;
+
+use egui::{Context, IMEPurpose, Id, ImeResetId, ImeTarget, ViewportId, ViewportIdMap};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Destination {
+    pub document: u64,
+    pub target: ImeTarget,
+    pub caret: usize,
+    pub anchor: usize,
+    pub text: u64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct OutputContext {
+    pub owner: Id,
+    pub generation: u64,
+    pub purpose: IMEPurpose,
+}
+
+impl OutputContext {
+    /// Snapshot the owner/generation/purpose triple that identifies one published custom IME
+    /// output.
+    pub(crate) fn of(ime: &egui::output::IMEOutput) -> Self {
+        Self { owner: ime.owner, generation: ime.context_generation, purpose: ime.purpose }
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+enum Phase {
+    NeedsRequest,
+    Awaiting(ImeResetId),
+    Suspended,
+    AllocationFailed,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct Pending {
+    // The retired composition is separate from the current destination (A -> B releases B).
+    origin: ImeTarget,
+    destination: Option<Destination>,
+    output: Option<OutputContext>,
+    phase: Phase,
+}
+
+#[derive(Default)]
+pub(crate) struct State {
+    pending: ViewportIdMap<Pending>,
+    incoming: ViewportIdMap<Destination>,
+    completed_origin: ViewportIdMap<ImeTarget>,
+    pub viewport: ViewportId,
+    custom_output: Option<OutputContext>,
+}
+
+impl State {
+    /// Start a pass for `ctx`'s viewport and clear the per-pass published-output record, so
+    /// `finish` cannot mistake a previous pass's descriptor for this pass's.
+    pub(crate) fn begin_pass(&mut self, ctx: &Context) {
+        self.viewport = ctx.viewport_id();
+        self.custom_output = None;
+    }
+
+    /// Whether a reset fence still guards `viewport`. While blocked, IME input for the custom
+    /// editor must not be admitted.
+    pub(crate) fn blocked(&self, viewport: ViewportId) -> bool {
+        self.pending.contains_key(&viewport)
+    }
+
+    /// The composition target being retired for `viewport`: the pending origin, or the last
+    /// completed origin until `terminal` clears it.
+    pub(crate) fn origin(&self, viewport: ViewportId) -> Option<ImeTarget> {
+        self.pending.get(&viewport).map(|p| p.origin).or_else(|| self.completed_origin.get(&viewport).copied())
+    }
+
+    /// Whether `destination` differs from the last one remembered for `viewport`; false when
+    /// nothing has been remembered yet.
+    pub(crate) fn incoming_changed(&self, viewport: ViewportId, destination: Destination) -> bool {
+        self.incoming.get(&viewport).is_some_and(|old| *old != destination)
+    }
+
+    /// Record the latest destination for `viewport`, so the next event can distinguish a real
+    /// target change from repeated observation of the same target.
+    pub(crate) fn remember(&mut self, viewport: ViewportId, destination: Destination) {
+        self.incoming.insert(viewport, destination);
+    }
+
+    /// Acknowledge a terminal IME event for `viewport`: forget the incoming destination and
+    /// completed origin so stale targets cannot be reused.
+    pub(crate) fn terminal(&mut self, viewport: ViewportId) {
+        self.incoming.remove(&viewport);
+        self.completed_origin.remove(&viewport);
+    }
+
+    /// Context-less commands retire an obsolete ID synchronously. Repeated unchanged
+    /// reconciliation is inert; the next live local destination flushes NeedsRequest.
+    pub(crate) fn interrupt(&mut self, origin: ImeTarget, destination: Option<Destination>) {
+        let viewport = self.viewport;
+        if let Some(pending) = self.pending.get_mut(&viewport) {
+            if pending.destination != destination {
+                pending.destination = destination;
+                // An unavailable route cannot be rearmed by reconciliation or a control.
+                // Only the actual eligible final descriptor may leave Suspended.
+                if !matches!(pending.phase, Phase::Suspended) {
+                    pending.phase = Phase::NeedsRequest;
+                }
+            }
+        } else {
+            self.pending.insert(viewport, Pending { origin, destination, output: None, phase: Phase::NeedsRequest });
+        }
+    }
+
+    /// Move a pending fence to `Suspended` and drop its old output binding. Only an actually
+    /// eligible final descriptor in `finish` may rearm it; `sync`/`interrupt` reconciliation cannot.
+    pub(crate) fn suspend(&mut self, viewport: ViewportId) {
+        if let Some(pending) = self.pending.get_mut(&viewport) {
+            pending.phase = Phase::Suspended;
+            pending.output = None;
+        }
+    }
+
+    /// Whether the custom output published in this pass is the one recorded by `produced`.
+    /// False when no custom output was produced in this pass.
+    pub(crate) fn owns_output(&self, ctx: &Context) -> bool {
+        self.custom_output.is_some() && ctx.output(|out| out.ime.as_ref().map(OutputContext::of)) == self.custom_output
+    }
+
+    /// Allocate a reset fence for the current viewport after clearing the previous fence's
+    /// output binding. Allocation failure leaves the phase `AllocationFailed`, which still
+    /// blocks input; a later real destination change can request again.
+    fn request(ctx: &Context, pending: &mut Pending) {
+        // A new fence invalidates any output context bound to the previous fence. Clearing it
+        // also lets `finish` recognize this request as already made in this pass, even when an
+        // earlier pass had bound a different descriptor to the old destination.
+        pending.output = None;
+        pending.phase = ctx.request_ime_reset(ctx.viewport_id()).map_or(Phase::AllocationFailed, Phase::Awaiting);
+    }
+
+    /// Must run with the live local ed/text before EACH raw event, never a staged engine copy.
+    pub(crate) fn sync(&mut self, ctx: &Context, destination: Destination) {
+        let Some(pending) = self.pending.get_mut(&ctx.viewport_id()) else { return };
+        let changed = pending.destination != Some(destination);
+        pending.destination = Some(destination);
+        // A suspended route cannot admit events until an actual eligible output rearms it.
+        if !matches!(pending.phase, Phase::Suspended) && (changed || matches!(pending.phase, Phase::NeedsRequest)) {
+            Self::request(ctx, pending);
+        }
+    }
+
+    /// Validate a completion token and release the viewport's guard. The token must belong to
+    /// this viewport and equal the current `Awaiting` id, and `destination` must equal the
+    /// pending destination; `ctx.output` is deliberately not consulted because raw events run
+    /// before this pass publishes its descriptor. Any mismatch returns false and keeps the
+    /// guard. Success records the origin and destination for the next observation.
+    pub(crate) fn complete(&mut self, ctx: &Context, id: ImeResetId, destination: Destination) -> bool {
+        let viewport = ctx.viewport_id();
+        let Some(pending) = self.pending.get(&viewport).copied() else { return false };
+        // The opaque token is necessary but not sufficient: the destination carries the owner
+        // and replacement epoch, Film publishes only `IMEPurpose::Normal`, and a generation,
+        // purpose or focus transition supersedes or suspends this guard before it can be rearmed. Do not read
+        // `ctx.output` here: raw events are processed before this pass has published its custom
+        // descriptor, so that would compare against an empty or stale output. The reducer test
+        // `changed_output_context_supersedes_and_allocation_failure_stays_blocked` binds a token
+        // to one live owner/generation/purpose by rejecting it after each transition.
+        if id.viewport_id() != viewport || pending.destination != Some(destination) || !matches!(pending.phase, Phase::Awaiting(current) if current == id) {
+            return false;
+        }
+        self.pending.remove(&viewport);
+        self.completed_origin.insert(viewport, pending.origin);
+        self.remember(viewport, destination);
+        true
+    }
+
+    /// Record the custom output descriptor published in this pass, for `finish` and
+    /// `owns_output` to compare against the actual output.
+    pub(crate) fn produced(&mut self, key: OutputContext) {
+        self.custom_output = Some(key);
+    }
+
+    /// Actual custom eligibility and actual final app output are independent facts. Never
+    /// overwrite a stock field or infer native completion from a descriptor/publication.
+    pub(crate) fn finish(&mut self, ctx: &Context, destination: Option<Destination>, eligible: bool) {
+        let actual = ctx.output(|out| out.ime.as_ref().map(OutputContext::of));
+        let custom = self.custom_output.filter(|custom| eligible && actual == Some(*custom));
+        self.settle(ctx, destination.filter(|_| custom.is_some()), custom);
+    }
+
+    /// [`Self::finish`] for a native floating window, whose descriptor docking publishes after
+    /// this call: `destination` is the eligible editor's, and `output` the identity the window
+    /// published in its previous pass ([`published`]). `None` there is a context that starts in
+    /// this pass, whose identity is not known yet: the fence waits for the next pass.
+    pub(crate) fn finish_window(&mut self, ctx: &Context, destination: Option<Destination>, output: Option<OutputContext>) {
+        if destination.is_some() && output.is_none() {
+            return;
+        }
+        self.settle(ctx, destination, output);
+    }
+
+    /// Bind or rearm the viewport's fence for the eligible `destination` and its published
+    /// `custom` output, or suspend it when there is no eligible destination.
+    fn settle(&mut self, ctx: &Context, destination: Option<Destination>, custom: Option<OutputContext>) {
+        let viewport = ctx.viewport_id();
+        let Some(pending) = self.pending.get_mut(&viewport) else { return };
+        let Some(destination) = destination else {
+            self.suspend(viewport);
+            return;
+        };
+        let changed = pending.destination != Some(destination) || pending.output != custom;
+        let activate = matches!(pending.phase, Phase::Suspended | Phase::NeedsRequest);
+        // `sync` may already have requested this pass, while `finish` is the first place the
+        // actual custom output context is known. Bind that same request to the descriptor instead
+        // of allocating a second, silently superseded ID for the same destination transition.
+        let requested_by_sync = matches!(pending.phase, Phase::Awaiting(_)) && pending.output.is_none();
+        pending.destination = Some(destination);
+        if activate || (changed && !requested_by_sync) {
+            Self::request(ctx, pending);
+        }
+        // A request clears the previous fence's binding. Bind the confirmed descriptor only
+        // after requesting, so the next pass compares against this output rather than mistaking
+        // an earlier pass's unbound request for a same-pass sync request.
+        pending.output = custom;
+    }
+
+    /// Forget all reset state for a closed viewport: pending fence, incoming destination and
+    /// completed origin.
+    pub(crate) fn end_viewport(&mut self, viewport: ViewportId) {
+        self.pending.remove(&viewport);
+        self.incoming.remove(&viewport);
+        self.completed_origin.remove(&viewport);
+    }
+}
+
+/// Temp-data key marking whether `viewport` is inside a UI pass rather than a hidden logic
+/// callback.
+fn mode_id(viewport: ViewportId) -> Id {
+    Id::unique(("filmcraft-ime-reset-ui-pass", viewport))
+}
+
+/// Whether the current callback is a UI pass (between the installed begin/end-pass hooks)
+/// for this viewport, rather than `run_logic`. Defaults to false when no hook ran.
+pub(crate) fn in_ui_pass(ctx: &Context) -> bool {
+    ctx.data(|data| data.get_temp::<bool>(mode_id(ctx.viewport_id()))).unwrap_or(false)
+}
+
+/// Temp-data key of the IME descriptor identity `viewport` published at the end of a pass.
+fn published_id(viewport: ViewportId) -> Id {
+    Id::unique(("filmcraft-ime-reset-published", viewport))
+}
+
+/// The identity of `owner`'s descriptor that `ctx`'s viewport published at the end of its
+/// previous pass; `None` when that pass published none of `owner`'s or wasn't the one before.
+pub(crate) fn published(ctx: &Context, owner: Id) -> Option<OutputContext> {
+    let viewport = ctx.viewport_id();
+    let previous = ctx.cumulative_pass_nr_for(viewport).checked_sub(1)?;
+    let (pass, output) = ctx.data(|data| data.get_temp::<(u64, Option<OutputContext>)>(published_id(viewport)))?;
+    output.filter(|output| pass == previous && output.owner == owner)
+}
+
+/// Install before the first run_ui. The callbacks receive Ui and capture no Context/app.
+pub(crate) fn install(ctx: &Context) {
+    let installed = Id::unique("filmcraft-ime-reset-mode-installed");
+    if ctx.data(|data| data.get_temp::<bool>(installed)).unwrap_or(false) {
+        return;
+    }
+    ctx.on_begin_pass(
+        "filmcraft IME reset UI entry",
+        Arc::new(|ui| {
+            let viewport = ui.ctx().viewport_id();
+            ui.data_mut(|data| data.insert_temp(mode_id(viewport), true));
+        }),
+    );
+    ctx.on_end_pass(
+        "filmcraft IME reset UI exit",
+        Arc::new(|ui| {
+            let viewport = ui.ctx().viewport_id();
+            ui.data_mut(|data| data.insert_temp(mode_id(viewport), false));
+            // A native floating window's descriptor is complete only here, after docking wrote it.
+            let published = (ui.ctx().cumulative_pass_nr_for(viewport), ui.ctx().output(|out| out.ime.as_ref().map(OutputContext::of)));
+            ui.data_mut(|data| data.insert_temp(published_id(viewport), published));
+        }),
+    );
+    ctx.data_mut(|data| data.insert_temp(installed, true));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A fixed destination for one editor owner with caret 3 and committed-text stamp 17.
+    fn destination() -> Destination {
+        Destination { document: 1, target: ImeTarget::new(Id::unique("film-model-editor"), 1), caret: 3, anchor: 3, text: 17 }
+    }
+
+    /// Build the IME output a custom producer publishes for `destination` with the given
+    /// generation and purpose.
+    fn output(destination: Destination, generation: u64, purpose: IMEPurpose) -> egui::output::IMEOutput {
+        egui::output::IMEOutput::new(destination.target.owner, generation, purpose, egui::Rect::ZERO, egui::Rect::ZERO)
+    }
+
+    // These reducer tests use real Context requests/output, not native acknowledgements.
+    /// Run one real UI pass that publishes a custom `output` and calls `finish` as eligible;
+    /// return the reset request the Context attached, if any.
+    fn custom_pass(ctx: &Context, state: &mut State, destination: Destination, generation: u64, purpose: IMEPurpose) -> Option<ImeResetId> {
+        let mut result = ctx.run_ui(egui::RawInput::default(), |ui| {
+            state.begin_pass(ui.ctx());
+            let ime = output(destination, generation, purpose);
+            state.produced(OutputContext::of(&ime));
+            ui.ctx().output_mut(|out| out.ime = Some(ime));
+            state.finish(ui.ctx(), Some(destination), true);
+        });
+        let id = result.platform_output.ime.as_ref().and_then(|ime| ime.reset_request);
+        result.textures_delta.clear();
+        id
+    }
+
+    /// A generation or purpose change supersedes the old fence, old tokens cannot complete, an
+    /// allocation failure stays blocked, and a later real destination change retries.
+    #[test]
+    fn changed_output_context_supersedes_and_allocation_failure_stays_blocked() {
+        let ctx = Context::default();
+        install(&ctx);
+        let mut state = State::default();
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        let first = custom_pass(&ctx, &mut state, destination, 1, IMEPurpose::Normal).unwrap();
+        assert!(custom_pass(&ctx, &mut state, destination, 1, IMEPurpose::Normal).is_none());
+        let second = custom_pass(&ctx, &mut state, destination, 2, IMEPurpose::Normal).unwrap();
+        let third = custom_pass(&ctx, &mut state, destination, 2, IMEPurpose::Password).unwrap();
+        assert_ne!(first, second);
+        assert_ne!(second, third);
+        // The old opaque IDs are rejected even though document/target/caret/text are unchanged.
+        assert!(!state.complete(&ctx, first, destination));
+        assert!(!state.complete(&ctx, second, destination));
+        let other_owner = Destination { target: ImeTarget::new(Id::unique("film-other-owner"), 1), ..destination };
+        assert!(!state.complete(&ctx, third, other_owner), "the live destination owner is part of the admission boundary");
+        assert!(state.blocked(ViewportId::ROOT));
+        // Model token exhaustion explicitly; do not attempt to forge an opaque ID.
+        state.pending.get_mut(&ViewportId::ROOT).unwrap().phase = Phase::AllocationFailed;
+        for _ in 0..3 {
+            assert!(custom_pass(&ctx, &mut state, destination, 2, IMEPurpose::Password).is_none());
+            assert!(state.blocked(ViewportId::ROOT));
+        }
+        let changed = Destination { caret: 1, anchor: 1, ..destination };
+        state.sync(&ctx, changed);
+        let retry = custom_pass(&ctx, &mut state, changed, 2, IMEPurpose::Password).unwrap();
+        assert!(state.complete(&ctx, retry, changed));
+        assert!(!state.complete(&ctx, retry, changed));
+    }
+
+    /// `sync` followed by `finish` in the same pass allocates exactly one request and keeps it
+    /// as the awaiting boundary.
+    #[test]
+    fn same_pass_sync_and_finish_keep_one_request() {
+        let ctx = Context::default();
+        install(&ctx);
+        let mut state = State::default();
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        let mut requested = None;
+        let mut result = ctx.run_ui(egui::RawInput::default(), |ui| {
+            state.begin_pass(ui.ctx());
+            let ime = output(destination, 1, IMEPurpose::Normal);
+            state.produced(OutputContext::of(&ime));
+            ui.ctx().output_mut(|out| out.ime = Some(ime));
+            state.sync(ui.ctx(), destination);
+            if let Phase::Awaiting(id) = state.pending[&ViewportId::ROOT].phase {
+                requested = Some(id);
+            }
+            state.finish(ui.ctx(), Some(destination), true);
+            assert!(matches!(
+                state.pending[&ViewportId::ROOT].phase,
+                Phase::Awaiting(id) if Some(id) == requested
+            ));
+        });
+        assert_eq!(result.platform_output.ime.as_ref().and_then(|ime| ime.reset_request), requested);
+        result.textures_delta.clear();
+    }
+
+    /// `finish` reuses the replacement request allocated by `sync` instead of allocating a
+    /// second one, and the stale token cannot release the guard.
+    #[test]
+    fn stale_output_binding_does_not_force_a_second_request_on_sync_then_finish() {
+        let ctx = Context::default();
+        install(&ctx);
+        let mut state = State::default();
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        let stale = custom_pass(&ctx, &mut state, destination, 1, IMEPurpose::Normal).unwrap();
+        assert!(matches!(
+            state.pending[&ViewportId::ROOT].phase,
+            Phase::Awaiting(id) if id == stale
+        ));
+        assert!(state.pending[&ViewportId::ROOT].output.is_some());
+
+        // A destination transition retires the fence at the admission boundary but leaves the
+        // previous output binding attached until the next actual request replaces it.
+        let changed = Destination { caret: 1, anchor: 1, ..destination };
+        state.interrupt(destination.target, Some(changed));
+        assert!(state.pending[&ViewportId::ROOT].output.is_some(), "an old output context remains bound");
+
+        let mut requested_by_sync = None;
+        let mut result = ctx.run_ui(egui::RawInput::default(), |ui| {
+            state.begin_pass(ui.ctx());
+            let ime = output(changed, 2, IMEPurpose::Normal);
+            state.produced(OutputContext::of(&ime));
+            ui.ctx().output_mut(|out| out.ime = Some(ime));
+            state.sync(ui.ctx(), changed);
+            if let Phase::Awaiting(id) = state.pending[&ViewportId::ROOT].phase {
+                requested_by_sync = Some(id);
+            }
+            state.finish(ui.ctx(), Some(changed), true);
+            assert!(
+                matches!(
+                    state.pending[&ViewportId::ROOT].phase,
+                    Phase::Awaiting(id) if Some(id) == requested_by_sync
+                ),
+                "finish must reuse the request sync allocated for this destination transition"
+            );
+        });
+        let replacement = requested_by_sync.expect("sync allocated the replacement request");
+        assert_ne!(replacement, stale);
+        assert_eq!(result.platform_output.ime.as_ref().and_then(|ime| ime.reset_request), Some(replacement));
+        result.textures_delta.clear();
+
+        // The retired R1 is no longer the awaiting boundary and cannot release the guard.
+        assert!(!state.complete(&ctx, stale, changed));
+        assert!(state.blocked(ViewportId::ROOT));
+        assert!(state.complete(&ctx, replacement, changed));
+        assert!(!state.blocked(ViewportId::ROOT));
+    }
+
+    /// If custom eligibility is lost after `sync`, stock IME may echo the queued token but it
+    /// cannot release the suspended guard; only a later eligible descriptor can.
+    #[test]
+    fn queued_before_absence_token_may_reach_stock_but_cannot_release_suspended_guard() {
+        let ctx = Context::default();
+        install(&ctx);
+        let mut state = State::default();
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        let mut queued = None;
+        let mut absent = ctx.run_ui(egui::RawInput::default(), |ui| {
+            state.begin_pass(ui.ctx());
+            state.sync(ui.ctx(), destination);
+            if let Phase::Awaiting(id) = state.pending[&ViewportId::ROOT].phase {
+                queued = Some(id); // actual Context request returned by the production reducer
+            }
+            // A later same-pass layout/control loss prevents any descriptor publication.
+            state.finish(ui.ctx(), Some(destination), false);
+        });
+        assert!(absent.platform_output.ime.is_none());
+        absent.textures_delta.clear();
+        let queued = queued.unwrap();
+        let stock_id = Id::unique("film-model-stock-field");
+        let mut text = String::from("stock");
+        let mut stock = ctx.run_ui(egui::RawInput::default(), |ui| {
+            state.begin_pass(ui.ctx());
+            ui.memory_mut(|memory| memory.request_focus(stock_id));
+            ui.add(egui::TextEdit::singleline(&mut text).id(stock_id));
+            // Destination changes on an ineligible route cannot allocate a replacement.
+            state.interrupt(destination.target, Some(Destination { caret: 0, anchor: 0, ..destination }));
+            state.sync(ui.ctx(), destination);
+            assert!(!state.complete(ui.ctx(), queued, destination));
+            state.finish(ui.ctx(), Some(destination), false);
+        });
+        assert_eq!(
+            stock.platform_output.ime.as_ref().and_then(|ime| ime.reset_request),
+            Some(queued),
+            "core may attach ONLY the already queued R1; the public app API cannot cancel it"
+        );
+        assert!(matches!(state.pending[&ViewportId::ROOT].phase, Phase::Suspended));
+        stock.textures_delta.clear();
+        ctx.memory_mut(|memory| memory.surrender_focus(stock_id));
+        let replacement = custom_pass(&ctx, &mut state, destination, 1, IMEPurpose::Normal).unwrap();
+        assert_ne!(replacement, queued);
+        assert!(!state.complete(&ctx, queued, destination));
+        assert!(state.complete(&ctx, replacement, destination));
+    }
+
+    /// A native window's suspended fence waits while the window's descriptor identity is not
+    /// known, rearms on the identity the window's previous pass published, and keeps that one
+    /// request while the identity stays.
+    #[test]
+    fn window_fence_rearms_on_the_published_identity() {
+        let ctx = Context::default();
+        install(&ctx);
+        let window = ViewportId::from_hash_of("film-native-window");
+        let mut state = State { viewport: window, ..Default::default() };
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        state.suspend(window);
+        let pass = |state: &mut State, f: &mut dyn FnMut(&mut State, &Context)| {
+            let mut raw = egui::RawInput { viewport_id: window, ..Default::default() };
+            raw.viewports.insert(window, egui::ViewportInfo { parent: Some(ViewportId::ROOT), ..Default::default() });
+            let mut out = ctx.run_ui(raw, |ui| {
+                ui.ctx().output_mut(|out| out.ime = Some(output(destination, 1, IMEPurpose::Normal)));
+                f(state, ui.ctx());
+            });
+            out.textures_delta.clear();
+            out.platform_output.ime.and_then(|ime| ime.reset_request)
+        };
+        let mut finish = |state: &mut State, ctx: &Context| state.finish_window(ctx, Some(destination), published(ctx, destination.target.owner));
+        assert!(pass(&mut state, &mut finish).is_none(), "the first pass's identity is not known yet");
+        assert!(state.blocked(window));
+        let request = pass(&mut state, &mut finish).expect("the next pass rearms the fence");
+        assert!(pass(&mut state, &mut finish).is_none(), "the same identity keeps the request");
+        let mut completed = false;
+        pass(&mut state, &mut |state, ctx| completed = state.complete(ctx, request, destination));
+        assert!(completed && !state.blocked(window));
+    }
+
+    /// UI-pass mode is scoped per viewport, `install` is idempotent, and a child viewport's
+    /// completion cannot release ROOT's guard.
+    #[test]
+    fn pass_mode_is_per_viewport_and_foreign_completion_cannot_release_a_real_guard() {
+        let ctx = Context::default();
+        install(&ctx);
+        install(&ctx); // creator reuse must not register another pair of callbacks
+        let mut state = State::default();
+        let destination = destination();
+        state.interrupt(destination.target, Some(destination));
+        let root = custom_pass(&ctx, &mut state, destination, 1, IMEPurpose::Normal).unwrap();
+
+        let foreign_viewport = ViewportId::from_hash_of("film-other-window");
+        // Register an actual child viewport; a request for an unlisted viewport would be dropped
+        // by `Memory::begin_pass` before it could exercise the viewport check at all.
+        let mut raw = egui::RawInput { viewport_id: foreign_viewport, ..Default::default() };
+        raw.viewports.insert(foreign_viewport, egui::ViewportInfo { parent: Some(ViewportId::ROOT), ..Default::default() });
+        let mut foreign = None;
+        let mut foreign_output = ctx.run_ui(raw, |ui| {
+            assert_eq!(ui.ctx().viewport_id(), foreign_viewport);
+            assert!(in_ui_pass(ui.ctx()));
+            foreign = ui.ctx().request_ime_reset(foreign_viewport);
+        });
+        foreign_output.textures_delta.clear();
+        let foreign = foreign.expect("the registered child viewport allocated a real request");
+
+        let mut full = ctx.run_ui(egui::RawInput::default(), |ui| {
+            assert!(in_ui_pass(ui.ctx()));
+            assert!(!ui.data(|data| data.get_temp::<bool>(mode_id(foreign_viewport))).unwrap_or(false));
+            state.begin_pass(ui.ctx());
+            assert!(!state.complete(ui.ctx(), foreign, destination), "a child viewport's completion cannot release ROOT's guard");
+            assert!(state.blocked(ViewportId::ROOT));
+            assert!(state.complete(ui.ctx(), root, destination));
+            assert!(!state.complete(ui.ctx(), foreign, destination));
+            assert!(!state.blocked(ViewportId::ROOT));
+        });
+        full.textures_delta.clear();
+        assert!(!in_ui_pass(&ctx));
+        let _logic = ctx.run_logic(&egui::RawInput::default(), |ctx| assert!(!in_ui_pass(ctx)));
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index e3a644ff8..7fbd07ed4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -32,18 +32,23 @@ macro_rules! tlf {
 pub mod automation;
 pub mod brand;
 pub mod calc;
+pub mod capture;
 mod cjk;
 pub mod control;
 pub mod crash;
 pub mod credits;
 pub mod dock;
-mod dock_shared;
 mod dock_ui;
+pub use dock_ui::area_id as dock_area_id;
+/// Thumbnail textures kept before the least recently used are freed (each is up to 320 px wide).
+const MAX_THUMB_TEXTURES: usize = 512;
+
 pub mod frames;
 pub mod graphics_notice;
 pub mod header;
 pub mod i18n;
 pub mod icons;
+mod ime_reset;
 pub mod links;
 pub mod menus;
 pub mod native_dialogs;
@@ -58,19 +63,21 @@ pub mod source_playback;
 pub mod state;
 pub mod theme;
 mod theme_favorites;
+pub mod updates_ui;
 pub mod widgets;
 
 use std::collections::HashMap;
-use std::sync::Arc;
 use std::sync::mpsc::{Receiver, Sender};
+use std::sync::{Arc, Mutex};
 
+use egui::ime_context::ImeTarget;
 use egui::{TextureHandle, TextureOptions};
 use filmcraft_engine::{Services, Session};
 use filmcraft_time::Tick;
 use serde_json::{Value, json};
 
 pub use control::ControlRequest;
-use dock::PanelKind;
+use dock::{LayoutExt as _, PanelKind};
 use frames::{FrameKey, FrameServer, Target};
 use native_dialogs::FileDialog;
 use state::UiState;
@@ -200,7 +207,7 @@ pub enum Dialog {
     NewSequence,
     /// Settings (Preferences window; page in `UiState::settings`).
     Preferences,
-    /// "Recover unsaved changes from <time>?" (shown at startup when a dead session left some).
+    /// "Recover unsaved changes from `<time>`?" (shown at startup when a dead session left some).
     Recovery,
     /// "Are you sure you want to discard your changes?" (File ▸ Revert).
     RevertConfirm,
@@ -221,20 +228,24 @@ pub struct Playback {
     pub playing: bool,
     pub speed: f64,
     pub looping: bool,
-    /// Wall-clock (egui time, s) and timeline tick when playback (re)started.
+    /// Monotonic host time (s) and timeline tick when playback (re)started.
     anchor_time: f64,
     anchor_tick: Tick,
     /// Audio frames played at anchor (when the audio clock drives).
     pub audio_clock: bool,
-    /// The audio clock's last reading and when (egui time, s) it last moved: a device that stops
+    /// The audio clock's last reading and when (monotonic host s) it last moved: a device that stops
     /// consuming samples hands the clock back to the wall clock (see [`AUDIO_STALL_S`]).
     audio_seen: (u64, f64),
+    /// When playback lost its output (a failed open or a dead stream), when it is opened again
+    /// (monotonic host s; 0 = not retrying). Pause/play proves a fresh stream works, so a stream the
+    /// device keeps dropping is reopened on a timer (see [`AUDIO_RETRY_S`]).
+    audio_retry_at: f64,
     /// Audio underruns for the current (or last) play (desktop: sound is mixed ahead).
     #[cfg(not(target_arch = "wasm32"))]
     pub audio_stats: std::sync::Arc<play_ahead::AudioStats>,
     /// Shown / dropped frame accounting for the current (or last) play.
     pub meter: frames::PlaybackMeter,
-    /// Waiting for the first frames before starting the clock: when the wait began (egui time,
+    /// Waiting for the first frames before starting the clock: when the wait began (monotonic host time,
     /// s; negative = not yet stamped), and whether the Program monitor has them ready.
     pub preroll: Option<f64>,
     pub preroll_ready: bool,
@@ -253,11 +264,10 @@ pub struct Playback {
 /// under this.
 pub const AUDIO_STALL_S: f64 = 1.0;
 
-/// How long `ui.screenshot` waits for the window to present the frame.
-const SCREENSHOT_TIMEOUT_S: f64 = 10.0;
-/// How long `ui.screenshot` waits for the UI to settle (monitors showing their exact frames, the
-/// timeline zoom animation finished) before capturing what is there.
-const SCREENSHOT_SETTLE_MAX_S: f64 = 5.0;
+/// How often (s) playback re-opens the output after its stream or device failed, while playing
+/// goes on silently on the wall clock. Reopening is what pause/play does by hand; doing it on a
+/// timer brings the sound back when the device recovers (#2503).
+pub const AUDIO_RETRY_S: f64 = 2.0;
 
 /// Export entries that run from the menus through the save panel: command, filter label,
 /// extension.
@@ -271,6 +281,16 @@ pub(crate) const EXPORT_SAVE_DIALOGS: [(&str, &str, &str); 7] = [
     ("file.exportSelectionProject", "FilmCraft Project", "fcproj"),
 ];
 
+/// Incoming composition identity for the Program monitor. Interrupted compositions remain
+/// Stale until the matching opaque native reset fence; output or old terminal input is not
+/// acknowledgement. The retired origin and current destination live in the UI reset adapter.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ImeComposition {
+    Active(ImeTarget),
+    TerminalPending(ImeTarget),
+    Stale,
+}
+
 pub struct FilmcraftApp {
     pub session: Session,
     pub ui: UiState,
@@ -283,12 +303,39 @@ pub struct FilmcraftApp {
     pub scrub: scrub::ScrubAudio,
     pub hooks: HostHooks,
     pub dialog: Option<Dialog>,
+    pub(crate) updates_rt: updates_ui::Runtime,
     pub file_dialogs: panels::file_dialogs::FileDialogState,
     /// The native file dialog the host is showing ([`Self::pick`]).
     native_dialog: Option<native_dialogs::PendingDialog>,
     pub auto: automation::Registry,
+    /// Bumped when the custom text edit target is (re)created, a sequence/document context
+    /// changes, or a control request replaces `gfxEdit`. It is the replacement epoch of the
+    /// otherwise stable sequence/clip/component owner.
+    pub(crate) ime_replacement_epoch: u64,
+    /// The composition in flight (including an empty preedit awaiting its terminal event), or a
+    /// tombstone for a composition whose target was replaced or caret/focus was interrupted.
+    pub(crate) ime_composition: Option<ImeComposition>,
+    ime_reset: ime_reset::State,
+    ime_composition_viewport: Option<egui::ViewportId>,
+    /// The input method at the Program monitor's text caret: event order, the keys it uses, the
+    /// marked text drawn on the video until it commits, and the published IME descriptor.
+    pub(crate) ime_composer: craft_ui::ime::Composer,
+    /// The edit target `ime_composer` was made for; another target gets a new composer, so a
+    /// new IME context.
+    pub(crate) ime_composer_target: Option<ImeTarget>,
+    /// The editor drawn in this pass; the end-of-pass check runs after control drain.
+    pub(crate) ime_drawn_editor: Option<panels::graphics::DrawnImeEditor>,
+    /// Project document generation last seen by the UI (the engine bumps it on replacement).
+    ime_document_epoch: u64,
+    /// Active sequence last seen by the UI; `sequence.close` need not emit `OpenSequence`.
+    ime_active_sequence: Option<filmcraft_project::ItemId>,
+    /// Viewports the Program monitor's editor published in, released when the app exits.
+    ime_viewports: Vec<egui::ViewportId>,
     /// Named textures (monitors, thumbnails) with the key they show.
     textures: HashMap<String, (FrameKey, TextureHandle)>,
+    /// The UI pass each thumbnail texture was last used in: thumbnails beyond
+    /// [`MAX_THUMB_TEXTURES`] are freed, least recently used first (#1682).
+    thumb_used: HashMap<String, u64>,
     control_rx: Option<Receiver<ControlRequest>>,
     /// One explicit panel reveal; consumed by the custom renderer, never repeated per frame.
     pub(crate) pending_panel_raise: Option<PanelKind>,
@@ -300,24 +347,62 @@ pub struct FilmcraftApp {
     synthetic_modifiers: egui::Modifiers,
     /// Requests waiting for the UI to show an element: (request, give-up time).
     deferred: Vec<(ControlRequest, f64)>,
+    /// Control requests that need a fresh layout/response; processed only in a real UI pass.
+    ui_requests: Vec<(ControlRequest, f64)>,
     last_ui_time: f64,
     pub(crate) synthetic: Vec<egui::Event>,
+    /// One synthetic step handed to `raw_input_hook` but not yet consumed by a real UI pass.
+    /// Hidden `run_logic` callbacks do not process raw input: the same step is offered again until
+    /// an actual pass consumes it, rather than being dropped or advancing the queue.
+    synthetic_pending_step: Option<Vec<egui::Event>>,
+    /// The pending step is already present in the `RawInput` the eframe integration preserves
+    /// across hidden logic ticks. Appending it again on the next hook would duplicate it.
+    synthetic_step_offered: bool,
+    /// Same for the `ModifiersChanged`/focus boundary events, which hidden ticks would otherwise
+    /// accumulate without bound.
+    synthetic_modifiers_offered: bool,
+    /// An image delivered by `Event::PasteImage` for the paste action this frame. Native and web
+    /// hosts deliver the bytes in the event; re-reading the OS clipboard can see a different image
+    /// (or none, on the web), so the menu path consumes this payload first.
+    pub(crate) pasted_image: Option<std::sync::Arc<egui::ColorImage>>,
+    /// Monotonic host clock for playback, deadlines and hidden work. Never `ctx.input(i.time)`.
+    clock_start: web_time::Instant,
+    /// The latest time egui itself reported for a layout pass. Native and web hosts supply a
+    /// monotonic wall clock; deterministic harnesses supply their own stepped clock. Taking the
+    /// later of this and the host clock keeps simulated tests on their clock while a hidden
+    /// logic tick (whose `InputState::time` is stale) still advances by host time.
+    ui_clock: f64,
+    /// Non-negative `ui_clock - host_elapsed`, captured on the first real UI pass. Native eframe
+    /// starts its `RawInput::time` at its own integration beginning, which can precede
+    /// `clock_start`; without this offset, `max` would hold `now()` at the stale UI time during
+    /// hidden logic and then jump by the startup offset when the next UI pass arrives.
+    ui_clock_offset: Option<f64>,
+    #[cfg(test)]
+    test_now: Option<f64>,
     /// macOS: a Control+Click already translated to a secondary (context) click, so its release is
     /// translated too even if Control is let go mid-click. AppKit delivers Control+Click to the
     /// view as a *primary* press with the Control modifier (`rightMouseDown:` only fires for a
     /// right button or two-finger click), so the app does the platform's translation itself.
     #[cfg_attr(not(target_os = "macos"), allow(dead_code))]
     mac_ctrl_click_armed: bool,
+    /// [`Self::mac_ctrl_click_armed`] for each dock panel's own OS window, shared with the dock
+    /// area's input hook.
+    pub(crate) native_ctrl_click_armed: Arc<Mutex<HashMap<egui::ViewportId, bool>>>,
     /// The mouse press in progress (its start time) and the undo history when it began, for Escape
     /// to take back what the press changed (#580).
     value_press: Option<(f64, filmcraft_engine::UndoMark)>,
+    /// Escape was pressed during the current press in pass 0; apply the rollback after the final
+    /// non-discarded UI pass (pass 1+ has no key event to re-read).
+    escape_cancel: bool,
     /// BS.1770 loudness of the programme as it plays, and the next sample position to feed.
     pub(crate) loudness: Option<(filmcraft_audio_dsp::LoudnessMeter, i64)>,
     /// Status message last shown and when it first appeared (messages expire after a few seconds).
     status_seen: (String, f64),
-    /// Screenshots waiting for their frame: (token, path, crop, reply, give-up time).
-    pending_screenshots: Vec<(u64, Option<String>, Option<[f32; 4]>, Sender<Value>, f64)>,
-    queued_screenshots: Vec<(u64, f64, u32)>,
+    /// Admitted `ui.screenshot` requests and their completion slots.
+    pub(crate) shots: capture::Shots,
+    /// Fresh raw-input surface geometry, refreshed in `raw_input_hook` for UI and logic callbacks.
+    pub(crate) capture_geometry: Option<capture::CaptureGeometry>,
+    pub(crate) capture_epoch: u64,
     /// A paused monitor drew a stand-in (nearest cached) picture last frame: its exact frame is
     /// still decoding.
     pub(crate) monitor_inexact: bool,
@@ -330,7 +415,6 @@ pub struct FilmcraftApp {
     /// the frame before the last one, so its timeline rects are final from 2 on.
     pub(crate) timeline_still: u32,
     input_waiters: Vec<Sender<Value>>,
-    next_token: u64,
     styled: bool,
     /// A panic in the UI pass, shown in an error window until dismissed (see [`crash`]).
     pub ui_error: Option<String>,
@@ -349,10 +433,14 @@ pub struct FilmcraftApp {
     /// The sequence whose view `ui.timeline` holds, and that view as it was last exchanged with
     /// `session.state.timeline_views` (see `sync_timeline_view`).
     timeline_view_of: Option<filmcraft_engine::project::ItemId>,
-    /// Items imported by an OS file drop, to place on the Timeline at the drop point this frame.
-    pending_timeline_drop: Option<(Vec<filmcraft_engine::project::ItemId>, egui::Pos2)>,
-    /// Files being dragged over the window from the OS (count, pointer): the Timeline previews where they would land.
-    file_drag_hover: Option<(usize, egui::Pos2)>,
+    /// Items imported by an OS file drop, to place on the Timeline at the drop point this frame
+    /// (in the coordinates of the viewport the files were dropped on).
+    pending_timeline_drop: Option<(Vec<filmcraft_engine::project::ItemId>, egui::Pos2, egui::ViewportId)>,
+    /// Files being dragged over a window from the OS (count, pointer, viewport): the Timeline previews where they would land.
+    file_drag_hover: Option<(usize, egui::Pos2, egui::ViewportId)>,
+    /// Files dragged over or dropped on dock panels in their own OS windows last frame; the
+    /// dock area reports them after the panels have drawn, so they are imported next frame.
+    window_files: Vec<craft_ui::docking::WindowFiles<PanelKind>>,
     timeline_view_last: Option<filmcraft_engine::project::SequenceView>,
     pub fps: f32,
     last_time: f64,
@@ -530,6 +618,8 @@ impl FilmcraftApp {
 }
 
 impl FilmcraftApp {
+    /// Build the app around one shared `FrameServer`, falling back to the default language on an unparsable preference, loading workspaces from the prefs
+    /// directory and seeding IME epoch/sequence identity.
     pub fn new(mut session: Session) -> Self {
         session.shortcuts.register_external(menus::external_commands());
         let recovery = !session.recovery_candidates().is_empty();
@@ -537,6 +627,8 @@ impl FilmcraftApp {
         let workspaces =
             session.prefs_path.as_ref().and_then(|p| p.parent()).map(|d| dock::WorkspacePrefs::load(&d.join(dock::WORKSPACES_FILE))).unwrap_or_default();
         let language = i18n::Language::parse(&session.prefs.general.interface_language).unwrap_or_default();
+        let ime_document_epoch = session.document_epoch;
+        let ime_active_sequence = session.state.active_sequence;
         Self {
             session,
             ui: UiState { language, ..UiState::default() },
@@ -549,30 +641,54 @@ impl FilmcraftApp {
             hooks: HostHooks::default(),
             // Unsaved changes left by a session that died are offered first thing.
             dialog: recovery.then_some(Dialog::Recovery),
+            updates_rt: Default::default(),
             file_dialogs: Default::default(),
             native_dialog: None,
             auto: Default::default(),
+            ime_replacement_epoch: 0,
+            ime_composition: None,
+            ime_reset: Default::default(),
+            ime_composition_viewport: None,
+            ime_composer: craft_ui::ime::Composer::new(),
+            ime_composer_target: None,
+            ime_drawn_editor: None,
+            ime_document_epoch,
+            ime_active_sequence,
+            ime_viewports: Vec::new(),
             textures: HashMap::new(),
+            thumb_used: HashMap::new(),
             control_rx: None,
             pending_panel_raise: None,
             control_input_only: false,
             native_window_focused: None,
             synthetic_modifiers: egui::Modifiers::NONE,
             deferred: Vec::new(),
+            ui_requests: Vec::new(),
             last_ui_time: 0.0,
             synthetic: Vec::new(),
+            synthetic_pending_step: None,
+            synthetic_step_offered: false,
+            synthetic_modifiers_offered: false,
+            pasted_image: None,
+            clock_start: web_time::Instant::now(),
+            ui_clock: 0.0,
+            ui_clock_offset: None,
+            #[cfg(test)]
+            test_now: None,
             mac_ctrl_click_armed: false,
+            native_ctrl_click_armed: Arc::default(),
             value_press: None,
+            escape_cancel: false,
             loudness: None,
             status_seen: (String::new(), 0.0),
-            pending_screenshots: Vec::new(),
-            queued_screenshots: Vec::new(),
+            shots: capture::Shots::default(),
+            capture_geometry: None,
+            capture_epoch: 0,
             monitor_inexact: false,
             monitor_asked: HashMap::new(),
             program_shown: None,
             timeline_still: 0,
             input_waiters: Vec::new(),
-            next_token: 1,
             styled: false,
             ui_error: None,
             panic_next_frame: false,
@@ -583,6 +699,7 @@ impl FilmcraftApp {
             timeline_view_of: None,
             pending_timeline_drop: None,
             file_drag_hover: None,
+            window_files: Vec::new(),
             timeline_view_last: None,
             fps: 60.0,
             last_time: 0.0,
@@ -612,6 +729,173 @@ impl FilmcraftApp {
         self
     }
 
+    /// Start a new replacement epoch for the Program monitor's text edit target.
+    ///
+    /// The owner key names the sequence, clip and component. A recreated edit session on the
+    /// same key (or a document/sequence replacement) must not inherit the previous IME context,
+    /// so the app advances this epoch and the editor's next pass starts a new composer.
+    pub(crate) fn restart_ime_target(&mut self) {
+        self.ime_replacement_epoch = self.ime_replacement_epoch.wrapping_add(1);
+        self.invalidate_ime_composition();
+    }
+
+    /// Context-less commands block immediately and retire the prior request on a real change.
+    /// The next Context-bearing local event boundary requests its current destination's fence.
+    pub(crate) fn invalidate_ime_composition(&mut self) {
+        let origin = match self.ime_composition {
+            Some(ImeComposition::Active(target) | ImeComposition::TerminalPending(target))
+                if self.ime_composition_viewport == Some(self.ime_reset.viewport) =>
+            {
+                Some(target)
+            }
+            _ => self.ime_reset.origin(self.ime_reset.viewport),
+        };
+        let Some(origin) = origin else { return };
+        let destination = panels::graphics::current_reset_destination(self);
+        self.ime_reset.interrupt(origin, destination);
+        self.ime_composition = Some(ImeComposition::Stale);
+        self.ime_composition_viewport = Some(self.ime_reset.viewport);
+    }
+
+    /// Feed the live local edit destination to the reset reducer before each raw event. When an
+    /// origin exists, a changed destination retires the old composition token and marks the
+    /// composition stale; an unchanged destination only re-arms a pending `NeedsRequest`. Call
+    /// with the editor's actual text, never a staged engine copy.
+    pub(crate) fn sync_live_ime_destination(&mut self, ctx: &egui::Context, destination: ime_reset::Destination) {
+        let viewport = ctx.viewport_id();
+        self.ime_reset.viewport = viewport;
+        if self.ime_reset.incoming_changed(viewport, destination) {
+            let origin = match self.ime_composition {
+                Some(ImeComposition::Active(target) | ImeComposition::TerminalPending(target)) if self.ime_composition_viewport == Some(viewport) => {
+                    Some(target)
+                }
+                _ => self.ime_reset.origin(viewport),
+            };
+            if let Some(origin) = origin {
+                self.ime_reset.interrupt(origin, Some(destination));
+                self.ime_composition = Some(ImeComposition::Stale);
+                self.ime_composition_viewport = Some(viewport);
+            }
+        }
+        self.ime_reset.sync(ctx, destination);
+    }
+
+    /// Retire the current composition and suspend this viewport's IME fence. UI paths that lose
+    /// the editor route through this; context-less control commands call
+    /// `invalidate_ime_composition` directly. Only an eligible final descriptor can re-arm the guard.
+    pub(crate) fn suspend_ime_input(&mut self, ctx: &egui::Context) {
+        self.ime_reset.viewport = ctx.viewport_id();
+        self.invalidate_ime_composition();
+        self.ime_reset.suspend(ctx.viewport_id());
+    }
+
+    /// The editor did not own this raw route. Controls stay inert after suspension; stock
+    /// text/key events remain available to their widgets. Never use this before a live loop.
+    fn suspended_ime_controls(&mut self, ctx: &egui::Context) {
+        self.suspend_ime_input(ctx);
+        ctx.input_mut(|input| input.events.retain(|event| !matches!(event, egui::Event::ImeResetCompleted { .. })));
+    }
+
+    /// An actual modal owns input: the in-app `dialog` (Recovery, Revert, About, …) or a
+    /// host-shown `native_dialog` picker. `file_dialogs` is only dialog-local state (the recovery
+    /// choice); it is not an open modal on its own, so it must not block an otherwise eligible
+    /// editor between frames.
+    pub(crate) fn ime_modal_blocks_input(&self) -> bool {
+        self.dialog.is_some() || self.native_dialog_open()
+    }
+
+    /// Hosts with post-logic application work call this at their actual outer return.
+    pub fn finish_ime_reset_logic(&mut self, ctx: &egui::Context) {
+        self.ime_reset.viewport = ctx.viewport_id();
+        self.sync_ime_target_context(ctx);
+        if !ime_reset::in_ui_pass(ctx) {
+            self.suspend_ime_input(ctx);
+        }
+    }
+
+    /// End-of-UI-pass reconciliation. Suspend and finish as ineligible when the custom output is
+    /// absent, the window is unfocused, a modal owns input, or the text edit lacks focus;
+    /// otherwise sync the live destination and let `finish` bind or allocate only for actual
+    /// custom eligibility.
+    fn finish_ime_reset_ui(&mut self, ctx: &egui::Context) {
+        let focused = ctx.input(|input| input.viewport().focused.unwrap_or(input.focused));
+        let eligible = self.ime_reset.owns_output(ctx)
+            && focused
+            && !self.ime_modal_blocks_input()
+            && ctx.memory(|memory| memory.has_focus(egui::Id::unique(panels::graphics::TEXT_EDIT_ID)));
+        if !eligible {
+            self.suspend_ime_input(ctx);
+            let destination = panels::graphics::current_reset_destination(self);
+            self.ime_reset.finish(ctx, destination, false);
+            return;
+        }
+        let destination = panels::graphics::current_reset_destination(self);
+        if let Some(destination) = destination {
+            // Same-pass control work can change only the caret after the overlay drew. Do
+            // not allocate until actual custom eligibility has been established above.
+            self.sync_live_ime_destination(ctx, destination);
+        }
+        self.ime_reset.finish(ctx, destination, self.ime_reset.owns_output(ctx));
+    }
+
+    /// [`Self::ui`]'s end-of-pass IME check for a native floating window, after its last panel
+    /// body: the Program monitor's editor, when it was drawn there, keeps or drops the
+    /// composer's descriptor, and the window's reset fence suspends or rearms.
+    pub(crate) fn finish_ime_window(&mut self, ctx: &egui::Context) {
+        let viewport = ctx.viewport_id();
+        if self.ime_drawn_editor.as_ref().is_none_or(|drawn| drawn.viewport != viewport) {
+            self.ime_reset.suspend(viewport);
+            return;
+        }
+        self.ime_reset.viewport = viewport;
+        let focused = ctx.input(|input| input.viewport().focused.unwrap_or(input.focused));
+        let eligible = panels::graphics::finish_graphics_ime(self, ctx, false) && focused;
+        let destination = panels::graphics::current_reset_destination(self);
+        if !eligible {
+            self.suspend_ime_input(ctx);
+            self.ime_reset.finish_window(ctx, None, None);
+            return;
+        }
+        if let Some(destination) = destination {
+            self.sync_live_ime_destination(ctx, destination);
+        }
+        let output = self.ime_composer_target.and_then(|target| ime_reset::published(ctx, target.owner));
+        self.ime_reset.finish_window(ctx, destination, output);
+    }
+
+    /// Notice a document replacement or an active-sequence change that did not emit
+    /// `OpenSequence` (`file.newProject`, a project with no sequence, `sequence.close`). The
+    /// edit target and any in-flight composition belong to the old context.
+    fn sync_ime_target_context(&mut self, ctx: &egui::Context) {
+        let document = self.session.document_epoch;
+        let sequence = self.session.state.active_sequence;
+        let replaced = document != self.ime_document_epoch;
+        if !replaced && sequence == self.ime_active_sequence {
+            return;
+        }
+        self.ime_document_epoch = document;
+        self.ime_active_sequence = sequence;
+        self.restart_ime_target();
+        self.ui.gfx_edit = None;
+        self.ime_drawn_editor = None;
+        let text_edit = egui::Id::unique(panels::graphics::TEXT_EDIT_ID);
+        ctx.memory_mut(|memory| memory.surrender_focus(text_edit));
+        ctx.data_mut(|data| data.remove::<PanelKind>(text_edit.with("panel")));
+    }
+
+    /// Remember a viewport the Program monitor's editor published in, for [`eframe::App::on_exit`].
+    pub(crate) fn note_ime_viewport(&mut self, viewport: egui::ViewportId) {
+        if !self.ime_viewports.contains(&viewport) {
+            self.ime_viewports.push(viewport);
+        }
+    }
+
+    /// The main window's end-of-pass check of the Program monitor's editor, after the pass's
+    /// control requests ran. Native floating windows ran theirs in [`Self::finish_ime_window`].
+    pub(crate) fn finish_ime_pass(&mut self, ctx: &egui::Context) {
+        let _ = panels::graphics::finish_graphics_ime(self, ctx, true);
+    }
+
     /// Isolate an automation-owned app from native keyboard, pointer, drop and menu input.
     /// Window close/quit and screenshot delivery remain available.
     pub fn with_control_input_only(mut self, rx: Receiver<ControlRequest>) -> Self {
@@ -623,6 +907,28 @@ impl FilmcraftApp {
         self.session.services.clone()
     }
 
+    /// Time used by logic-only ticks, playback and deadlines.
+    ///
+    /// The host clock is authoritative (egui's `InputState::time` is stale during
+    /// `Context::run_logic`), but an egui pass's reported time can be ahead of it: deterministic
+    /// harnesses step a simulated clock without sleeping. Taking the later value keeps those
+    /// runs deterministic while a hidden tick still moves on the monotonic host clock.
+    pub(crate) fn now(&self) -> f64 {
+        #[cfg(test)]
+        if let Some(now) = self.test_now {
+            return now;
+        }
+        let host = self.clock_start.elapsed().as_secs_f64();
+        let host = self.ui_clock_offset.map_or(host, |offset| host + offset);
+        host.max(self.ui_clock)
+    }
+
+    /// Override `now()` with a deterministic value for tests; compiled only under `cfg(test)`.
+    #[cfg(test)]
+    pub(crate) fn set_now_for_test(&mut self, now: f64) {
+        self.test_now = Some(now);
+    }
+
     /// Rebuild the frame server if the session's media pool was replaced (e.g. project opened).
     fn sync_pool(&mut self) {
         if !Arc::ptr_eq(&self.frames.pool, &self.session.media) || !Arc::ptr_eq(&self.frames.previews, &self.session.previews) {
@@ -633,6 +939,7 @@ impl FilmcraftApp {
                 FrameServer::default_workers(),
             ));
             self.textures.clear();
+            self.thumb_used.clear();
             self.tl.reset_media_caches();
             // the new frame server needs the Memory settings
             self.applied_prefs = None;
@@ -685,6 +992,16 @@ impl FilmcraftApp {
         }
     }
 
+    /// View ▸ Reset Interface Zoom: the scale Settings ▸ Appearance ▸ UI Scale asks for (the
+    /// system's with Auto), undoing any session zoom (#2253).
+    /// Returns the zoom factor set (egui reports it from the next pass on).
+    pub(crate) fn reset_ui_zoom(&mut self, ctx: &egui::Context) -> f32 {
+        let native = ctx.native_pixels_per_point().filter(|v| v.is_finite() && *v > 0.0).unwrap_or(1.0);
+        let zoom = self.session.prefs.appearance.ui_scale_factor().map_or(1.0, |scale| scale / native);
+        ctx.set_zoom_factor(zoom);
+        zoom
+    }
+
     /// Make the UI follow the settings after they change (theme, tooltips, frame cache budget,
     /// play after rendering, audio device).
     pub fn apply_prefs(&mut self, ctx: &egui::Context) {
@@ -697,6 +1014,11 @@ impl FilmcraftApp {
                 self.set_theme(ctx, k);
             }
         }
+        // checked every frame: a theme or font change installs the style again
+        let animation = if self.session.prefs.appearance.animations { theme::ANIMATION_TIME } else { 0.0 };
+        if ctx.global_style().animation_time != animation {
+            ctx.global_style_mut(|s| s.animation_time = animation);
+        }
         if self.applied_prefs.as_ref() == Some(&self.session.prefs) {
             return;
         }
@@ -727,6 +1049,7 @@ impl FilmcraftApp {
                 self.ui.language = language;
             }
             i18n::set_current(self.ui.language);
+            ctx.set_language(Some(self.ui.language.bcp47().to_owned()));
         }
         self.frames.set_cache_budget(p.memory.frame_cache_mb as usize * (1 << 20));
         self.ui.play_after_render = p.timeline.play_after_rendering;
@@ -744,10 +1067,10 @@ impl FilmcraftApp {
         }
         if (hardware_changed || pitch_changed) && self.playback.playing && self.playback.preroll.is_none() {
             self.playback.anchor_tick = self.session.playhead();
-            let now = ctx.input(|i| i.time);
+            let now = self.now();
             self.playback.anchor_time = now;
             self.playback.audio_seen = (0, now);
-            self.start_audio();
+            self.start_audio(now);
         }
         if let Some(note) = self.audio.as_ref().and_then(|a| a.note()) {
             self.ui.status = note;
@@ -831,9 +1154,7 @@ impl FilmcraftApp {
 
     pub fn set_workspace(&mut self, name: &str) {
         self.ui.workspace = name.to_string();
-        let layout = dock::saved_docking(&self.workspaces, name);
-        self.ui.dock = layout.root;
-        self.ui.floating = layout.floating;
+        self.ui.dock = dock::saved_docking(&self.workspaces, name);
         self.pending_panel_raise = None;
         self.ui.keys.maximized = None;
         if self.workspaces.current != name {
@@ -849,15 +1170,22 @@ impl FilmcraftApp {
     }
 
     pub fn show_panel(&mut self, p: PanelKind) {
-        if p == PanelKind::Timeline && !self.ui.floating.iter().any(|group| group.panels.contains(&p)) {
+        // closed while floating: it floats again where it was (#1985); taken before the Timeline's
+        // own restore below docks it
+        let open = self.ui.dock.contains(&p);
+        let refloat = match self.ui.closed_floating.iter().position(|(k, _)| *k == p) {
+            Some(i) if !open => Some(self.ui.closed_floating.remove(i).1),
+            _ => None,
+        };
+        if p == PanelKind::Timeline {
             self.ui.dock.restore_timeline();
         }
-        if !self.ui.dock.contains(p) && !self.ui.floating.iter().any(|group| group.panels.contains(&p)) {
+        if !self.ui.dock.contains(&p) {
             let near = match p {
                 // a side panel beside Properties (or Essential Sound), never over the Program monitor
                 PanelKind::TextToSpeech => [PanelKind::Properties, PanelKind::EssentialSound, PanelKind::EssentialGraphics]
                     .into_iter()
-                    .find(|k| self.ui.dock.contains(*k))
+                    .find(|k| self.ui.dock.contains(k))
                     .unwrap_or(PanelKind::Program),
                 PanelKind::LumetriColor | PanelKind::EssentialGraphics | PanelKind::EssentialSound | PanelKind::Properties => PanelKind::Program,
                 PanelKind::Source
@@ -873,6 +1201,15 @@ impl FilmcraftApp {
             };
             self.ui.dock.open_near(p, near);
         }
+        if let Some(rect) = refloat.filter(|r| r.iter().all(|v| v.is_finite())) {
+            let rect = [rect[0], rect[1], rect[2].max(160.0), rect[3].max(120.0)];
+            if let Err(e) = self.apply_dock(craft_ui::docking::Action::Float { panel: p, rect }) {
+                // refused (it is the only docked panel left): it stays docked, and its floating
+                // place is kept rather than lost
+                log::warn!("could not float {} again: {e}", p.id());
+                self.ui.closed_floating.push((p, rect));
+            }
+        }
         let _ = self.apply_dock(craft_ui::docking::Action::Activate { panel: p });
         self.ui.focused = p;
     }
@@ -963,6 +1300,7 @@ impl FilmcraftApp {
             a.stop();
         }
         self.playback.audio_clock = false;
+        self.playback.audio_retry_at = 0.0;
     }
 
     /// Start the clock (and audio) once the first frames are ready or the preroll timed out.
@@ -971,7 +1309,7 @@ impl FilmcraftApp {
         self.playback.anchor_time = now;
         self.playback.anchor_tick = self.session.playhead();
         self.playback.audio_seen = (0, now);
-        self.start_audio();
+        self.start_audio(now);
         // Audio Track Mixer: an automation pass runs while playing forward in real time
         if (self.playback.speed - 1.0).abs() < 1e-9 && !self.session.mixrec.active() {
             let t = self.session.playhead();
@@ -990,7 +1328,7 @@ impl FilmcraftApp {
         if self.playback.playing {
             self.stop();
         }
-        let a = self.audio.as_mut().ok_or("no audio output (check Settings ▸ Audio Hardware)")?;
+        let a = self.audio.as_mut().ok_or("no audio output (check Settings > Audio Hardware)")?;
         let sr = a.sample_rate().max(1);
         a.stop();
         let step = f64::from(audio.sample_rate.max(1)) / f64::from(sr);
@@ -1023,6 +1361,7 @@ impl FilmcraftApp {
         }
         self.scrub.device_stopped();
         self.playback.audio_clock = false;
+        self.playback.audio_retry_at = 0.0;
         if self.session.mixrec.active() {
             let t = self.session.playhead();
             if let Err(e) = self.session.execute("mixer.recordStop", json!({"time": t.0})) {
@@ -1033,7 +1372,7 @@ impl FilmcraftApp {
         panels::voiceover::on_stop(self);
     }
 
-    fn start_audio(&mut self) {
+    fn start_audio(&mut self, now: f64) {
         let Some(seq_id) = self.session.state.active_sequence else { return };
         let start_tick = self.session.playhead();
         let Some(a) = self.audio.as_mut() else { return };
@@ -1042,6 +1381,7 @@ impl FilmcraftApp {
         // either the original rate conversion or pitch-corrected program audio.
         let Some((mix_rate, mix)) = shuttle::mix(&self.session, seq_id, sr, self.playback.speed) else {
             a.stop();
+            self.playback.audio_retry_at = 0.0;
             return;
         };
         let cursor = start_tick.to_units_floor(i64::from(mix_rate));
@@ -1061,6 +1401,7 @@ impl FilmcraftApp {
         match a.start(fill) {
             Ok(_) => {
                 self.playback.audio_clock = true;
+                self.playback.audio_retry_at = 0.0;
                 if let Some(note) = self.audio.as_ref().and_then(|audio| audio.note()) {
                     self.ui.status = note;
                 }
@@ -1068,15 +1409,18 @@ impl FilmcraftApp {
             Err(e) => {
                 log::warn!("audio output unavailable: {e}");
                 self.playback.audio_clock = false;
+                self.playback.audio_retry_at = now + AUDIO_RETRY_S;
             }
         }
     }
 
+    /// Advance the Program playhead only while playing; owns preroll completion, audio-clock anchoring, output retry and the fallback to wall time when audio
+    /// is lost or stalls.
     fn advance_playback(&mut self, ctx: &egui::Context) {
         if !self.playback.playing {
             return;
         }
-        let now = ctx.input(|i| i.time);
+        let now = self.now();
         if let Some(since) = self.playback.preroll {
             let since = if since < 0.0 { now } else { since };
             self.playback.preroll = Some(since);
@@ -1090,6 +1434,15 @@ impl FilmcraftApp {
         if self.playback.anchor_time < 0.0 {
             self.playback.anchor_time = now;
         }
+        if !self.playback.audio_clock && self.playback.audio_retry_at > 0.0 && now >= self.playback.audio_retry_at {
+            // The output failed mid-play: open it again where the wall clock got to (what
+            // pause/play does by hand), so a recovering device brings the sound back.
+            self.playback.audio_retry_at = now + AUDIO_RETRY_S;
+            self.playback.anchor_tick = self.session.playhead();
+            self.playback.anchor_time = now;
+            self.playback.audio_seen = (0, now);
+            self.start_audio(now);
+        }
         let rate = self.session.sequence_rate();
         if self.playback.audio_clock
             && let Some(audio) = self.audio.as_mut()
@@ -1103,11 +1456,12 @@ impl FilmcraftApp {
             self.playback.anchor_tick = self.session.playhead();
             self.playback.anchor_time = now;
             self.playback.audio_clock = false;
+            self.playback.audio_retry_at = now + AUDIO_RETRY_S;
             if let Some(audio) = self.audio.as_mut() {
                 audio.stop();
             }
             log::warn!("audio output lost its playback clock; playing without sound");
-            self.ui.status = tl!("Audio output failed: playing without sound (check Settings ▸ Audio Hardware)").into();
+            self.ui.status = tl!("Audio output failed: playing without sound (check Settings > Audio Hardware)").into();
         }
         if let Some((f, sr)) = reading {
             if f != self.playback.audio_seen.0 {
@@ -1123,7 +1477,7 @@ impl FilmcraftApp {
                     a.stop();
                 }
                 log::warn!("audio output stalled (no samples consumed for {AUDIO_STALL_S} s); playing without sound");
-                self.ui.status = tl!("Audio output is not responding: playing without sound (check Settings ▸ Audio Hardware)").into();
+                self.ui.status = tl!("Audio output is not responding: playing without sound (check Settings > Audio Hardware)").into();
             }
         }
         let elapsed = match reading {
@@ -1161,16 +1515,30 @@ impl FilmcraftApp {
 
     // ---------------------------------------------------------------- textures
 
-    /// Upload a rendered frame into a named texture (only when the key changed).
+    /// Upload a rendered frame into a named texture (only when the key changed), opaque: the
+    /// picture over black.
     pub fn texture_for(&mut self, ctx: &egui::Context, name: &str, key: FrameKey, img: &frames::Rgba) -> egui::TextureId {
+        self.upload_frame(ctx, name, key, img, false)
+    }
+
+    /// Like [`Self::texture_for`], keeping the frame's alpha, so what is painted under the
+    /// texture (the monitors' Transparency Grid) shows through its transparent areas.
+    pub fn texture_with_alpha(&mut self, ctx: &egui::Context, name: &str, key: FrameKey, img: &frames::Rgba) -> egui::TextureId {
+        self.upload_frame(ctx, name, key, img, true)
+    }
+
+    /// Fetch or create the named texture and upload only when `key` changed; `alpha` selects
+    /// transparent or opaque conversion. Returns the texture's stable id.
+    fn upload_frame(&mut self, ctx: &egui::Context, name: &str, key: FrameKey, img: &frames::Rgba, alpha: bool) -> egui::TextureId {
+        let image = || img.color_image(alpha);
         if let Some((k, tex)) = self.textures.get_mut(name) {
             if *k != key {
-                tex.set(egui::ColorImage::from_rgba_unmultiplied([img.w, img.h], &img.px), TextureOptions::LINEAR);
+                tex.set(image(), TextureOptions::LINEAR);
                 *k = key;
             }
             return tex.id();
         }
-        let tex = ctx.load_texture(name, egui::ColorImage::from_rgba_unmultiplied([img.w, img.h], &img.px), TextureOptions::LINEAR);
+        let tex = ctx.load_texture(name, image(), TextureOptions::LINEAR);
         let id = tex.id();
         self.textures.insert(name.to_string(), (key, tex));
         id
@@ -1251,12 +1619,40 @@ impl FilmcraftApp {
         let name = format!("thumb-{}-{}-{}", item.0, frame, width);
         if let Some(img) = self.frames.get(&key) {
             let id = self.texture_for(ctx, &name, key, &img);
+            self.thumb_touched(ctx, &name);
             return Some((id, egui::vec2(img.w as f32, img.h as f32)));
         }
         let scale = width as f32 / src_w.max(1) as f32;
         let project = self.session.project.clone();
         self.frames.request(key, rate.tick_of(frame), scale, &project, 50);
-        self.texture_existing(&name)
+        let shown = self.texture_existing(&name);
+        if shown.is_some() {
+            self.thumb_touched(ctx, &name);
+        }
+        shown
+    }
+
+    /// Note that thumbnail texture `name` is used in this pass, and free the least recently used
+    /// thumbnails once there are more than [`MAX_THUMB_TEXTURES`]: every frame shown in a timeline
+    /// tile or a hover scrub got a texture of its own that was never freed (#1682).
+    fn thumb_touched(&mut self, ctx: &egui::Context, name: &str) {
+        let pass = ctx.cumulative_pass_nr();
+        if self.thumb_used.insert(name.to_string(), pass).is_some() || self.thumb_used.len() <= MAX_THUMB_TEXTURES {
+            return;
+        }
+        // down to three quarters, never a thumbnail already drawn in this pass
+        let mut old: Vec<(u64, String)> = self.thumb_used.iter().filter(|(_, p)| **p < pass).map(|(n, p)| (*p, n.clone())).collect();
+        old.sort_unstable();
+        let excess = self.thumb_used.len().saturating_sub(MAX_THUMB_TEXTURES * 3 / 4);
+        for (_, n) in old.into_iter().take(excess) {
+            self.thumb_used.remove(&n);
+            self.textures.remove(&n);
+        }
+    }
+
+    /// The number of thumbnail textures held (tests, diagnostics).
+    pub fn thumbnail_textures(&self) -> usize {
+        self.textures.keys().filter(|n| n.starts_with("thumb-")).count()
     }
 
     // ---------------------------------------------------------------- files
@@ -1377,63 +1773,87 @@ impl FilmcraftApp {
         })
     }
 
-    /// Import dropped files. With Timeline ▸ drop imports to the timeline, the new items are also
-    /// queued to be placed at the pointer (see `timeline::interact`).
+    /// Import dropped files, on the main window and on dock panels in their own OS windows.
+    /// With Timeline ▸ drop imports to the timeline, the new items are also queued to be placed
+    /// at the pointer (see `timeline::interact`).
     fn handle_drops(&mut self, ctx: &egui::Context) {
+        let to_timeline = self.session.prefs.timeline.drop_import_to_timeline;
         // While files hover, the OS sends no cursor events: poll the cursor each frame to draw the Timeline preview.
         let hovering = ctx.input(|i| i.raw.hovered_files.len());
-        self.file_drag_hover = if hovering > 0 && self.session.prefs.timeline.drop_import_to_timeline {
+        self.file_drag_hover = None;
+        if hovering > 0 && to_timeline {
             ctx.request_repaint();
-            self.drop_pointer(ctx).map(|p| (hovering, p))
-        } else {
-            None
-        };
-        let dropped = ctx.input(|i| i.raw.dropped_files.clone());
-        let mut paths = Vec::new();
-        for f in dropped {
-            let p = f.path();
-            if p.exists() {
-                paths.push(p.to_string_lossy().to_string());
-            }
+            self.file_drag_hover = self.drop_pointer(ctx, egui::ViewportId::ROOT, None).map(|p| (hovering, p, egui::ViewportId::ROOT));
         }
-        if !paths.is_empty() {
-            let pointer = self.drop_pointer(ctx);
-            let imported = self.session.execute("file.import", json!({"paths": paths, "bin": self.import_bin().0}));
-            if let Ok(v) = imported
-                && let Some(pos) = pointer
-                && self.session.prefs.timeline.drop_import_to_timeline
-            {
-                let items: Vec<filmcraft_engine::project::ItemId> =
-                    v["items"].as_array().map(|a| a.iter().filter_map(|i| i.as_u64()).map(filmcraft_engine::project::ItemId).collect()).unwrap_or_default();
-                if !items.is_empty() {
-                    self.pending_timeline_drop = Some((items, pos));
-                }
+        let dropped = ctx.input(|i| i.raw.dropped_files.clone());
+        if !dropped.is_empty() {
+            let pointer = self.drop_pointer(ctx, egui::ViewportId::ROOT, None);
+            self.import_dropped(&dropped, pointer.map(|p| (p, egui::ViewportId::ROOT)));
+        }
+        for files in std::mem::take(&mut self.window_files) {
+            // Only the Timeline places files at the pointer; elsewhere they go to the bin.
+            let at_timeline = to_timeline && files.panel == PanelKind::Timeline;
+            let pointer = if at_timeline { self.drop_pointer(ctx, files.viewport, files.pos) } else { None };
+            if !files.hovered.is_empty() && self.file_drag_hover.is_none() && at_timeline {
+                ctx.request_repaint();
+                self.file_drag_hover = pointer.map(|p| (files.hovered.len(), p, files.viewport));
+            }
+            if !files.dropped.is_empty() {
+                self.import_dropped(&files.dropped, pointer.map(|p| (p, files.viewport)));
             }
         }
     }
 
-    /// Where files dragged in from the OS are over the window. The OS reports no cursor motion during such a drag
-    /// (winit, Windows), so ask it through the host hook, else use the last pointer position egui saw.
-    fn drop_pointer(&self, ctx: &egui::Context) -> Option<egui::Pos2> {
+    /// Import the dropped files that exist; with a pointer and Timeline ▸ drop imports to the
+    /// timeline, queue the new items for the Timeline drawn in that viewport.
+    fn import_dropped(&mut self, dropped: &[egui::DroppedFileHandle], pointer: Option<(egui::Pos2, egui::ViewportId)>) {
+        let paths: Vec<String> = dropped.iter().map(|f| f.path()).filter(|p| p.exists()).map(|p| p.to_string_lossy().to_string()).collect();
+        if paths.is_empty() {
+            return;
+        }
+        let imported = self.session.execute("file.import", json!({"paths": paths, "bin": self.import_bin().0}));
+        if let Ok(v) = imported
+            && let Some((pos, viewport)) = pointer
+            && self.session.prefs.timeline.drop_import_to_timeline
+        {
+            let items: Vec<filmcraft_engine::project::ItemId> =
+                v["items"].as_array().map(|a| a.iter().filter_map(|i| i.as_u64()).map(filmcraft_engine::project::ItemId).collect()).unwrap_or_default();
+            if !items.is_empty() {
+                self.pending_timeline_drop = Some((items, pos, viewport));
+            }
+        }
+    }
+
+    /// Where files dragged in from the OS are over `viewport`. The OS reports no cursor motion during such a drag
+    /// (winit, Windows), so ask it through the host hook, else use `last` (a native window's last
+    /// pointer position), else the last pointer position egui saw in the main window.
+    fn drop_pointer(&self, ctx: &egui::Context, viewport: egui::ViewportId, last: Option<egui::Pos2>) -> Option<egui::Pos2> {
         let os_pointer = self
             .hooks
             .cursor_screen_position
             .as_ref()
             .and_then(|f| f())
-            .and_then(|px| ctx.input(|i| i.viewport().inner_rect.map(|r| screen_px_to_ui(px, i.pixels_per_point, r.min))));
-        os_pointer.or_else(|| ctx.input(|i| i.pointer.hover_pos().or(i.pointer.latest_pos())))
+            .and_then(|px| ctx.input_for(viewport, |i| i.viewport().inner_rect.map(|r| screen_px_to_ui(px, i.pixels_per_point, r.min))));
+        let fallback = || if viewport == egui::ViewportId::ROOT { ctx.input(|i| i.pointer.hover_pos().or(i.pointer.latest_pos())) } else { None };
+        os_pointer.or(last).or_else(fallback)
     }
 
     // ---------------------------------------------------------------- input
 
     /// Sends the menu tree to the native menu bar when it changed, so its items show the same
     /// labels, shortcuts and enablement as the in-window menus (Undo with nothing to undo is
-    /// disabled). Without a native menu bar this does nothing.
-    fn sync_native_menu(&mut self) {
+    /// disabled). The items a focused text field takes stay enabled while one has the keyboard.
+    /// Without a native menu bar this does nothing.
+    fn sync_native_menu(&mut self, ctx: &egui::Context) {
         if self.hooks.menu_changed.is_none() {
             return;
         }
-        let items = menus::menu_items(self);
+        let mut items = menus::menu_items(self);
+        if menus::text_field_window(ctx).is_some() {
+            for it in items.iter_mut().filter(|it| menus::edits_text(&it.id)) {
+                it.enabled = true;
+            }
+        }
         if items == self.menu_sent {
             return;
         }
@@ -1443,24 +1863,29 @@ impl FilmcraftApp {
         self.menu_sent = items;
     }
 
-    /// Whether keyboard focus is on a dock divider or a floating panel's resize grip, as drawn last pass.
+    /// Whether keyboard focus is on any dock divider or floating-window resize grip, as drawn last pass.
     fn divider_focused(&self, ctx: &egui::Context) -> bool {
+        use craft_ui::docking::{DockArea, Hit};
         let Some(focused) = ctx.memory(|m| m.focused()) else { return false };
-        self.auto
-            .previous
+        let area = dock_ui::area_id();
+        DockArea::<PanelKind>::hit_rects(ctx, area)
             .iter()
-            .any(|e| e.response_id == Some(focused) && (e.id.starts_with("dock.gutter.") || (e.id.starts_with("panel.float.") && e.id.ends_with(".resize"))))
+            .any(|(hit, _)| matches!(hit, Hit::Divider(_) | Hit::Resize(..)) && DockArea::hit_id(area, hit) == focused)
     }
 
+    /// Per-pass shortcut handling: reset the pasted image, rebuild bindings only when the shortcut revision or workspace set changes, and leave unmodified keys
+    /// to a focused text field except dock dividers.
     fn handle_shortcuts(&mut self, ctx: &egui::Context) {
+        // A paste image payload belongs to the paste event in this pass only.
+        self.pasted_image = None;
         let workspaces = (dock::names(&self.workspaces), self.ui.workspace.clone());
         if self.bindings_rev != self.session.shortcuts.revision || workspaces != self.menu_workspaces {
             self.menu_workspaces = workspaces;
             self.bindings = menus::bindings(self);
             self.bindings_rev = self.session.shortcuts.revision;
         }
-        // A pane divider or floating-panel grip keeps focus after a pointer drag so arrows can
-        // nudge it, but it takes no other key: Space and the other shortcuts keep working (#1482).
+        // A focused dock divider or floating-window grip takes the arrow keys to nudge it, but no
+        // other key: Space and the other shortcuts keep working (#1482).
         let divider_focused = self.divider_focused(ctx);
         if (ctx.egui_wants_keyboard_input() && !divider_focused) || self.dialog == Some(Dialog::Shortcuts) {
             return;
@@ -1476,60 +1901,108 @@ impl FilmcraftApp {
             let _ = self.session.execute("trim.cancelDynamic", json!({}));
         }
         panels::masks::pen_take_back(self, ctx, text_focused);
+        let fire = ctx.input_mut(|i| self.match_shortcuts(i, text_focused, divider_focused));
+        self.fire_shortcuts(ctx, fire);
+    }
+
+    /// Key, text and clipboard events that a floating panel in its own OS window left over
+    /// (`DockOutput::forwarded_events`): they run the main window's bindings in the frame they
+    /// arrive, so shortcuts work while a floating window has focus. craft-ui forwards nothing
+    /// while that window's text field has focus.
+    pub(crate) fn handle_forwarded_keys(&mut self, ctx: &egui::Context, events: Vec<egui::Event>) {
+        if events.is_empty() || self.dialog == Some(Dialog::Shortcuts) {
+            return;
+        }
+        let mut input = egui::InputState::default();
+        input.modifiers = self.floating_window_modifiers(ctx);
+        input.events = events;
+        if self.session.trim_play.dynamic.is_some() && input.consume_key(egui::Modifiers::NONE, egui::Key::Escape) {
+            let _ = self.session.execute("trim.cancelDynamic", json!({}));
+        }
+        let fire = self.match_shortcuts(&mut input, false, false);
+        self.fire_shortcuts(ctx, fire);
+    }
+
+    /// The modifiers held in the focused native floating window. Copy, Cut and Paste events
+    /// carry none, and egui-winit drops the key press they stand for.
+    fn floating_window_modifiers(&self, ctx: &egui::Context) -> egui::Modifiers {
+        self.ui
+            .dock
+            .floating
+            .iter()
+            .filter(|window| window.native.is_some())
+            .map(|window| craft_ui::docking::DockArea::<PanelKind>::window_viewport(dock_ui::area_id(), window.id))
+            .find_map(|viewport| ctx.input_for(viewport, |i| (i.viewport().focused == Some(true)).then_some(i.modifiers)))
+            .unwrap_or_default()
+    }
+
+    /// The binding ids the key presses in `i` fire, consuming those presses.
+    fn match_shortcuts(&mut self, i: &mut egui::InputState, text_focused: bool, divider_focused: bool) -> Vec<String> {
         // Panel shortcuts of the focused panel override application shortcuts on the same chord.
         // egui ignores extra Shift and Alt when matching, so the most specific chords go first
         // across both scopes (the sort is stable, so the panel still wins a tie): otherwise the
         // Timeline's `Delete` (Clear) swallows the app-wide `Shift+Delete` (Ripple Delete) (#680).
         let focused = self.ui.focused.title();
         let mut fire = Vec::new();
-        ctx.input_mut(|i| {
-            let modifiers = i.modifiers;
-            // With no text on the system clipboard, egui-winit drops the Ctrl+V press but still
-            // passes its release: put the press back, so Paste can paste files or an image (#611).
-            let mut swallowed = None;
-            for e in &i.events {
-                match e {
-                    egui::Event::Key { key: egui::Key::V, pressed, modifiers: m, .. } => {
-                        if !pressed && !self.v_down {
-                            swallowed = Some(*m);
-                        }
-                        self.v_down = *pressed;
+        let modifiers = i.modifiers;
+        // With no text on the system clipboard, egui-winit drops the Ctrl+V press but still
+        // passes its release: put the press back, so Paste can paste files or an image (#611).
+        let mut swallowed = None;
+        for e in &i.events {
+            match e {
+                egui::Event::Key { key: egui::Key::V, pressed, modifiers: m, .. } => {
+                    if !pressed && !self.v_down {
+                        swallowed = Some(*m);
                     }
-                    egui::Event::Paste(_) if modifiers.command => self.v_down = true,
-                    _ => {}
+                    self.v_down = *pressed;
                 }
+                egui::Event::PasteImage(image) => {
+                    // Keep the delivered pixels; re-reading the OS clipboard later is racy and
+                    // the web host has no clipboard-media hook at all.
+                    self.pasted_image = Some(image.clone());
+                    if modifiers.command {
+                        self.v_down = true;
+                    }
+                }
+                egui::Event::Paste(_) if modifiers.command => self.v_down = true,
+                _ => {}
             }
-            if let Some(m) = swallowed {
-                i.events.push(egui::Event::Key {
-                    key: egui::Key::V,
-                    physical_key: Some(egui::Key::V),
-                    pressed: true,
-                    repeat: false,
-                    modifiers: m | egui::Modifiers::COMMAND,
-                });
+        }
+        if let Some(m) = swallowed {
+            i.events.push(egui::Event::Key {
+                key: egui::Key::V,
+                physical_key: Some(egui::Key::V),
+                pressed: true,
+                repeat: false,
+                modifiers: m | egui::Modifiers::COMMAND,
+            });
+        }
+        clipboard_events_as_keys(&mut i.events, modifiers);
+        let panel = self.bindings.iter().filter(|b| b.3.as_deref() == Some(focused));
+        let app_wide = self.bindings.iter().filter(|b| b.3.is_none());
+        let mut candidates: Vec<&menus::KeyBinding> = panel.chain(app_wide).collect();
+        candidates.sort_by_key(|b| std::cmp::Reverse(menus::specificity(b.0)));
+        for (m, k, id, _) in candidates {
+            // With a text field focused, an unmodified key belongs to the field (and to the input
+            // method composing in it), not to a tool shortcut: `J`, `Z`, `R`, `A`… are the keys
+            // Vietnamese Telex combines into diacritics (#243). Chords with a modifier stay:
+            // Ctrl+S and friends are not something a text field or an IME consumes.
+            if lets_text_field_keep(*m, text_focused) {
+                continue;
             }
-            clipboard_events_as_keys(&mut i.events, modifiers);
-            let panel = self.bindings.iter().filter(|b| b.3.as_deref() == Some(focused));
-            let app_wide = self.bindings.iter().filter(|b| b.3.is_none());
-            let mut candidates: Vec<&menus::KeyBinding> = panel.chain(app_wide).collect();
-            candidates.sort_by_key(|b| std::cmp::Reverse(menus::specificity(b.0)));
-            for (m, k, id, _) in candidates {
-                // With a text field focused, an unmodified key belongs to the field (and to the input
-                // method composing in it), not to a tool shortcut: `J`, `Z`, `R`, `A`… are the keys
-                // Vietnamese Telex combines into diacritics (#243). Chords with a modifier stay:
-                // Ctrl+S and friends are not something a text field or an IME consumes.
-                if lets_text_field_keep(*m, text_focused) {
-                    continue;
-                }
-                // The focused divider consumes the arrows itself (egui matches them with any Shift/Alt).
-                if divider_focused && matches!(k, egui::Key::ArrowLeft | egui::Key::ArrowRight | egui::Key::ArrowUp | egui::Key::ArrowDown) {
-                    continue;
-                }
-                if i.consume_key(*m, *k) {
-                    fire.push(id.clone());
-                }
+            // The focused divider consumes the arrows itself (egui matches them with any Shift/Alt).
+            if divider_focused && matches!(k, egui::Key::ArrowLeft | egui::Key::ArrowRight | egui::Key::ArrowUp | egui::Key::ArrowDown) {
+                continue;
             }
-        });
+            if i.consume_key(*m, *k) {
+                fire.push(id.clone());
+            }
+        }
+        fire
+    }
+
+    /// Run the commands of the bindings `match_shortcuts` fired, as the focused panel scopes them.
+    fn fire_shortcuts(&mut self, ctx: &egui::Context, fire: Vec<String>) {
         for mut id in fire {
             // Select All / Deselect All act on the Project panel's items when it has focus (#168).
             // Select All takes only what the shown bin lists, not the whole project (#456).
@@ -1566,6 +2039,8 @@ impl FilmcraftApp {
                 self.ui.status = e;
             }
         }
+        // Only the paste action of this pass may consume the event's image.
+        self.pasted_image = None;
     }
 
     // ---------------------------------------------------------------- control channel
@@ -1578,19 +2053,29 @@ impl FilmcraftApp {
         ctx.request_repaint();
     }
 
+    /// Drain queued control requests without blocking: UI requests wait for a layout pass with a 3 s deadline (except screenshots), non-UI requests run now,
+    /// and hidden windows are raised and repainted.
     fn drain_control(&mut self, ctx: &egui::Context) {
         let Some(rx) = self.control_rx.take() else { return };
-        let now = ctx.input(|i| i.time);
+        let now = self.now();
         let mut reqs: Vec<(ControlRequest, f64)> = std::mem::take(&mut self.deferred);
         while let Ok(req) = rx.try_recv() {
             // UI requests need rendered frames: raise the window if `ui` hasn't run recently
             // (occluded macOS windows stop running `ui`).
             if req.method.starts_with("ui.") && now - self.last_ui_time > 0.25 {
                 self.raise_for_control(ctx);
+                // A hidden native window still needs a real UI pass for widget state/geometry.
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
             }
             reqs.push((req, now + 3.0));
         }
         for (req, deadline) in reqs {
+            if req.method.starts_with("ui.") && req.method != "ui.screenshot" {
+                self.ui_requests.push((req, deadline));
+                ctx.request_repaint();
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+                continue;
+            }
             let reply = req.reply.clone();
             match control::handle(self, ctx, &req) {
                 control::Outcome::Done(v) => {
@@ -1606,72 +2091,56 @@ impl FilmcraftApp {
                 }
                 control::Outcome::AfterInput => self.input_waiters.push(reply),
                 control::Outcome::Screenshot { path, crop } => {
-                    let token = self.next_token;
-                    self.next_token += 1;
-                    let settle = ctx.input(|i| i.time) + 0.25;
-                    self.queued_screenshots.push((token, settle, 0));
-                    self.pending_screenshots.push((token, path, crop, reply, settle + SCREENSHOT_TIMEOUT_S));
+                    capture::admit(self, ctx, path, crop, reply);
                 }
             }
         }
         self.control_rx = Some(rx);
-    }
-
-    /// Capture once the UI shows the current state (`settled`): after a seek the monitor shows the
-    /// nearest cached picture until the exact frame is decoded, and an agent must not be handed
-    /// the stand-in.
-    fn issue_screenshots(&mut self, ctx: &egui::Context, settled: bool) {
-        let now = ctx.input(|i| i.time);
-        let mut any = false;
-        self.queued_screenshots.retain_mut(|(token, at, frames)| {
-            *frames += 1;
-            any = true;
-            if now >= *at && *frames >= 3 && (settled || now >= *at + SCREENSHOT_SETTLE_MAX_S) {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::UserData::new(*token)));
-                false
-            } else {
-                true
-            }
-        });
-        // A hidden window (or a sleeping display) never presents, so its screenshot never
-        // arrives: give up instead of waiting (and repainting) forever.
-        self.pending_screenshots.retain(|(.., reply, deadline)| {
+        self.ui_requests.retain(|(req, deadline)| {
             if now > *deadline {
-                let _ = reply.send(json!({"ok": false, "error": "no frame was presented (window hidden or display asleep)"}));
+                let _ = req.reply.send(json!({"ok": false, "error": "no UI pass ran before the control request deadline"}));
                 false
             } else {
                 true
             }
         });
-        if any {
-            ctx.request_repaint();
-        } else if !self.pending_screenshots.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
-        }
     }
 
-    fn collect_screenshots(&mut self, ctx: &egui::Context) {
-        if self.pending_screenshots.is_empty() {
-            return;
-        }
-        let events: Vec<_> = ctx.input(|i| {
-            i.raw
-                .events
-                .iter()
-                .filter_map(|e| match e {
-                    egui::Event::Screenshot { user_data, image, .. } => {
-                        let token = user_data.data.as_ref().and_then(|d| d.downcast_ref::<u64>()).copied()?;
-                        Some((token, image.clone()))
+    /// Process control requests that need the current layout/response. Called at the end of a
+    /// final, non-discarded UI pass; `ui.click`/`ui.drag` queue synthetic input for the next pass.
+    fn drain_ui_requests(&mut self, ctx: &egui::Context) {
+        let reqs = std::mem::take(&mut self.ui_requests);
+        let now = self.now();
+        let mut pending = reqs.into_iter();
+        while let Some((req, deadline)) = pending.next() {
+            // A panel/dock/resize request changes the next layout. Anything after it in this
+            // batch (ui.click, ui.elements, ui.screenshot, …) must see the new geometry, so it
+            // waits for the next accepted pass rather than reading the layout drawn before it.
+            let changes_layout = matches!(req.method.as_str(), "ui.set" | "ui.panel.show" | "ui.panel.close" | "ui.resize");
+            let reply = req.reply.clone();
+            match control::handle(self, ctx, &req) {
+                control::Outcome::Done(v) => {
+                    let _ = reply.send(v);
+                }
+                control::Outcome::Retry(msg) => {
+                    if now < deadline {
+                        self.ui_requests.push((req, deadline));
+                        ctx.request_repaint();
+                    } else {
+                        let _ = reply.send(json!({"ok": false, "error": msg}));
                     }
-                    _ => None,
-                })
-                .collect()
-        });
-        for (token, image) in events {
-            if let Some(i) = self.pending_screenshots.iter().position(|(t, ..)| *t == token) {
-                let (_, path, crop, reply, _) = self.pending_screenshots.remove(i);
-                let r = control::save_screenshot(ctx, &image, path.as_deref(), crop);
-                let _ = reply.send(r);
+                }
+                control::Outcome::AfterInput => self.input_waiters.push(reply),
+                control::Outcome::Screenshot { path, crop } => capture::admit(self, ctx, path, crop, reply),
+            }
+            if changes_layout {
+                let rest: Vec<_> = pending.collect();
+                if !rest.is_empty() {
+                    self.ui_requests.extend(rest);
+                    ctx.request_repaint();
+                    ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+                }
+                break;
             }
         }
     }
@@ -1683,22 +2152,21 @@ impl FilmcraftApp {
     /// stamp the project's media files on a worker thread and read the changed ones again
     /// ([`filmcraft_engine::media_watch`]).
     #[cfg(not(target_arch = "wasm32"))]
-    fn tick_media_refresh(&mut self, ctx: &egui::Context) {
+    fn tick_media_refresh(&mut self, ctx: &egui::Context, now: f64) {
         if let Some(r) = self.session.poll_media_scan() {
             match r {
                 Ok(r) => {
                     if let Some(n) = r["refreshed"].as_array().map(Vec::len).filter(|n| *n > 0) {
-                        self.toast = Some((format!("Refreshed {n} media item(s) changed on disk"), ctx.input(|i| i.time)));
+                        self.toast = Some((format!("Refreshed {n} media item(s) changed on disk"), now));
                     }
                 }
-                Err(e) => self.toast = Some((e.to_string(), ctx.input(|i| i.time))),
+                Err(e) => self.toast = Some((e.to_string(), now)),
             }
         }
         let media = &self.session.prefs.media;
         let (on, every) = (media.refresh_growing_files, f64::from(media.growing_refresh_seconds.max(1)));
-        let (last_key, focus_key) = (egui::Id::new("mediaWatch.lastScan"), egui::Id::new("mediaWatch.focused"));
-        let now = ctx.input(|i| i.time);
-        let focused = ctx.input(|i| i.focused);
+        let (last_key, focus_key) = (egui::Id::unique("mediaWatch.lastScan"), egui::Id::unique("mediaWatch.focused"));
+        let focused = self.native_window_focused.unwrap_or(false);
         let was_focused: bool = ctx.data(|d| d.get_temp(focus_key)).unwrap_or(focused);
         ctx.data_mut(|d| d.insert_temp(focus_key, focused));
         if !on || filmcraft_engine::media_watch::media_files(&self.session.project, &self.session.media).is_empty() {
@@ -1713,63 +2181,15 @@ impl FilmcraftApp {
         ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait));
     }
 
+    /// Top-level UI pass: set the language, honor the injected panic test hook, lay out header, body and status bar, and dispatch the active mode.
     fn frame(&mut self, ui: &mut egui::Ui) {
         i18n::set_current(self.ui.language);
         if std::mem::take(&mut self.panic_next_frame) {
             crash::injected_fault("injected UI fault");
         }
         let ctx = ui.ctx().clone();
-        self.auto.begin_frame();
-        panels::metadata::follow_selection(self);
-        self.frames.set_context(&ctx);
-        self.session.poll_persistence();
-        panels::trim_monitor::advance(self, &ctx);
-        if self.session.persistence.is_some() && self.session.is_dirty() {
-            // Keep polling the auto-save worker (status, "also save the project" results).
-            ctx.request_repaint_after(std::time::Duration::from_secs(1));
-        }
-        self.sync_pool();
-        self.apply_prefs(&ctx);
-        #[cfg(not(target_arch = "wasm32"))]
-        self.tick_media_refresh(&ctx);
-        for ev in self.session.drain_events() {
-            match ev {
-                filmcraft_engine::Event::OpenSequence(_) => {
-                    // show the sequence with its own view (or fitted, the first time)
-                    self.timeline_view_of = None;
-                    if !self.ui.floating.iter().any(|group| group.panels.contains(&PanelKind::Timeline)) {
-                        self.ui.dock.restore_timeline();
-                    }
-                    let _ = self.apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Timeline });
-                }
-                filmcraft_engine::Event::OpenSource(_) => {
-                    let _ = self.apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Source });
-                }
-                filmcraft_engine::Event::RevealInProject(item) => self.reveal_in_project(item),
-                filmcraft_engine::Event::Toast { message, .. } => self.toast = Some((message, ctx.input(|i| i.time))),
-                filmcraft_engine::Event::ProjectChanged { .. } => {}
-            }
-        }
-        self.sync_timeline_view();
-        self.handle_drops(&ctx);
-        if let Some(rx) = self.command_inbox.take() {
-            while let Ok(id) = rx.try_recv() {
-                if self.control_input_only {
-                    continue;
-                }
-                if let Err(e) = menus::invoke(self, &ctx, &id, json!({})) {
-                    self.ui.status = e;
-                }
-            }
-            self.command_inbox = Some(rx);
-        }
-        self.begin_press(&ctx);
-        self.handle_shortcuts(&ctx);
-        self.sync_native_menu();
-        self.advance_playback(&ctx);
-        self.advance_source_playback(&ctx);
-        self.scrub_audio(&ctx);
-        // Text to Speech: a selected narration clip loads into the panel
+        // Text to Speech panel selection and its repaint cadence are presentation state; they do
+        // not poll a background queue.
         panels::tts::follow_selection(self);
         if self.ui.tts.pending.is_some() || self.ui.tts.download_job.is_some() {
             ctx.request_repaint_after(std::time::Duration::from_millis(100));
@@ -1777,7 +2197,7 @@ impl FilmcraftApp {
         let t = self.tokens;
         let full = ui.max_rect();
         ui.painter().rect_filled(full, 0.0, t.app_bg);
-        let header_h = if self.ui.show_header { 38.0 } else { 0.0 };
+        let header_h = if self.ui.show_header { header::HEIGHT } else { 0.0 };
         let header = egui::Rect::from_min_size(full.min, egui::vec2(full.width(), header_h));
         if self.ui.show_header {
             header::show(self, ui, header);
@@ -1792,9 +2212,8 @@ impl FilmcraftApp {
         // the Timeline has had its chance to place a file drop this frame; anything left stays a bin import
         self.pending_timeline_drop = None;
         panels::dialogs::show(self, &ctx);
+        updates_ui::show(self, &ctx);
         if !self.ui.show_status_bar {
-            // no bar to draw the job in, but a finished preview render still plays
-            self.watch_jobs(ui.ctx());
             return;
         }
         // Status / hint bar
@@ -1812,7 +2231,7 @@ impl FilmcraftApp {
         }
         let hint = if !self.ui.status.is_empty() { self.ui.status.clone() } else { self.hint_text() };
         ui.painter().text(egui::pos2(sb.min.x + 10.0, sb.center().y), egui::Align2::LEFT_CENTER, hint, Tokens::ui(11.0), t.text_dim);
-        let resp = ui.interact(sb, egui::Id::new("status-bar"), egui::Sense::click());
+        let resp = ui.interact(sb, egui::Id::unique("status-bar"), egui::Sense::click());
         if resp.clicked() {
             self.ui.status.clear();
         }
@@ -1821,7 +2240,7 @@ impl FilmcraftApp {
 
     /// The running job (export / render previews), if any; plays the rendered range when a preview
     /// render completes. Runs every frame, with or without the status bar.
-    fn watch_jobs(&mut self, ctx: &egui::Context) -> Option<filmcraft_engine::Job> {
+    fn poll_jobs(&mut self, ctx: &egui::Context) -> Option<filmcraft_engine::Job> {
         use std::sync::atomic::Ordering;
         let running = self.session.jobs.iter().rev().find(|j| !j.progress.finished.load(Ordering::Relaxed)).cloned();
         // Play after rendering previews.
@@ -1845,11 +2264,17 @@ impl FilmcraftApp {
         Some(job)
     }
 
+    /// The running job for drawing only; polling/play-after-render stays in logic.
+    fn running_job(&self) -> Option<filmcraft_engine::Job> {
+        use std::sync::atomic::Ordering;
+        self.session.jobs.iter().rev().find(|j| !j.progress.finished.load(Ordering::Relaxed)).cloned()
+    }
+
     /// Right side of the status bar: the running job (export / render previews) with a progress
     /// bar and a cancel button.
     fn job_status(&mut self, ui: &mut egui::Ui, sb: egui::Rect, t: &Tokens) {
         use std::sync::atomic::Ordering;
-        let Some(job) = self.watch_jobs(ui.ctx()) else { return };
+        let Some(job) = self.running_job() else { return };
         let f = job.progress.fraction().clamp(0.0, 1.0);
         let left = job.progress.eta().map(panels::left_text).unwrap_or_default();
         let cancel = egui::Rect::from_center_size(egui::pos2(sb.max.x - 14.0, sb.center().y), egui::vec2(14.0, 14.0));
@@ -1865,7 +2290,7 @@ impl FilmcraftApp {
             Tokens::ui(11.0),
             t.text_dim,
         );
-        let resp = ui.interact(cancel, egui::Id::new(("job-cancel", job.id)), egui::Sense::click());
+        let resp = ui.interact(cancel, egui::Id::unique(("job-cancel", job.id)), egui::Sense::click());
         let c = if resp.hovered() { t.hot_text } else { t.text_dim };
         let k = 3.5;
         p.line_segment([cancel.center() - egui::vec2(k, k), cancel.center() + egui::vec2(k, k)], egui::Stroke::new(1.4, c));
@@ -1913,13 +2338,23 @@ impl FilmcraftApp {
         }
     }
 
+    /// Latch Escape during pass 0, where the key event is fresh.
+    fn latch_escape_cancel(&mut self, ctx: &egui::Context) {
+        if ctx.input(|i| i.pointer.any_down() && i.key_pressed(egui::Key::Escape)) {
+            self.escape_cancel = true;
+        }
+    }
+
     /// Escape while a mouse button is held takes back every edit this press made (#580): value
     /// drags (one merged step or one step per change), color picks, anything committed on the
-    /// Escape frame. Run after the panels, so a value sent on the Escape frame goes with it.
-    fn cancel_value_drag(&mut self, ctx: &egui::Context) {
-        let escape = ctx.input(|i| i.pointer.any_down() && i.key_pressed(egui::Key::Escape));
+    /// Escape frame. Called once after the final non-discarded UI pass; the latch outlives a
+    /// discarded pass, and pass 1+ has no Escape key event to re-read.
+    fn cancel_value_drag(&mut self, _ctx: &egui::Context) {
+        if !self.escape_cancel {
+            return;
+        }
+        self.escape_cancel = false;
         if let Some((press, mark)) = self.value_press
-            && escape
             && self.session.revert_to(mark) > 0
         {
             self.value_press = Some((press, self.session.undo_mark()));
@@ -1934,7 +2369,7 @@ impl FilmcraftApp {
         let Some(msg) = self.ui_error.clone() else { return };
         let mut close = false;
         egui::Window::new(tl!("FilmCraft hit an error"))
-            .id(egui::Id::new("FilmCraft hit an error"))
+            .id(egui::Id::unique("FilmCraft hit an error"))
             .collapsible(false)
             .resizable(false)
             .pivot(egui::Align2::CENTER_CENTER)
@@ -1965,6 +2400,31 @@ impl FilmcraftApp {
     }
 }
 
+/// `--control-input-only`: drop the window system's input. Screenshot results arrive through
+/// `ScreenshotCallback`, not raw input; all viewport lifecycle and geometry data stay.
+fn drop_native_input(raw_input: &mut egui::RawInput) {
+    raw_input.events.clear();
+    raw_input.hovered_files.clear();
+    raw_input.dropped_files.clear();
+}
+
+/// The main window's input rewrite ([`eframe::App::raw_input_hook`]) for a dock panel in its
+/// own OS window, which eframe does not run the hook for: macOS Control+Click becomes a
+/// secondary click, and `--control-input-only` drops the window system's input. Control
+/// gestures go to the main window only, so nothing is added.
+pub(crate) fn rewrite_native_window_input(
+    control_input_only: bool,
+    #[cfg_attr(not(target_os = "macos"), allow(unused_variables))] armed: &Mutex<HashMap<egui::ViewportId, bool>>,
+    raw_input: &mut egui::RawInput,
+) {
+    if control_input_only {
+        drop_native_input(raw_input);
+    } else {
+        #[cfg(target_os = "macos")]
+        synthesize_mac_ctrl_click(armed.lock().unwrap_or_else(std::sync::PoisonError::into_inner).entry(raw_input.viewport_id).or_default(), raw_input);
+    }
+}
+
 /// On macOS a Control+Click means "right click": AppKit delivers it to the view as a *primary*
 /// press carrying the Control modifier (`rightMouseDown:` only fires for a real right button or
 /// two-finger click), so the app translates it to a secondary click before egui computes pointer
@@ -1996,51 +2456,15 @@ fn synthesize_mac_ctrl_click(armed: &mut bool, raw_input: &mut egui::RawInput) {
     }
 }
 
-impl eframe::App for FilmcraftApp {
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw_input: &mut egui::RawInput) {
-        self.native_window_focused = Some(raw_input.focused);
-        #[cfg(target_os = "macos")]
-        if !self.control_input_only {
-            synthesize_mac_ctrl_click(&mut self.mac_ctrl_click_armed, raw_input);
-        }
-        if self.control_input_only {
-            // Preserve screenshot responses and all viewport lifecycle/geometry metadata.
-            raw_input.events.retain(|event| matches!(event, egui::Event::Screenshot { .. }));
-            raw_input.hovered_files.clear();
-            raw_input.dropped_files.clear();
-        }
-        if self.control_input_only || !self.synthetic.is_empty() {
-            // Native modifiers cannot replace those requested by a control gesture. A queued
-            // reset runs in the frame after release, so clicked() still sees Shift/Alt.
-            raw_input.events.push(egui::Event::ModifiersChanged(self.synthetic_modifiers));
-            // Widget keyboard handling requires effective egui focus. Control input must work
-            // in a background window without activating it or taking the user's OS keyboard.
-            raw_input.focused = true;
-        }
-        if !self.synthetic.is_empty() {
-            // Pointer events go one per frame so egui sees press → moves → release as a real drag
-            // (all in one frame reads as a click); key/text runs go together up to a key release.
-            let pointer = |e: &egui::Event| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. } | egui::Event::MouseWheel { .. });
-            let n = if pointer(&self.synthetic[0]) {
-                1
-            } else {
-                self.synthetic
-                    .iter()
-                    .position(|e| pointer(e) || matches!(e, egui::Event::Key { pressed: false, .. }))
-                    .map_or(self.synthetic.len(), |i| if pointer(&self.synthetic[i]) { i.max(1) } else { i + 1 })
-            };
-            for event in self.synthetic.drain(..n) {
-                if let egui::Event::ModifiersChanged(modifiers) = event {
-                    self.synthetic_modifiers = modifiers;
-                }
-                raw_input.events.push(event);
-            }
-        }
-    }
+/// Install once in each native/web/harness Context creator, before the first UI pass.
+pub fn install_ime_reset_callbacks(ctx: &egui::Context) {
+    ime_reset::install(ctx);
+}
 
-    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        // a native file dialog's answer first, so the panels draw what it chose (#260)
-        self.poll_native_dialog(ctx);
+impl FilmcraftApp {
+    /// Install the theme once, then keep fonts ready; a saved language without its system face
+    /// falls back to English as before.
+    fn logic_theme(&mut self, ctx: &egui::Context) {
         if !self.styled {
             theme::install(ctx, &self.tokens);
             // theme::install replaces the fonts: add the system Japanese font back (or fall back to
@@ -2058,9 +2482,16 @@ impl eframe::App for FilmcraftApp {
         } else {
             self.fonts_ready = true;
         }
-        let now = ctx.input(|i| i.time);
+    }
+
+    /// Advance the monotonic host clock and the smoothed frame rate, returning the pass time.
+    /// Hidden playback is marked so a hidden window's skipped frames are not counted as drops.
+    fn logic_clock(&mut self, ctx: &egui::Context) -> f64 {
+        // Monotonic host time. Native and web both call logic once per layout pass and through
+        // `run_logic` while hidden; `ctx.input(i.time)` is stale in that second case.
+        let now = self.now();
         let dt = (now - self.last_time) as f32;
-        if dt > 0.0 {
+        if dt > 0.0 && dt.is_finite() {
             self.fps = self.fps * 0.9 + (1.0 / dt).min(480.0) * 0.1;
         }
         self.last_time = now;
@@ -2068,68 +2499,300 @@ impl eframe::App for FilmcraftApp {
             // Nothing is shown while the window is hidden: not a dropped frame.
             self.playback.hidden = true;
         }
-        self.timeline_still = if self.ui.timeline.animating() { 0 } else { self.timeline_still.saturating_add(1) };
+        now
+    }
+
+    /// Close-request handling and control-driven synthetic input, in the original order.
+    fn logic_control(&mut self, ctx: &egui::Context) {
         // Quitting with unsaved changes asks to save them first.
         if ctx.input(|i| i.viewport().close_requested()) && panels::clip_dialogs::intercept_quit(self) {
             ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
         }
-        let had_synthetic = !self.synthetic.is_empty();
+        let had_synthetic = !self.synthetic.is_empty() || self.synthetic_pending_step.is_some();
         self.drain_control(ctx);
-        if !self.synthetic.is_empty() && !had_synthetic {
+        if (!self.synthetic.is_empty() || self.synthetic_pending_step.is_some()) && !had_synthetic {
             // Occluded macOS windows stop running `ui`; bring the window forward (without taking
             // keyboard focus) so the input is processed.
             self.raise_for_control(ctx);
         }
-        if !self.synthetic.is_empty() {
+        if !self.synthetic.is_empty() || self.synthetic_pending_step.is_some() {
             ctx.request_repaint();
-        } else if !self.input_waiters.is_empty() {
-            for w in self.input_waiters.drain(..) {
-                let _ = w.send(json!({"ok": true, "result": null}));
+            // The next step is consumed by a UI pass, not by another logic tick. Native eframe
+            // honours this; the pinned web runner logs it as unhandled (a recorded fork gap).
+            ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+        }
+    }
+
+    /// Background queues and idempotent deadlines that are safe on every logic call.
+    fn logic_background(&mut self, ctx: &egui::Context, now: f64) {
+        self.frames.set_context(ctx);
+        self.frames.pump(std::time::Duration::from_millis(if self.playback.playing { 24 } else { 40 }));
+        self.session.poll_persistence();
+        panels::trim_monitor::advance_at(self, now);
+        if self.session.trim_play.active() {
+            ctx.request_repaint();
+        }
+        if self.session.persistence.is_some() && self.session.is_dirty() {
+            // Keep polling the auto-save worker (status, "also save the project" results) while hidden.
+            ctx.request_repaint_after(std::time::Duration::from_secs(1));
+        }
+        self.sync_pool();
+        updates_ui::tick(self, ctx);
+        #[cfg(not(target_arch = "wasm32"))]
+        self.tick_media_refresh(ctx, now);
+    }
+
+    /// Apply engine events that change the active sequence/view, IME target, toast or project.
+    fn logic_session_events(&mut self, now: f64) {
+        for ev in self.session.drain_events() {
+            match ev {
+                filmcraft_engine::Event::OpenSequence(_) => {
+                    // A sequence switch (including opening/reverting/recovering a project, which
+                    // emits this event for the newly active sequence) is a new IME owner context.
+                    self.restart_ime_target();
+                    // show the sequence with its own view (or fitted, the first time)
+                    self.timeline_view_of = None;
+                    self.ui.dock.restore_timeline();
+                    let _ = self.apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Timeline });
+                }
+                filmcraft_engine::Event::OpenSource(_) => {
+                    let _ = self.apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Source });
+                }
+                filmcraft_engine::Event::RevealInProject(item) => self.reveal_in_project(item),
+                filmcraft_engine::Event::Toast { message, .. } => self.toast = Some((message, now)),
+                filmcraft_engine::Event::ProjectChanged { .. } => {}
             }
         }
-        let settled = !std::mem::take(&mut self.monitor_inexact) && self.timeline_still > 0;
-        self.issue_screenshots(ctx, settled);
-        self.collect_screenshots(ctx);
     }
 
-    fn on_exit(&mut self) {
-        // Flush the recovery journal and stop the auto-save worker; a session with nothing unsaved
-        // removes its journal, one with unsaved changes keeps it for the next launch.
-        self.session.shutdown();
+    /// Drain native menu/control command ids, preserving the control-only Quit exception.
+    fn logic_command_inbox(&mut self, ctx: &egui::Context) {
+        if let Some(rx) = self.command_inbox.take() {
+            while let Ok(id) = rx.try_recv() {
+                // control-only mode ignores native menu commands, but Quit stays available (#1943)
+                if self.control_input_only && id != "app.quit" {
+                    continue;
+                }
+                if let Err(e) = menus::activate_native(self, ctx, &id) {
+                    self.ui.status = e;
+                }
+            }
+            self.command_inbox = Some(rx);
+        }
     }
 
-    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+    /// Run one logic pass in order: retain the later UI clock, poll the native dialog, apply the
+    /// logic subsystems, advance playback, poll jobs, then drain completed screenshots and ask
+    /// for hidden paints. Safe on hidden logic-only callbacks.
+    pub fn logic_inner(&mut self, ctx: &egui::Context) {
+        // Remember the pass's clock before anything reads `now()`. A hidden logic-only tick keeps
+        // the last UI time (which is stale there), so `now()` never runs behind the host clock.
+        self.ui_clock = self.ui_clock.max(ctx.input(|i| i.time));
+        // a native file dialog's answer first, so the panels draw what it chose (#260)
+        self.poll_native_dialog(ctx);
+        self.logic_theme(ctx);
+        let now = self.logic_clock(ctx);
+        self.logic_control(ctx);
+        self.logic_background(ctx, now);
+        self.logic_session_events(now);
+        self.logic_command_inbox(ctx);
+        self.advance_playback(ctx);
+        self.advance_source_playback(ctx);
+        self.poll_jobs(ctx);
+        capture::drain(self, ctx);
+        capture::request_hidden_paint(self, ctx);
+    }
+
+    /// Draw one real UI pass. Establish the UI clock offset once, run first-pass input handling,
+    /// draw panels under a panic guard, drain UI requests and check the IME editor only after
+    /// this pass's commands ran. Screenshots are offered to `capture::issue`, which issues only
+    /// on an accepted pass.
+    fn ui_inner(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+        if self.ui_clock_offset.is_none() {
+            let egui_time = ui.ctx().input(|input| input.time);
+            if egui_time.is_finite() {
+                let host = self.clock_start.elapsed().as_secs_f64();
+                // Never move host time backwards when a harness clock starts behind it; the host
+                // clock stays authoritative in that case.
+                self.ui_clock_offset = Some((egui_time - host).max(0.0));
+            }
+        }
         if !self.fonts_ready {
+            // This pass did not consume the pending synthetic input; the next hook must offer it
+            // again (the UI path does not preserve raw input across this early return).
+            self.synthetic_step_offered = false;
+            self.synthetic_modifiers_offered = false;
+            self.finish_ime_pass(ui.ctx());
             ui.ctx().request_repaint();
             return;
         }
-        // No frame worker threads on the web: render queued frames here, within a time budget
-        // that leaves room for the UI pass (a no-op where workers run).
-        self.frames.pump(std::time::Duration::from_millis(if self.playback.playing { 24 } else { 40 }));
+        frame.set_ui_language(Some(self.ui.language.bcp47()));
+        let ctx = ui.ctx().clone();
+        // A project/sequence replacement may have happened in the previous pass's control drain.
+        // Drop the old edit and IME composition before shortcuts or the frame see them.
+        self.sync_ime_target_context(&ctx);
+        // Each pass draws at most one editor; a stale entry from a previous pass must not be
+        // observed as this pass's editor.
+        self.ime_drawn_editor = None;
+        // Only an actual pass counts toward screenshot settlement; hidden logic ticks do not draw.
+        self.timeline_still = if self.ui.timeline.animating() { 0 } else { self.timeline_still.saturating_add(1) };
+        // This is a real UI pass: the one synthetic step offered to raw_input_hook has been fed to
+        // egui now. A hidden logic tick never reaches this point and keeps it pending.
+        self.synthetic_pending_step = None;
+        self.synthetic_step_offered = false;
+        self.synthetic_modifiers_offered = false;
+        let first_pass = ctx.current_pass_index() == 0;
+        if first_pass {
+            // Setup and fresh-input handling happen where `RawInput::events` are available. Pass 1+
+            // has no new events and must not re-run a click, shortcut or drop.
+            self.auto.begin_frame();
+            self.apply_prefs(&ctx);
+            self.sync_timeline_view();
+            panels::metadata::follow_selection(self);
+            self.handle_drops(&ctx);
+            self.begin_press(&ctx);
+            self.latch_escape_cancel(&ctx);
+            self.handle_shortcuts(&ctx);
+            self.sync_native_menu(&ctx);
+            self.scrub_audio(&ctx);
+        } else {
+            // Pass 1+ redraws the same frame; drop the discarded pass's registrations so lookups
+            // and `ui.elements` see one entry per widget, from the layout that is accepted.
+            self.auto.elements.clear();
+        }
         // A panic in one panel must not close the app (losing unsaved work) or leave a blank
         // window: catch it, keep the session, and say what happened.
         if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.frame(ui))).is_err() {
             self.ui_error = Some(crash::take_last().unwrap_or_else(|| "unknown error".into()));
             self.playback.playing = false;
         }
+        if !ctx.will_discard() {
+            self.cancel_value_drag(&ctx);
+        }
         self.error_window(ui.ctx());
         if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| graphics_notice::show(self, ui.ctx()))).is_err() {
             // a broken notice must not take the session down: drop it
             self.graphics_notice = None;
         }
-        let ctx = ui.ctx().clone();
-        self.last_ui_time = ctx.input(|i| i.time);
-        if !self.synthetic.is_empty() {
+        self.last_ui_time = self.now();
+        if !self.synthetic.is_empty() || self.synthetic_pending_step.is_some() {
             ctx.request_repaint();
-        } else if !self.input_waiters.is_empty() {
-            ctx.request_repaint();
-            for w in self.input_waiters.drain(..) {
-                let _ = w.send(json!({"ok": true, "result": null}));
-            }
         }
         if self.frames.queue_len() > 0 {
             ctx.request_repaint_after(std::time::Duration::from_millis(16));
         }
+        if !ctx.will_discard() {
+            self.drain_ui_requests(&ctx);
+        }
+        // Check only after this pass's control requests ran: `ui.menu.invoke`/`engine.execute`
+        // may have edited the text or replaced the target. Every other pass (hidden editor, focus
+        // in another panel, no editor at all) turns the composer off.
+        self.finish_ime_pass(&ctx);
+        // Ack `ui.*` waiters once the action had a final, non-discarded UI pass to apply in. Holding
+        // them through a discard avoids reporting success for a pass egui threw away.
+        if !ctx.will_discard() && self.synthetic.is_empty() && self.synthetic_pending_step.is_none() && !self.input_waiters.is_empty() {
+            for w in self.input_waiters.drain(..) {
+                let _ = w.send(json!({"ok": true, "result": null}));
+            }
+        }
+        // Only a real, accepted UI pass may issue a capture: it observes the final layout for this
+        // pass and `screenshot` itself forces the paint needed when the window is hidden.
+        capture::issue(self, &ctx);
+    }
+}
+
+impl eframe::App for FilmcraftApp {
+    /// Snapshot this callback's fresh surface geometry, optionally synthesize macOS ctrl-click
+    /// and agent input, and offer at most one queued synthetic step. A step already preserved by
+    /// hidden logic callbacks is not appended twice; a real UI pass clears it.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
+        self.native_window_focused = Some(raw_input.focused);
+        capture::note_raw_geometry(self, ctx, raw_input);
+        #[cfg(target_os = "macos")]
+        if !self.control_input_only {
+            synthesize_mac_ctrl_click(&mut self.mac_ctrl_click_armed, raw_input);
+        }
+        if self.control_input_only {
+            drop_native_input(raw_input);
+        }
+        if self.control_input_only || !self.synthetic.is_empty() || self.synthetic_pending_step.is_some() {
+            // Native modifiers cannot replace those requested by a control gesture. A queued
+            // reset runs in the frame after release, so clicked() still sees Shift/Alt.
+            if !self.synthetic_modifiers_offered {
+                raw_input.events.push(egui::Event::ModifiersChanged(self.synthetic_modifiers));
+                self.synthetic_modifiers_offered = true;
+            }
+            // Widget keyboard handling requires effective egui focus. Control input must work
+            // in a background window without activating it or taking the user's OS keyboard.
+            raw_input.focused = true;
+        }
+        if self.synthetic_pending_step.is_none() && !self.synthetic.is_empty() {
+            // Pointer events go one per frame so egui sees press → moves → release as a real drag
+            // (all in one frame reads as a click); key/text runs go together up to a key release.
+            let pointer = |e: &egui::Event| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. } | egui::Event::MouseWheel { .. });
+            let n = if pointer(&self.synthetic[0]) {
+                1
+            } else {
+                self.synthetic
+                    .iter()
+                    .position(|e| pointer(e) || matches!(e, egui::Event::Key { pressed: false, .. }))
+                    .map_or(self.synthetic.len(), |i| if pointer(&self.synthetic[i]) { i.max(1) } else { i + 1 })
+            };
+            let step: Vec<egui::Event> = self.synthetic.drain(..n).collect();
+            for event in &step {
+                if let egui::Event::ModifiersChanged(modifiers) = event {
+                    self.synthetic_modifiers = *modifiers;
+                }
+            }
+            self.synthetic_pending_step = Some(step);
+            self.synthetic_step_offered = false;
+        }
+        if let Some(step) = &self.synthetic_pending_step {
+            // `raw_input_hook` also runs before hidden `run_logic` ticks, whose raw input egui does
+            // not feed to widgets. Keep the exact same one-step batch pending and offer it again
+            // on the next callback; a real UI pass clears it at `ui()` start. Never coalesce a
+            // press with its release and, crucially, never append a step that the integration
+            // already preserved in its pending raw input: the UI pass would then see two copies.
+            if !self.synthetic_step_offered {
+                raw_input.events.extend(step.iter().cloned());
+                self.synthetic_step_offered = true;
+            }
+        }
+    }
+
+    /// Eframe's hidden logic callback: run the logic pass, sync the IME target context, then
+    /// suspend reset state because a logic-only callback is never a UI pass.
+    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        self.logic_inner(ctx);
+        self.finish_ime_reset_logic(ctx);
+    }
+
+    /// Cancel outstanding screenshots with one error reply each, end per-viewport IME reset
+    /// state, and shut the session down so its recovery journal is flushed or removed.
+    fn on_exit(&mut self) {
+        // Late screenshot callbacks now find a dropped slot and write nothing; clients get one error.
+        capture::cancel_all(self);
+        for viewport in self.ime_viewports.drain(..) {
+            self.ime_reset.end_viewport(viewport);
+        }
+        // Flush the recovery journal and stop the auto-save worker; a session with nothing unsaved
+        // removes its journal, one with unsaved changes keeps it for the next launch.
+        self.session.shutdown();
+    }
+
+    /// Eframe's UI entry: begin this pass's IME reset state, suspend custom controls when no
+    /// eligible editor owns input, draw `ui_inner`, then run end-of-pass IME reconciliation.
+    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+        let ctx = ui.ctx().clone();
+        self.ime_reset.begin_pass(&ctx);
+        self.ime_drawn_editor = None;
+        let focused = ctx.input(|input| input.viewport().focused.unwrap_or(input.focused));
+        let another_field = ctx.memory(|memory| memory.focused().is_some_and(|id| id != egui::Id::unique(panels::graphics::TEXT_EDIT_ID)));
+        if !self.fonts_ready || self.ui.gfx_edit.is_none() || self.ime_modal_blocks_input() || !focused || another_field {
+            self.suspended_ime_controls(&ctx);
+        }
+        self.ui_inner(ui, frame);
+        self.finish_ime_reset_ui(&ctx);
     }
 }
 
@@ -2223,9 +2886,9 @@ fn clipboard_events_as_keys(events: &mut Vec<egui::Event>, modifiers: egui::Modi
             Event::Cut if modifiers.command => Some(Key::X),
             Event::Cut if modifiers.shift => Some(Key::Delete),
             Event::Cut => Some(Key::Cut),
-            Event::Paste(_) if modifiers.command => Some(Key::V),
-            Event::Paste(_) if modifiers.shift => Some(Key::Insert),
-            Event::Paste(_) => Some(Key::Paste),
+            Event::Paste(_) | Event::PasteImage(_) if modifiers.command => Some(Key::V),
+            Event::Paste(_) | Event::PasteImage(_) if modifiers.shift => Some(Key::Insert),
+            Event::Paste(_) | Event::PasteImage(_) => Some(Key::Paste),
             _ => None,
         })
         .collect();
@@ -2242,12 +2905,17 @@ mod clipboard_key_tests {
         events.into_iter().filter_map(|e| if let Event::Key { key, modifiers, pressed: true, .. } = e { Some((key, modifiers)) } else { None }).collect()
     }
 
+    /// Clipboard Copy/Cut/Paste events become C/X/V key presses so they match the shortcut bindings.
     #[test]
     fn ctrl_c_x_v_become_key_presses() {
         let c = Modifiers::COMMAND;
         assert_eq!(keys(vec![Event::Copy], c), vec![(Key::C, c)]);
         assert_eq!(keys(vec![Event::Cut], c), vec![(Key::X, c)]);
         assert_eq!(keys(vec![Event::Paste("x".into())], c), vec![(Key::V, c)]);
+        let image = || Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::RED)));
+        assert_eq!(keys(vec![image()], c), vec![(Key::V, c)]);
+        assert_eq!(keys(vec![image()], Modifiers::SHIFT), vec![(Key::Insert, Modifiers::SHIFT)]);
+        assert_eq!(keys(vec![image()], Modifiers::NONE), vec![(Key::Paste, Modifiers::NONE)]);
     }
 
     #[test]
@@ -2276,6 +2944,22 @@ mod clipboard_key_tests {
     }
 }
 
+#[cfg(test)]
+mod forwarded_key_tests {
+    use egui::{Event, Key, Modifiers};
+
+    /// A key a floating native window left over runs the main window's bindings.
+    #[test]
+    fn forwarded_keys_fire_shortcuts() {
+        let mut app = super::FilmcraftApp::new(filmcraft_engine::Session::default());
+        app.bindings = super::menus::bindings(&app);
+        app.ui.focused = crate::dock::PanelKind::Timeline;
+        let shift_backtick = Event::Key { key: Key::Backtick, physical_key: Some(Key::Backtick), pressed: true, repeat: false, modifiers: Modifiers::SHIFT };
+        app.handle_forwarded_keys(&egui::Context::default(), vec![Event::Text("~".into()), shift_backtick]);
+        assert_eq!(app.ui.keys.maximized, Some(crate::dock::PanelKind::Timeline), "Shift+` maximizes the focused frame");
+    }
+}
+
 #[cfg(test)]
 mod mac_ctrl_click_tests {
     use egui::{Event, Modifiers, PointerButton, RawInput};
@@ -2316,7 +3000,7 @@ mod mac_ctrl_click_tests {
         let mut secondary = false;
         // No renderer here: drop the pass output, clearing its texture deltas so epaint's drop
         // guard does not panic on the font texture.
-        let mut out = ctx.run_ui(raw, |ctx| secondary = ctx.input(|i| i.pointer.secondary_clicked()));
+        let mut out = ctx.run_ui(raw, |ui| secondary = ui.ctx().input(|i| i.pointer.secondary_clicked()));
         out.textures_delta.clear();
         assert!(secondary);
     }
@@ -2405,12 +3089,32 @@ mod gpu_fallback_tests {
     }
 }
 
+#[cfg(test)]
+mod clock_tests {
+    use super::*;
+
+    /// The egui clock starts at the integration's beginning, which can precede `clock_start`.
+    /// Applying the captured offset to host time keeps hidden logic moving instead of freezing at
+    /// the last UI time and then jumping when the next UI pass arrives.
+    #[test]
+    fn now_applies_the_ui_clock_offset_and_keeps_the_test_override_first() {
+        let mut app = FilmcraftApp::new(Session::default());
+        app.ui_clock = 123.0;
+        app.ui_clock_offset = Some(1_000.0);
+        assert!(app.now() >= 1_000.0, "the captured offset moves the host clock to egui time");
+        app.ui_clock = 2_000.0;
+        assert_eq!(app.now(), 2_000.0, "an egui clock ahead of host+offset still wins");
+        app.set_now_for_test(7.0);
+        assert_eq!(app.now(), 7.0, "the deterministic test override keeps precedence");
+    }
+}
+
 #[cfg(test)]
 mod audio_recovery_tests {
     use super::*;
     use std::sync::{
         Arc,
-        atomic::{AtomicUsize, Ordering},
+        atomic::{AtomicBool, AtomicUsize, Ordering},
     };
 
     struct Device {
@@ -2481,15 +3185,26 @@ mod audio_recovery_tests {
                 Some(4_800)
             }
         }
-        let amplitude = |samples: &[f32], ch: usize, hz: f64| {
-            let (mut re, mut im) = (0.0, 0.0);
-            for (i, frame) in samples.as_chunks::<2>().0.iter().enumerate() {
-                let phase = std::f64::consts::TAU * hz * i as f64 / 48_000.0;
-                re += f64::from(frame[ch]) * phase.cos();
-                im += f64::from(frame[ch]) * phase.sin();
+        fn assert_shuttle_tones(buf: &[f32], maintain: bool, speed: f64) {
+            let amplitude = |samples: &[f32], ch: usize, hz: f64| {
+                let (mut re, mut im) = (0.0, 0.0);
+                for (i, frame) in samples.as_chunks::<2>().0.iter().enumerate() {
+                    let phase = std::f64::consts::TAU * hz * i as f64 / 48_000.0;
+                    re += f64::from(frame[ch]) * phase.cos();
+                    im += f64::from(frame[ch]) * phase.sin();
+                }
+                2.0 * re.hypot(im) / (samples.len() / 2) as f64
+            };
+            for (ch, tone) in [440.0, 660.0].into_iter().enumerate() {
+                let hz = if maintain { tone } else { tone * speed };
+                let level = amplitude(buf, ch, hz);
+                assert!(level > 0.08, "maintain={maintain}, speed={speed}, channel={ch}: {hz} Hz level={level}");
+                if speed != 1.0 {
+                    let wrong = if maintain { tone * speed } else { tone };
+                    assert!(amplitude(buf, ch, wrong) < level * 0.3, "wrong pitch {wrong} Hz at {speed}x, maintain={maintain}");
+                }
             }
-            2.0 * re.hypot(im) / (samples.len() / 2) as f64
-        };
+        }
         let mut session = Session::default();
         session.execute("file.newSequence", json!({"width":16,"height":16})).unwrap();
         let inter: Vec<f32> =
@@ -2510,15 +3225,7 @@ mod audio_recovery_tests {
                 app.end_preroll(0.0);
                 assert!(app.playback.audio_clock);
                 let buf = samples.lock().unwrap();
-                for (ch, tone) in [440.0, 660.0].into_iter().enumerate() {
-                    let hz = if maintain { tone } else { tone * speed };
-                    let level = amplitude(&buf, ch, hz);
-                    assert!(level > 0.08, "maintain={maintain}, speed={speed}, channel={ch}: {hz} Hz level={level}");
-                    if speed != 1.0 {
-                        let wrong = if maintain { tone * speed } else { tone };
-                        assert!(amplitude(&buf, ch, wrong) < level * 0.3, "wrong pitch {wrong} Hz at {speed}x, maintain={maintain}");
-                    }
-                }
+                assert_shuttle_tones(&buf, maintain, speed);
                 if speed == 1.0 {
                     if let Some(previous) = &normal {
                         assert_eq!(&*buf, previous, "1x must bypass pitch processing");
@@ -2590,6 +3297,7 @@ mod audio_recovery_tests {
         app.stop();
     }
 
+    /// A device that loses its playback clock resumes from the displayed frame and reports a status message.
     #[test]
     fn a_failed_device_clock_resumes_from_the_displayed_frame() {
         let mut session = Session::default();
@@ -2603,6 +3311,7 @@ mod audio_recovery_tests {
         app.playback.audio_clock = true;
         app.playback.anchor_tick = Tick::ZERO;
         app.playback.anchor_time = 0.0;
+        app.set_now_for_test(10.0);
         let mut output = ctx.run_ui(egui::RawInput { time: Some(10.0), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
         output.textures_delta.clear();
         assert!(!app.playback.audio_clock);
@@ -2633,6 +3342,7 @@ mod audio_recovery_tests {
         }
     }
 
+    /// A recovered stream keeps the device clock and the sound keeps playing.
     #[test]
     fn a_restarted_stream_keeps_the_device_clock_and_the_sound() {
         let mut session = Session::default();
@@ -2645,6 +3355,7 @@ mod audio_recovery_tests {
         app.playback.anchor_tick = Tick::ZERO;
         app.playback.anchor_time = 0.0;
         app.playback.audio_seen = (0, 10.0);
+        app.set_now_for_test(10.0);
         let mut output = ctx.run_ui(egui::RawInput { time: Some(10.0), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
         output.textures_delta.clear();
         assert!(app.playback.audio_clock, "the restarted stream is still the master clock");
@@ -2657,6 +3368,79 @@ mod audio_recovery_tests {
         );
         app.stop();
     }
+
+    /// A device whose stream dies mid-play (`ticking`) or whose open fails (`opens`).
+    struct Reviving {
+        starts: Arc<AtomicUsize>,
+        opens: Arc<AtomicBool>,
+        ticking: Arc<AtomicBool>,
+    }
+
+    impl AudioOut for Reviving {
+        fn start(&mut self, _: Box<dyn FnMut(&mut [f32], usize) + Send>) -> Result<u32, String> {
+            self.starts.fetch_add(1, Ordering::Relaxed);
+            if self.opens.load(Ordering::Relaxed) { Ok(48_000) } else { Err("device unavailable".into()) }
+        }
+        fn stop(&mut self) {}
+        fn sample_rate(&self) -> u32 {
+            48_000
+        }
+        fn played_frames(&self) -> Option<u64> {
+            self.ticking.load(Ordering::Relaxed).then_some(0)
+        }
+    }
+
+    /// A lost output is reopened on retry and the sound returns without pause/play.
+    #[test]
+    fn a_lost_output_is_reopened_and_the_sound_returns() {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).unwrap();
+        let ctx = egui::Context::default();
+        let mut app = FilmcraftApp::new(session);
+        let starts = Arc::new(AtomicUsize::new(0));
+        let ticking = Arc::new(AtomicBool::new(true));
+        app.audio = Some(Box::new(Reviving { starts: starts.clone(), opens: Arc::new(AtomicBool::new(true)), ticking: ticking.clone() }));
+        app.play(1.0);
+        app.end_preroll(0.0);
+        assert!(app.playback.audio_clock && starts.load(Ordering::Relaxed) == 1);
+        // the stream dies: the device stops reporting a playback clock
+        ticking.store(false, Ordering::Relaxed);
+        app.set_now_for_test(10.0);
+        let mut output = ctx.run_ui(egui::RawInput { time: Some(10.0), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
+        output.textures_delta.clear();
+        assert!(!app.playback.audio_clock);
+        // the device recovers before the next retry: playback reopens it itself
+        ticking.store(true, Ordering::Relaxed);
+        app.set_now_for_test(10.0 + AUDIO_RETRY_S + 0.5);
+        let mut output = ctx.run_ui(egui::RawInput { time: Some(10.0 + AUDIO_RETRY_S + 0.5), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
+        output.textures_delta.clear();
+        assert_eq!(starts.load(Ordering::Relaxed), 2, "the output is reopened without pause/play");
+        assert!(app.playback.audio_clock, "the fresh stream is the master clock again");
+        app.stop();
+    }
+
+    /// A device that becomes available mid-playback starts sounding on the next retry.
+    #[test]
+    fn a_device_that_appears_mid_playback_starts_sounding() {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).unwrap();
+        let ctx = egui::Context::default();
+        let mut app = FilmcraftApp::new(session);
+        let starts = Arc::new(AtomicUsize::new(0));
+        let opens = Arc::new(AtomicBool::new(false));
+        app.audio = Some(Box::new(Reviving { starts: starts.clone(), opens: opens.clone(), ticking: Arc::new(AtomicBool::new(true)) }));
+        app.play(1.0);
+        app.end_preroll(0.0);
+        assert!(!app.playback.audio_clock, "no device yet: playing on the wall clock");
+        // headphones plug in while playing: the next retry opens them
+        opens.store(true, Ordering::Relaxed);
+        app.set_now_for_test(AUDIO_RETRY_S + 0.5);
+        let mut output = ctx.run_ui(egui::RawInput { time: Some(AUDIO_RETRY_S + 0.5), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
+        output.textures_delta.clear();
+        assert_eq!(starts.load(Ordering::Relaxed), 2, "the output is retried without pause/play");
+        assert!(app.playback.audio_clock);
+        app.stop();
+    }
 }
 
 /// Whether a shortcut chord must be left alone because a text field is focused.
@@ -2717,6 +3501,7 @@ mod text_focus_shortcut_tests {
 mod voiceover_playback_tests {
     use super::*;
 
+    /// A voice-over take into an empty timeline past the end keeps playing and recording.
     #[test]
     fn a_voice_over_take_records_into_the_empty_timeline_past_the_end() {
         let mut session = Session::default();
@@ -2735,6 +3520,7 @@ mod voiceover_playback_tests {
         assert_eq!(app.session.playhead(), from);
         app.end_preroll(0.0);
         // and one second later the take is still playing and recording, not stopped at the end
+        app.set_now_for_test(1.0);
         let mut output = ctx.run_ui(egui::RawInput { time: Some(1.0), ..Default::default() }, |ui| app.advance_playback(ui.ctx()));
         output.textures_delta.clear();
         assert!(app.playback.playing);
@@ -2791,24 +3577,189 @@ mod native_menu_tests {
         let mut app = FilmcraftApp::new(Session::default());
         let sink = sent.clone();
         app.hooks.menu_changed = Some(Box::new(move |items: &[menus::MenuItem]| sink.borrow_mut().push(items.to_vec())));
+        let ctx = egui::Context::default();
 
-        app.sync_native_menu();
+        app.sync_native_menu(&ctx);
         let last = |sent: &Rc<RefCell<Vec<Vec<menus::MenuItem>>>>, id: &str| sent.borrow().last().and_then(|items| enabled(items, id));
         assert_eq!(last(&sent, "edit.undo"), Some(false), "nothing to undo in an empty project");
         assert_eq!(last(&sent, "edit.redo"), Some(false), "nothing to redo in an empty project");
         assert_eq!(last(&sent, "file.newProject"), Some(true));
 
-        app.sync_native_menu();
+        app.sync_native_menu(&ctx);
         assert_eq!(sent.borrow().len(), 1, "an unchanged menu is not sent again");
 
         app.session.execute("file.newSequence", json!({"width":16,"height":16})).unwrap();
-        app.sync_native_menu();
+        app.sync_native_menu(&ctx);
         assert_eq!(last(&sent, "edit.undo"), Some(true), "an edit can be undone");
         assert_eq!(last(&sent, "edit.redo"), Some(false));
 
         app.session.execute("edit.undo", json!({})).unwrap();
-        app.sync_native_menu();
+        app.sync_native_menu(&ctx);
         assert_eq!(last(&sent, "edit.undo"), Some(false));
         assert_eq!(last(&sent, "edit.redo"), Some(true), "the undone edit can be redone");
     }
 }
+
+#[cfg(test)]
+mod native_window_input_tests {
+    use super::*;
+    use std::path::{Path, PathBuf};
+
+    use craft_ui::docking::WindowFiles;
+    use egui_kittest::Harness;
+    use filmcraft_engine::Session;
+
+    #[derive(Debug)]
+    struct OsFile(PathBuf);
+
+    impl egui::DroppedFile for OsFile {
+        fn path(&self) -> &Path {
+            &self.0
+        }
+
+        fn bytes(&self) -> Result<Vec<u8>, String> {
+            std::fs::read(&self.0).map_err(|e| e.to_string())
+        }
+    }
+
+    fn step(h: &mut Harness<'static, FilmcraftApp>) {
+        let ctx = h.ctx.clone();
+        let mut raw = std::mem::take(h.input_mut());
+        eframe::App::raw_input_hook(h.state_mut(), &ctx, &mut raw);
+        *h.input_mut() = raw;
+        ctx.request_repaint();
+        h.step();
+    }
+
+    fn clips(h: &Harness<'static, FilmcraftApp>) -> usize {
+        h.state().session.active_sequence().map_or(0, |q| q.video_tracks.iter().map(|t| t.items.len()).sum())
+    }
+
+    /// Files dropped on a dock panel in its own OS window are imported; on the Timeline they are
+    /// placed at the pointer, by the Timeline drawn in that window only.
+    #[test]
+    fn files_dropped_on_native_windows_import_and_reach_their_timeline() {
+        let dir = tempfile::tempdir().unwrap();
+        let still = dir.path().join("native_window_drop.png");
+        image::RgbaImage::from_pixel(64, 36, image::Rgba([40, 140, 220, 255])).save(&still).unwrap();
+        let mut s = Session::default();
+        s.execute("file.openDemoProject", json!({})).unwrap();
+        s.execute("file.newSequence", json!({"name": "Drop test", "width": 1280, "height": 720, "fps": 24})).unwrap();
+        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).build_eframe(move |_cc| FilmcraftApp::new(s));
+        for _ in 0..4 {
+            step(&mut h);
+        }
+        let row = h.state().auto.find("timeline.track.V1.target").unwrap().rect;
+        let panel = h.state().auto.find("panel.Timeline").unwrap().rect;
+        let at = egui::pos2(panel[0] + h.state().ui.timeline.header_w + 60.0, row[1] + row[3] / 2.0);
+        let drop_files = |h: &mut Harness<'static, FilmcraftApp>, panel: PanelKind, viewport: egui::ViewportId| {
+            let files = WindowFiles { window: 1, viewport, panel, pos: Some(at), hovered: Vec::new(), dropped: vec![Arc::new(OsFile(still.clone()))] };
+            h.state_mut().window_files = vec![files];
+            step(h);
+            step(h);
+        };
+        let items = h.state().session.project.items.len();
+        // another window's Timeline: imported, and the main window's Timeline leaves it
+        drop_files(&mut h, PanelKind::Timeline, egui::ViewportId::from_hash_of("another window"));
+        assert_eq!((h.state().session.project.items.len(), clips(&h)), (items + 1, 0), "status: {}", h.state().ui.status);
+        // a panel other than the Timeline: imported to the bin only
+        drop_files(&mut h, PanelKind::Project, egui::ViewportId::ROOT);
+        assert_eq!((h.state().session.project.items.len(), clips(&h)), (items + 2, 0), "status: {}", h.state().ui.status);
+        // the Timeline drawn in the window the files were dropped on places them
+        drop_files(&mut h, PanelKind::Timeline, egui::ViewportId::ROOT);
+        assert_eq!((h.state().session.project.items.len(), clips(&h)), (items + 3, 1), "status: {}", h.state().ui.status);
+    }
+
+    /// `--control-input-only` drops a native window's own input as the main window's hook does.
+    #[test]
+    fn control_input_only_drops_native_window_input() {
+        let armed = Mutex::new(HashMap::new());
+        let mut raw = egui::RawInput { viewport_id: egui::ViewportId::from_hash_of("palette"), ..Default::default() };
+        raw.events = vec![egui::Event::Text("typing".into()), egui::Event::PointerMoved(egui::pos2(4.0, 4.0))];
+        raw.hovered_files.push(Default::default());
+        raw.dropped_files.push(Arc::new(OsFile(PathBuf::from("/unrelated-input.txt"))));
+        let mut kept = raw.clone();
+        rewrite_native_window_input(false, &armed, &mut kept);
+        assert_eq!(kept.events.len(), 2);
+        assert_eq!(kept.dropped_files.len(), 1);
+        rewrite_native_window_input(true, &armed, &mut raw);
+        assert!(raw.events.is_empty() && raw.hovered_files.is_empty() && raw.dropped_files.is_empty());
+    }
+}
+
+#[cfg(test)]
+mod lifecycle_synthetic_tests {
+    use egui::{Event, Modifiers, PointerButton, pos2};
+    use filmcraft_engine::Session;
+
+    use super::FilmcraftApp;
+
+    /// Extract the pointer-moved positions from a raw event batch, for synthetic-input tests.
+    fn pointer_events(events: &[Event]) -> Vec<egui::Pos2> {
+        events
+            .iter()
+            .filter_map(|event| match event {
+                Event::PointerMoved(pos) => Some(*pos),
+                _ => None,
+            })
+            .collect()
+    }
+
+    /// `raw_input_hook` runs before hidden logic ticks too, but those raw events are not fed to
+    /// widgets. The same one-step batch must remain pending, instead of advancing to the next
+    /// step or being silently lost; a real UI pass consumes it.
+    #[test]
+    fn one_synthetic_step_survives_hidden_logic_callbacks() {
+        let ctx = egui::Context::default();
+        let mut app = FilmcraftApp::new(Session::default());
+        app.synthetic = vec![
+            Event::PointerMoved(pos2(10.0, 10.0)),
+            Event::PointerMoved(pos2(20.0, 20.0)),
+            Event::PointerButton { pos: pos2(20.0, 20.0), button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::PointerButton { pos: pos2(20.0, 20.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        ];
+        let mut first = egui::RawInput::default();
+        eframe::App::raw_input_hook(&mut app, &ctx, &mut first);
+        assert_eq!(pointer_events(&first.events), vec![pos2(10.0, 10.0)]);
+        assert_eq!(app.synthetic.len(), 3, "only one step was popped");
+        assert_eq!(app.synthetic_pending_step.as_ref().map(Vec::len), Some(1));
+
+        // The integration keeps the raw input that did not reach widgets (native
+        // `pending_raw_input`, web `input.raw`) and replays it through the hook.
+        let mut hidden = first.clone();
+        eframe::App::raw_input_hook(&mut app, &ctx, &mut hidden);
+        assert_eq!(pointer_events(&hidden.events), vec![pos2(10.0, 10.0)], "the preserved step is not appended twice");
+        assert_eq!(app.synthetic.len(), 3, "a hidden callback must not advance the queue");
+
+        // A real UI pass consumes the pending step (App::ui clears it at its start).
+        app.synthetic_pending_step = None;
+        app.synthetic_step_offered = false;
+        app.synthetic_modifiers_offered = false;
+        let mut next = egui::RawInput::default();
+        eframe::App::raw_input_hook(&mut app, &ctx, &mut next);
+        assert_eq!(pointer_events(&next.events), vec![pos2(20.0, 20.0)]);
+        assert_eq!(app.synthetic.len(), 2);
+    }
+
+    /// eframe's hidden `run_logic` path saves the raw input (including our step) and hands it to
+    /// `raw_input_hook` again on the next hidden callback. The hook must not append the same step
+    /// a second time, or the eventual UI pass inserts text / clicks / runs a command more than once.
+    #[test]
+    fn hidden_callbacks_do_not_duplicate_a_step_preserved_in_raw_input() {
+        let ctx = egui::Context::default();
+        let mut app = FilmcraftApp::new(Session::default());
+        app.synthetic =
+            vec![Event::Text("once".into()), Event::Key { key: egui::Key::F35, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE }];
+        let mut first = egui::RawInput::default();
+        eframe::App::raw_input_hook(&mut app, &ctx, &mut first);
+        let texts = |events: &[Event]| events.iter().filter(|e| matches!(e, Event::Text(t) if t == "once")).count();
+        assert_eq!(texts(&first.events), 1);
+
+        // What the integration preserves as pending_raw_input, then replays through the hook on
+        // the next hidden logic tick.
+        let mut preserved = first.clone();
+        eframe::App::raw_input_hook(&mut app, &ctx, &mut preserved);
+        assert_eq!(texts(&preserved.events), 1, "the preserved raw input must keep exactly one copy");
+        assert_eq!(app.synthetic_pending_step.as_ref().map(Vec::len), Some(2), "the queue did not advance");
+    }
+}
diff --git a/crates/ui-egui/src/links.rs b/crates/ui-egui/src/links.rs
index 37df98da1..da4fa7242 100644
--- a/crates/ui-egui/src/links.rs
+++ b/crates/ui-egui/src/links.rs
@@ -50,6 +50,7 @@ pub fn menu_hint(command: &str) -> Option<String> {
             "help.revealLogFiles" => tl!("Saves this session's log and shows it in your file manager."),
             "help.systemCompatibilityReport" => tl!("Shows a report on this computer."),
             "app.about" => tl!("Shows the version, community links and credits in a FilmCraft window."),
+            "app.checkForUpdates" => tl!("Looks for a newer FilmCraft release and offers to update."),
             _ => return None,
         }
         .to_string(),
@@ -84,7 +85,7 @@ pub fn show_failed(app: &mut crate::FilmcraftApp, ctx: &egui::Context) {
     let mut close = false;
     let mut elems: Vec<(&str, egui::Rect, String)> = Vec::new();
     egui::Window::new(tl!("Couldn't open your web browser"))
-        .id(egui::Id::new("failed-link"))
+        .id(egui::Id::unique("failed-link"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -97,7 +98,7 @@ pub fn show_failed(app: &mut crate::FilmcraftApp, ctx: &egui::Context) {
             ui.label(tl!("Open this address in your browser yourself:"));
             ui.horizontal(|ui| {
                 let mut text = link.url.as_str();
-                let r = ui.add(egui::TextEdit::singleline(&mut text).desired_width(340.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut text).desired_width(340.0)), "Link address");
                 elems.push(("failedLink.url", r.rect, link.url.clone()));
                 let c = ui.button(tl!("Copy"));
                 elems.push(("failedLink.copy", c.rect, "Copy".into()));
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index a827d0e5c..577141c6d 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -54,6 +54,7 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     uic!("view.zoomIn", "Zoom In", ["View"], Some("=")),
     uic!("view.zoomOut", "Zoom Out", ["View"], Some("-")),
     uic!("view.zoomToSequence", "Zoom to Sequence", ["View"], Some("\\")),
+    uic!("view.resetInterfaceZoom", "Reset Interface Zoom", ["View"], None),
     uic!("view.playbackRes.full", "Full", ["View", "Playback Resolution"], None),
     uic!("view.playbackRes.half", "1/2", ["View", "Playback Resolution"], None),
     uic!("view.playbackRes.quarter", "1/4", ["View", "Playback Resolution"], None),
@@ -91,6 +92,8 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     uic!("view.addGuide", "Add Guide…", ["View"], None),
     uic!("view.clearGuides", "Clear Guides", ["View"], None),
     uic!("view.snapInProgramMonitor", "Snap in Program Monitor", ["View"], None),
+    // the monitors' wrench menus only, as in the reference app
+    uic!("view.transparencyGrid", "Transparency Grid", [], None),
     uic!("view.safeMargins", "Safe Margins", ["View", "Guide Templates"], None),
     uic!("view.guideTemplates.save", "Save Guides as Template…", ["View", "Guide Templates"], None),
     uic!("view.guideTemplates.manage", "Manage Guides…", ["View", "Guide Templates"], None),
@@ -144,6 +147,7 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     uic!("help.reportIssue", "Report an Issue…", ["Help"], None),
     uic!("help.revealLogFiles", "Reveal Log Files…", ["Help"], None),
     uic!("help.systemCompatibilityReport", "System Compatibility Report…", ["Help"], None),
+    uic!("app.checkForUpdates", "Check for Updates…", ["Help"], None),
     uic!("app.about", "About FilmCraft", ["Help"], None),
     uic!("app.keyboardShortcuts", "Keyboard Shortcuts…", ["Edit"], Some("Cmd+Alt+K")),
     uic!("app.settings.general", "General…", ["Edit", "Preferences"], Some("Cmd+,")),
@@ -289,6 +293,12 @@ pub fn invoke(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, mut params:
     if let Some(r) = crate::panels::clip_dialogs::route(app, id, &params) {
         return r;
     }
+    if let Some(r) = crate::panels::misc::route_history(app, ctx, id, &params) {
+        if let Err(e) = &r {
+            app.ui.status = e.clone();
+        }
+        return r;
+    }
     if let Some(r) = crate::panels::settings::route(app, id) {
         return r;
     }
@@ -420,6 +430,12 @@ pub fn invoke(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, mut params:
             app.ui.timeline.fit_pending = true;
             return Ok(Value::Null);
         }
+        // the whole interface back to Settings ▸ Appearance ▸ UI Scale, after Ctrl+Plus or a mouse
+        // mapped to page zoom scaled it (#2253)
+        "view.resetInterfaceZoom" => {
+            let zoom = app.reset_ui_zoom(ctx);
+            return Ok(json!({"zoom": zoom}));
+        }
         "mode.import" => {
             app.ui.mode = Mode::Import;
             return Ok(Value::Null);
@@ -432,6 +448,10 @@ pub fn invoke(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, mut params:
             app.ui.mode = Mode::Export;
             return Ok(Value::Null);
         }
+        "app.checkForUpdates" => {
+            let _ = crate::updates_ui::check(app);
+            return Ok(serde_json::Value::Null);
+        }
         "app.about" => {
             app.dialog = Some(crate::Dialog::About);
             return Ok(Value::Null);
@@ -594,13 +614,74 @@ pub fn invoke(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, mut params:
     if r.is_ok() && matches!(id, "playhead.start" | "playhead.end") {
         crate::panels::timeline::reveal_playhead(app, ctx);
     }
-    if r.is_ok() && matches!(id, "edit.copy" | "edit.cut") {
+    let filled_clipboard = match id {
+        "edit.copy" | "edit.cut" => r.is_ok(),
+        // over a range with no clips on the targeted tracks they leave the clipboard (and the OS one) as it was
+        "sequence.lift" | "sequence.extract" => r.as_ref().is_ok_and(|v| v["copied"].as_u64().is_some_and(|n| n > 0)),
+        _ => false,
+    };
+    if filled_clipboard {
         remember_stale_clipboard_media(app);
         put_clip_names_on_system_clipboard(app, ctx);
     }
     r
 }
 
+/// Run the command `id` chosen in the native menu bar, which takes the Edit menu's key
+/// equivalents (⌘C, ⌘X, ⌘V, ⌘A, ⌘Z, ⇧⌘Z) before any window sees them: while a text field has
+/// the keyboard, in the main window or a floating panel's own window, the field gets the key
+/// and the project command does not run.
+pub fn activate_native(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str) -> Result<Value, String> {
+    let (Some(window), Some(text)) = (text_field_window(ctx), text_command(id, ctx.os().is_mac())) else {
+        return invoke(app, ctx, id, json!({}));
+    };
+    match text {
+        TextCommand::Paste => ctx.send_viewport_cmd_to(window, egui::ViewportCommand::RequestPaste),
+        TextCommand::Events(events) if window == egui::ViewportId::ROOT => {
+            app.synthetic.extend(events);
+            ctx.request_repaint();
+        }
+        TextCommand::Events(events) => craft_ui::docking::send_keys(ctx, window, events),
+    }
+    Ok(Value::Null)
+}
+
+/// The window whose text field has the keyboard: a floating panel's own OS window, or the main
+/// window.
+pub fn text_field_window(ctx: &egui::Context) -> Option<egui::ViewportId> {
+    craft_ui::docking::typing_window(ctx).or_else(|| ctx.text_edit_focused().then_some(egui::ViewportId::ROOT))
+}
+
+/// Whether a focused text field takes the menu command `id` ([`activate_native`]): the native
+/// menu keeps such items enabled while one has the keyboard, whatever the project allows.
+pub fn edits_text(id: &str) -> bool {
+    text_command(id, false).is_some()
+}
+
+/// What a focused text field does for an Edit menu command.
+#[derive(Debug, PartialEq)]
+enum TextCommand {
+    /// The clipboard text, which the window asks for and receives as `Paste`.
+    Paste,
+    Events(Vec<egui::Event>),
+}
+
+fn text_command(id: &str, mac: bool) -> Option<TextCommand> {
+    let key = |key, shift| {
+        let modifiers = egui::Modifiers { mac_cmd: mac, ctrl: !mac, command: true, shift, alt: false };
+        TextCommand::Events([true, false].map(|pressed| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers }).into())
+    };
+    Some(match id {
+        "edit.copy" => TextCommand::Events(vec![egui::Event::Copy]),
+        "edit.cut" => TextCommand::Events(vec![egui::Event::Cut]),
+        "edit.paste" => TextCommand::Paste,
+        "edit.undo" => key(egui::Key::Z, false),
+        "edit.redo" => key(egui::Key::Z, true),
+        "edit.selectAll" => key(egui::Key::A, false),
+        _ => return None,
+    })
+}
+
 /// Snapshot OS files/image present at Copy/Cut. Many platforms keep a previous file list after
 /// `copy_text`, so Paste would otherwise import those files instead of the clips (#697).
 fn remember_stale_clipboard_media(app: &mut FilmcraftApp) {
@@ -637,8 +718,20 @@ fn put_clip_names_on_system_clipboard(app: &FilmcraftApp, ctx: &egui::Context) {
 /// Paste the files or the image on the system clipboard: placed on the Timeline when it has focus,
 /// imported into the shown bin in the Project panel. None when the clipboard holds neither.
 fn paste_clipboard_media(app: &mut FilmcraftApp, insert: bool) -> Option<Result<Value, String>> {
-    let media = (app.hooks.clipboard_media.as_mut()?)()?;
-    if app.stale_clipboard_media.as_ref() == Some(&clipboard_media_key(&media)) {
+    // The paste event already carries the image bytes. Prefer them: re-reading the OS clipboard
+    // is racy (it may have changed) and the web host installs no clipboard-media hook.
+    let event_media = match app.pasted_image.take() {
+        Some(image) => match paste_image_media(&image) {
+            Ok(media) => Some(media),
+            Err(error) => return Some(Err(error)),
+        },
+        None => None,
+    };
+    let (media, from_event) = match event_media {
+        Some(media) => (media, true),
+        None => ((app.hooks.clipboard_media.as_mut()?)()?, false),
+    };
+    if !from_event && app.stale_clipboard_media.as_ref() == Some(&clipboard_media_key(&media)) {
         return None;
     }
     let paths = match media {
@@ -654,6 +747,34 @@ fn paste_clipboard_media(app: &mut FilmcraftApp, insert: bool) -> Option<Result<
     Some(app.session.execute("edit.pasteMedia", params).map_err(|e| e.to_string()))
 }
 
+/// Upper bound on the RGBA copy made from a clipboard image, matching the screenshot per-image
+/// bound. The event's own `ColorImage` is still alive while this copy is encoded, so reject before
+/// allocating it rather than only checking for integer overflow.
+const MAX_CLIPBOARD_IMAGE_BYTES: usize = 128 * 1024 * 1024;
+
+/// The RGBA bytes of an image delivered by `egui::Event::PasteImage`.
+fn paste_image_media(image: &egui::ColorImage) -> Result<crate::ClipboardMedia, String> {
+    let [width, height] = image.size;
+    let len =
+        width.checked_mul(height).and_then(|pixels| pixels.checked_mul(4)).ok_or_else(|| "the pasted image size overflows the clipboard buffer".to_string())?;
+    if len > MAX_CLIPBOARD_IMAGE_BYTES {
+        return Err(format!(
+            "the pasted image is too large: {width}×{height} needs {len} RGBA bytes, over the {MAX_CLIPBOARD_IMAGE_BYTES}-byte clipboard image limit"
+        ));
+    }
+    let mut rgba = Vec::with_capacity(len);
+    for c in &image.pixels {
+        // `Color32` is premultiplied internally; PNG/RgbaImage expect straight alpha. Round-trip
+        // through the straight sRGB form so a semi-transparent clipboard pixel keeps its colour.
+        let [r, g, b, a] = c.to_srgba_unmultiplied();
+        rgba.extend_from_slice(&[r, g, b, a]);
+    }
+    if rgba.len() != len {
+        return Err("the pasted image does not match its reported size".into());
+    }
+    Ok(crate::ClipboardMedia::Image { width, height, rgba })
+}
+
 /// A compressed PNG of a clipboard image; an error when its size and pixels disagree.
 fn encode_png(width: usize, height: usize, rgba: Vec<u8>) -> Result<Vec<u8>, String> {
     let (w, h) = (u32::try_from(width).map_err(|e| e.to_string())?, u32::try_from(height).map_err(|e| e.to_string())?);
@@ -846,6 +967,16 @@ pub fn bindings(app: &FilmcraftApp) -> Vec<KeyBinding> {
     let shifted: Vec<KeyBinding> =
         v.iter().filter(|b| b.0.shift).filter_map(|(m, k, id, p)| shifted_key(*k).map(|k2| (*m, k2, id.clone(), p.clone()))).collect();
     v.extend(shifted);
+    // `+` is the `=` key with Shift on US layouts and its own key on others and the keypad: a chord
+    // on `=` takes it too, unless something is bound to `+` itself. Otherwise Ctrl+Plus fell
+    // through to egui's interface zoom while Ctrl+- and Ctrl+0 were taken by FilmCraft
+    // shortcuts, so the interface grew and could not shrink back (#2253).
+    let plus: Vec<KeyBinding> = v
+        .iter()
+        .filter(|(m, k, _, p)| *k == egui::Key::Equals && !v.iter().any(|(m2, k2, _, p2)| *k2 == egui::Key::Plus && m2 == m && p2 == p))
+        .map(|(m, _, id, p)| (*m, egui::Key::Plus, id.clone(), p.clone()))
+        .collect();
+    v.extend(plus);
     v.sort_by_key(|(m, ..)| std::cmp::Reverse(specificity(*m)));
     v
 }
@@ -885,13 +1016,14 @@ pub fn external_commands() -> Vec<filmcraft_engine::shortcuts::CommandInfo> {
 
 /// Draw the in-window menu bar.
 pub fn menu_bar(app: &mut FilmcraftApp, ui: &mut egui::Ui) {
-    ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new("interface-language"), app.ui.language));
+    ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique("interface-language"), app.ui.language));
     let items = menu_items(app);
     // Draw Edit ▸ Label with the user's live palette, not the baked-in label colours.
     let labels = app.session.prefs.labels.clone();
     let ctx = ui.ctx().clone();
     let mut clicked: Option<String> = None;
-    egui::MenuBar::new().config(egui::containers::menu::MenuConfig::new().style(crate::theme::menu_style)).ui(ui, |ui| {
+    // The bar's titles and their menus share one size and colour, as in a native menu bar.
+    egui::MenuBar::new().style(crate::theme::menu_style).config(egui::containers::menu::MenuConfig::new().style(crate::theme::menu_style)).ui(ui, |ui| {
         let mut titles = Vec::with_capacity(MENUS.len());
         for top in MENUS {
             let mine: Vec<&MenuItem> = items.iter().filter(|i| i.path.first().map(String::as_str) == Some(top)).collect();
@@ -945,7 +1077,7 @@ fn menu_level(
             }
             subs.push(sub);
             let inner: Vec<&MenuItem> = items.iter().copied().filter(|x| x.path.get(depth).map(String::as_str) == Some(sub)).collect();
-            let language = ui.ctx().data(|d| d.get_temp::<crate::i18n::Language>(egui::Id::new("interface-language"))).unwrap_or_default();
+            let language = ui.ctx().data(|d| d.get_temp::<crate::i18n::Language>(egui::Id::unique("interface-language"))).unwrap_or_default();
             ui.menu_button(language.tr(sub), |ui| {
                 ui.set_min_width(220.0);
                 menu_level(ui, &inner, depth + 1, clicked, auto, labels);
@@ -1070,6 +1202,30 @@ mod parse_shortcut_tests {
 mod tests {
     use super::*;
 
+    /// A clipboard image is premultiplied inside `Color32`. The PNG writer expects straight
+    /// alpha, so a semi-transparent pixel must come back with its colour, not darkened.
+    #[test]
+    fn pasted_images_keep_straight_alpha_colour() {
+        // Red at 50% opacity: premultiplied storage is about (128, 0, 0, 128).
+        let image = egui::ColorImage::from_rgba_unmultiplied([1, 1], &[255, 0, 0, 128]);
+        let media = paste_image_media(&image).expect("a 1×1 clipboard image");
+        let crate::ClipboardMedia::Image { width, height, rgba } = media else { panic!("not an image") };
+        assert_eq!((width, height), (1, 1));
+        assert_eq!(rgba, vec![255, 0, 0, 128], "straight RGBA, not the premultiplied bytes");
+        let png = encode_png(width, height, rgba).expect("a PNG");
+        let decoded = image::load_from_memory(&png).expect("decode the pasted PNG").to_rgba8();
+        assert_eq!(decoded.get_pixel(0, 0).0, [255, 0, 0, 128]);
+    }
+
+    /// An image whose RGBA size exceeds the 128 MiB cap is rejected before any RGBA copy is allocated.
+    #[test]
+    fn oversized_clipboard_images_are_rejected_before_allocating_rgba() {
+        let side = 100_000;
+        let image = egui::ColorImage { size: [side, side], source_size: egui::vec2(100_000.0, 100_000.0), pixels: Vec::new() };
+        let Err(error) = paste_image_media(&image) else { panic!("an oversized clipboard image was accepted") };
+        assert!(error.contains("too large"), "{error}");
+    }
+
     /// What `cargo xtask parity` measures: every item sits under a top-level menu, and Window ▸
     /// Workspaces lists the built-in workspaces before the layout commands, none checked.
     #[test]
diff --git a/crates/ui-egui/src/native_dialogs.rs b/crates/ui-egui/src/native_dialogs.rs
index a18ae8bf8..e1445155a 100644
--- a/crates/ui-egui/src/native_dialogs.rs
+++ b/crates/ui-egui/src/native_dialogs.rs
@@ -5,7 +5,7 @@
 //! the desktop app on Linux, where the XDG portal call would otherwise hold the UI thread until the
 //! user chooses, and GNOME offers to force-quit the window after about five seconds) gets the
 //! dialog and answers on a channel; the frame loop keeps running, and the continuation runs on the
-//! frame the answer arrives ([`FilmcraftApp::poll_native_dialog`]). Without it the host's
+//! frame the answer arrives (`FilmcraftApp::poll_native_dialog`). Without it the host's
 //! synchronous pickers (`pick_files`, `pick_save_as`, …) are called and the continuation runs at
 //! once, as before: headless tests, the control channel's stand-ins and other hosts are unchanged.
 //!
diff --git a/crates/ui-egui/src/panels/audio_fx_editor.rs b/crates/ui-egui/src/panels/audio_fx_editor.rs
index ba86d691a..8daec9b11 100644
--- a/crates/ui-egui/src/panels/audio_fx_editor.rs
+++ b/crates/ui-egui/src/panels/audio_fx_editor.rs
@@ -191,13 +191,13 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         let kind = if matches!(target, FxTarget::Clip { .. }) { tl!("Clip Fx Editor") } else { tl!("Track Fx Editor") };
         let title = format!("{kind} - {name}: {place}");
         let k = key(&target);
-        let drafts_id = egui::Id::new(("fx-editor-drafts", &k));
+        let drafts_id = egui::Id::unique(("fx-editor-drafts", &k));
         let drafts: HashMap<String, f64> = ctx.data(|d| d.get_temp(drafts_id)).unwrap_or_default();
         let fx_id = inst.effect.clone();
         let mut ed = Ed { t: app.tokens, fx: &fx_id, target: &target, inst, mt, drafts, acts: Vec::new(), autos: Vec::new() };
         let mut open = true;
         let mut closed = false;
-        egui::Window::new(title).id(egui::Id::new(("fx-editor", &k))).open(&mut open).collapsible(false).resizable(false).show(ctx, |ui| {
+        egui::Window::new(title).id(egui::Id::unique(("fx-editor", &k))).open(&mut open).collapsible(false).resizable(false).show(ctx, |ui| {
             match ed.fx {
                 "parametric_eq" => parametric(ui, &mut ed),
                 "graphic_eq" | "graphic_eq_20" | "graphic_eq_30" => graphic(ui, &mut ed),
@@ -322,7 +322,7 @@ fn parametric(ui: &mut egui::Ui, ed: &mut Ed) {
         let g = if gain { ed.v(&g_id) } else { 0.0 };
         let c = pos2(x_of(f, r), y_of(g, r, range));
         let nr = Rect::from_center_size(c, vec2(16.0, 16.0));
-        let id = egui::Id::new(("peq-node", ed.target.clone(), pre));
+        let id = egui::Id::unique(("peq-node", ed.target.clone(), pre));
         let resp = ui.interact(nr, id, Sense::click_and_drag());
         let on = ed.on(&on_id);
         let col = if on { ed.t.eq_node } else { ed.t.eq_node_off };
@@ -390,7 +390,7 @@ fn graphic(ui: &mut egui::Ui, ed: &mut Ed) {
         let v = ed.v(&pid);
         let ky = track.center().y - (v / 24.0) as f32 * track.height() * 0.5;
         let knob = Rect::from_center_size(pos2(x, ky), vec2(colw.min(18.0), 8.0));
-        let id = egui::Id::new(("geq-band", ed.target.clone(), i));
+        let id = egui::Id::unique(("geq-band", ed.target.clone(), i));
         let resp = ui.interact(knob.union(track).expand(3.0), id, Sense::click_and_drag());
         ui.painter().rect_filled(knob, 2.0, if resp.hovered() || resp.dragged() { ed.t.eq_knob_active } else { ed.t.eq_knob });
         ui.painter().text(pos2(x, area.max.y - 22.0), Align2::CENTER_CENTER, format!("{v:+.0}"), Tokens::ui(8.5), ed.t.text_dim);
@@ -470,7 +470,7 @@ fn multiband(ui: &mut egui::Ui, ed: &mut Ed) {
     for (k, pid) in ["xo1", "xo2", "xo3"].iter().enumerate() {
         let x = edges[k + 1];
         let hr = Rect::from_center_size(pos2(x, r.center().y), vec2(10.0, r.height()));
-        let resp = ui.interact(hr, egui::Id::new(("mb-xo", ed.target.clone(), k)), Sense::drag());
+        let resp = ui.interact(hr, egui::Id::unique(("mb-xo", ed.target.clone(), k)), Sense::drag());
         ui.painter()
             .line_segment([pos2(x, r.min.y), pos2(x, r.max.y)], Stroke::new(if resp.hovered() || resp.dragged() { 2.5 } else { 1.5 }, ed.t.crossover_handle));
         ui.painter().text(pos2(x + 3.0, r.min.y + 2.0), Align2::LEFT_TOP, format!("{:.0} Hz", xo[k]), Tokens::ui(9.0), ed.t.text_dim);
diff --git a/crates/ui-egui/src/panels/clip_dialogs.rs b/crates/ui-egui/src/panels/clip_dialogs.rs
index 5d64f4254..b5874a731 100644
--- a/crates/ui-egui/src/panels/clip_dialogs.rs
+++ b/crates/ui-egui/src/panels/clip_dialogs.rs
@@ -41,7 +41,9 @@ use crate::state::ClipDialogDraft;
 type Elems = Vec<(String, egui::Rect, String)>;
 
 fn push(elems: &mut Elems, id: impl Into<String>, r: &egui::Response, label: impl Into<String>) {
-    elems.push((id.into(), r.rect, label.into()));
+    let label = label.into();
+    crate::widgets::accessible_name(r.clone(), label.clone());
+    elems.push((id.into(), r.rect, label));
 }
 
 /// Dialog title and automation prefix of a command's dialog.
@@ -300,7 +302,7 @@ fn frames(ui: &mut egui::Ui, elems: &mut Elems, pre: &str, p: &mut Value, key: &
 /// Draw the open dialog, if any.
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.clip_dialog.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("clip-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("clip-dialog-before-drag"), &mut d);
     let Some((title, pre)) = meta(&d.command) else {
         app.ui.clip_dialog = None;
         return;
@@ -311,7 +313,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     // a never-saved project is saved through the Save dialog
     let can_save = app.session.path.is_some() || app.hooks.pick_save.is_some();
     // the title is translated; the window keeps one id whatever the interface language
-    let id = egui::Id::new(("clip-dialog", pre));
+    let id = egui::Id::unique(("clip-dialog", pre));
     egui::Window::new(title).id(id).collapsible(false).resizable(false).default_width(360.0).centered(ctx).show(ctx, |ui| {
         let p = &mut d.params;
         match d.command.as_str() {
@@ -375,8 +377,8 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 let mut v = p["name"].as_str().unwrap_or_default().to_string();
                 ui.horizontal(|ui| {
                     ui.label(tl!("Name:"));
-                    let id = egui::Id::new("nest-name");
-                    let r = ui.add(egui::TextEdit::singleline(&mut v).desired_width(240.0).id(id));
+                    let id = egui::Id::unique("nest-name");
+                    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut v).desired_width(240.0).id(id)), tl!("Name:"));
                     push(&mut elems, format!("{pre}.name"), &r, "Name:");
                     if r.changed() {
                         p["name"] = json!(v);
@@ -384,7 +386,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
                     if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
                         action = Some("ok");
                     }
-                    let first = egui::Id::new("nest-name-focused");
+                    let first = egui::Id::unique("nest-name-focused");
                     if !ui.data(|d| d.get_temp::<bool>(first).unwrap_or(false)) {
                         ui.data_mut(|d| d.insert_temp(first, true));
                         r.request_focus();
@@ -587,7 +589,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         action = Some("cancel");
     }
     if action.is_some() {
-        ctx.data_mut(|d| d.remove::<bool>(egui::Id::new("nest-name-focused")));
+        ctx.data_mut(|d| d.remove::<bool>(egui::Id::unique("nest-name-focused")));
     }
     match action {
         Some("cancel") => {
diff --git a/crates/ui-egui/src/panels/color_dialogs.rs b/crates/ui-egui/src/panels/color_dialogs.rs
index 9ee1c809f..a883b9843 100644
--- a/crates/ui-egui/src/panels/color_dialogs.rs
+++ b/crates/ui-egui/src/panels/color_dialogs.rs
@@ -71,7 +71,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 .unwrap_or_else(|| "—".into());
             let n = items.len();
             egui::Window::new(tl!("Interpret Footage"))
-                .id(egui::Id::new("Interpret Footage"))
+                .id(egui::Id::unique("Interpret Footage"))
                 .open(&mut open)
                 .collapsible(false)
                 .resizable(false)
@@ -102,7 +102,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         }
         ColorDialog::Sequence { working_space, wide_gamut, auto_tone_map } => {
             egui::Window::new(tl!("Sequence Color Management"))
-                .id(egui::Id::new("Sequence Color Management"))
+                .id(egui::Id::unique("Sequence Color Management"))
                 .open(&mut open)
                 .collapsible(false)
                 .resizable(false)
diff --git a/crates/ui-egui/src/panels/dialogs.rs b/crates/ui-egui/src/panels/dialogs.rs
index 8bc23dbc3..9becefe10 100644
--- a/crates/ui-egui/src/panels/dialogs.rs
+++ b/crates/ui-egui/src/panels/dialogs.rs
@@ -23,6 +23,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     crate::panels::frame_export::show(app, ctx);
     crate::panels::project_dialogs::show(app, ctx);
     crate::panels::media_browser::dialogs(app, ctx);
+    crate::panels::misc::history_dialogs(app, ctx);
     let Some(d) = app.dialog else { return };
     if let Some(still_open) = crate::panels::file_dialogs::show(app, ctx, d) {
         if !still_open && app.dialog == Some(d) {
@@ -34,7 +35,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     match d {
         Dialog::About => {
             egui::Window::new(tl!("About FilmCraft"))
-                .id(egui::Id::new("About FilmCraft"))
+                .id(egui::Id::unique("About FilmCraft"))
                 .open(&mut open)
                 .collapsible(false)
                 .resizable(false)
@@ -94,7 +95,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
 /// Automation ids: `audioGain.<set|adjust|normalizeMax|normalizeAll>` (radio buttons),
 /// `audioGain.<mode>.value` (dB fields), `audioGain.peak`, `audioGain.ok`, `audioGain.cancel`.
 fn audio_gain(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
-    let peak_id = egui::Id::new("audio-gain-peak");
+    let peak_id = egui::Id::unique("audio-gain-peak");
     let rev = app.session.revision;
     let cached: Option<(u64, Option<f64>)> = ctx.data(|d| d.get_temp(peak_id));
     let peak = match cached {
@@ -106,12 +107,12 @@ fn audio_gain(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
         }
     };
     let mut draft = app.ui.audio_gain.clone();
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("audio-gain-before-drag"), &mut draft);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("audio-gain-before-drag"), &mut draft);
     let mut keep = true;
     let mut apply = false;
     let mut elems: Vec<(String, egui::Rect, String)> = Vec::new();
     egui::Window::new(tl!("Audio Gain"))
-        .id(egui::Id::new("Audio Gain"))
+        .id(egui::Id::unique("Audio Gain"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -192,14 +193,14 @@ fn add_tracks(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let names = |tracks: &[filmcraft_engine::project::Track]| tracks.iter().map(|t| t.name.clone()).collect::<Vec<_>>();
     let (vnames, anames, snames) = (names(&seq.video_tracks), names(&seq.audio_tracks), names(&seq.submix_tracks));
     let mut d = app.ui.add_tracks.clone();
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("add-tracks-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("add-tracks-before-drag"), &mut d);
     let mut keep = true;
     let mut apply = false;
     let mut elems: Vec<(String, egui::Rect, String)> = Vec::new();
     let audio_types: [(&str, &str); 4] = [("standard", tl!("Standard")), ("5.1", "5.1"), ("adaptive", tl!("Adaptive")), ("mono", tl!("Mono"))];
     let submix_types: [(&str, &str); 4] = [("stereo", tl!("Stereo")), ("5.1", "5.1"), ("adaptive", tl!("Adaptive")), ("mono", tl!("Mono"))];
     egui::Window::new(tl!("Add Tracks"))
-        .id(egui::Id::new("Add Tracks"))
+        .id(egui::Id::unique("Add Tracks"))
         .collapsible(false)
         .resizable(false)
         .default_width(320.0)
@@ -330,7 +331,7 @@ fn delete_tracks(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let mut apply = false;
     let mut elems: Vec<(String, egui::Rect, String)> = Vec::new();
     egui::Window::new(tl!("Delete Tracks"))
-        .id(egui::Id::new("Delete Tracks"))
+        .id(egui::Id::unique("Delete Tracks"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -416,7 +417,7 @@ fn delete_tracks(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
 /// Automation ids: `about.tab.about`, `about.tab.contributors`, `about.tab.models`; the About tab's
 /// links and the credits controls are listed on [`about_tab`] and [`crate::credits::contributors_ui`].
 fn about(app: &mut FilmcraftApp, ui: &mut egui::Ui) {
-    let tab_id = egui::Id::new("about_tab");
+    let tab_id = egui::Id::unique("about_tab");
     let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);
     ui.horizontal(|ui| {
         for (i, (id, label)) in [("about", tl!("About")), ("contributors", tl!("Contributors")), ("models", tl!("Models"))].into_iter().enumerate() {
diff --git a/crates/ui-egui/src/panels/effect_controls.rs b/crates/ui-egui/src/panels/effect_controls.rs
index b829a25fc..aa1ab03c9 100644
--- a/crates/ui-egui/src/panels/effect_controls.rs
+++ b/crates/ui-egui/src/panels/effect_controls.rs
@@ -11,6 +11,7 @@ use crate::FilmcraftApp;
 use crate::icons::{self, Icon};
 use crate::state::KeyframeRef;
 use crate::theme::Tokens;
+use crate::widgets::HotNumberOptions;
 
 #[path = "effect_controls_selection.rs"]
 mod selection;
@@ -197,9 +198,18 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             // Premiere lists the fixed effects (Motion, Opacity, Time Remapping / Volume…) first.
             let mut order: Vec<usize> = (0..it.effects.len()).collect();
             order.sort_by_key(|i| !it.effects[*i].def().is_some_and(|d| d.intrinsic));
+            let mut after_fixed = false;
             for idx in order {
                 let e = &it.effects[idx];
                 let Some(def) = e.def() else { continue };
+                // the first effect added from the library after the fixed ones gets a line on top
+                // (#2328); drawn on its edge, so no row moves
+                let first_added = if def.intrinsic {
+                    after_fixed = true;
+                    false
+                } else {
+                    std::mem::take(&mut after_fixed)
+                };
                 let key = format!("{}:{}", clip.0, idx);
                 let open = !app.ui.collapsed_fx.contains(&key);
                 let selected = app.session.state.selected_effect.as_ref().is_some_and(|s| s.clip == clip && s.index(&it.effects) == Some(idx));
@@ -210,14 +220,20 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     bui.painter().rect_filled(crate::panels::effect_controls::row_fill(r), 0.0, t.hover);
                 }
                 row_line(bui, r, &lane, &t);
+                if first_added {
+                    let line = Rect::from_min_max(pos2(r.min.x, r.min.y - 1.0), pos2(r.max.x, r.min.y + 1.0));
+                    bui.painter().rect_filled(line, 0.0, t.accent.gamma_multiply(0.8));
+                    let which = if *kind == TrackKind::Video { "video" } else { "audio" };
+                    app.auto.add(&format!("effectControls.addedEffects.{which}"), line, "Added effects");
+                }
                 // only the arrow twirls the effect open or shut; the rest of the header selects it
                 let tw = Rect::from_center_size(pos2(r.min.x + 10.0, r.center().y), vec2(10.0, 10.0));
                 icons::paint(bui.painter(), tw, if open { Icon::ChevronDown } else { Icon::ChevronRight }, t.text_dim);
-                let twresp = bui.interact(tw.expand(3.0), egui::Id::new(("fx-twirl", clip.0, idx)), Sense::click());
+                let twresp = bui.interact(tw.expand(3.0), egui::Id::unique(("fx-twirl", clip.0, idx)), Sense::click());
                 app.auto.add(&format!("effectControls.effect.{}.twirl", e.effect), tw, "twirl");
                 // fx enable toggle
                 let fxr = Rect::from_center_size(pos2(r.min.x + 28.0, r.center().y), vec2(18.0, 14.0));
-                let fxresp = bui.interact(fxr, egui::Id::new(("fxen", clip.0, idx)), Sense::click());
+                let fxresp = bui.interact(fxr, egui::Id::unique(("fxen", clip.0, idx)), Sense::click());
                 bui.painter().text(fxr.center(), Align2::CENTER_CENTER, "fx", Tokens::semibold(10.5), if e.enabled { t.text } else { t.text_faint });
                 if !e.enabled {
                     bui.painter().line_segment([fxr.left_bottom(), fxr.right_top()], Stroke::new(1.0, t.text_faint));
@@ -229,7 +245,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 row_label(bui, pos2(r.min.x + 42.0, r.center().y), crate::i18n::t(def.name), r.max.x - 26.0 - (r.min.x + 42.0), Tokens::ui(12.0), t.text);
                 // reset button
                 let rr = Rect::from_center_size(pos2(r.max.x - 14.0, r.center().y), vec2(16.0, 16.0));
-                let rresp = bui.interact(rr, egui::Id::new(("fxreset", clip.0, idx)), Sense::click()).on_hover_text(tl!("Reset Effect"));
+                let rresp = bui.interact(rr, egui::Id::unique(("fxreset", clip.0, idx)), Sense::click()).on_hover_text(tl!("Reset Effect"));
                 icons::paint(bui.painter(), rr.shrink(2.0), Icon::Reset, if rresp.hovered() { t.text } else { t.text_dim });
                 if rresp.clicked() {
                     actions.push(("effects.reset".into(), json!({"clip": clip.0, "index": idx})));
@@ -292,7 +308,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     ui.painter().with_clip_rect(bar).text(pos2(bar.min.x + 4.0, bar.center().y), Align2::LEFT_CENTER, &it.name, Tokens::ui(10.0), t.text);
     // click or drag anywhere on the ruler (or the bar) to move the playhead (after the rows, which
     // reach under it, so it gets the pointer first)
-    let sresp = ui.interact(scrub, egui::Id::new(("ec-scrub", clip.0)), Sense::click_and_drag());
+    let sresp = ui.interact(scrub, egui::Id::unique(("ec-scrub", clip.0)), Sense::click_and_drag());
     if (sresp.dragged() || sresp.clicked())
         && let Some(pos) = sresp.interact_pointer_pos()
     {
@@ -303,7 +319,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     // the divider: a line the height of the panel, a resize cursor and a wider grab area
     let divider = Rect::from_min_max(pos2(split - 2.0, rect.min.y), pos2(split + 4.0, rect.max.y - 26.0));
-    let dresp = ui.interact(divider, egui::Id::new("ec-divider"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
+    let dresp = ui.interact(divider, egui::Id::unique("ec-divider"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
     if dresp.dragged() {
         app.ui.effect_controls_split = (list_w + dresp.drag_delta().x).clamp(MIN_LIST_W, max_list);
     }
@@ -359,7 +375,7 @@ fn custom_setup_row(app: &mut FilmcraftApp, ui: &mut egui::Ui, body: Rect, lane:
     row_line(ui, r, lane, &t);
     ui.painter().text(pos2(r.min.x + 42.0, r.center().y), Align2::LEFT_CENTER, tl!("Custom Setup"), Tokens::ui(12.0), t.text_dim);
     let br = Rect::from_min_size(pos2(r.min.x + 160.0, r.min.y + 2.0), vec2(60.0, ROW_H - 4.0));
-    let resp = ui.interact(br, egui::Id::new(("fx-custom-setup", clip.0, idx)), Sense::click());
+    let resp = ui.interact(br, egui::Id::unique(("fx-custom-setup", clip.0, idx)), Sense::click());
     ui.painter().rect_filled(br, 3.0, if resp.hovered() { t.hover } else { t.field_bg });
     ui.painter().rect_stroke(br, 3.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
     ui.painter().text(br.center(), Align2::CENTER_CENTER, tl!("Edit…"), Tokens::ui(11.5), t.text);
@@ -496,7 +512,7 @@ fn properties_nav(
         _ => "Turn on animation and add keyframe",
     };
     let at = pos2(row.max.x - PROPS_NAV_X, row.center().y);
-    let id = egui::Id::new(("props-nav", effect, param, clip.0));
+    let id = egui::Id::unique(("props-nav", effect, param, clip.0));
     if keyframe_nav(app, ui, at, prm, mt, it, id, &format!("properties.{effect}.{param}"), tip, actions) {
         if it.effect(effect).is_none() {
             actions.push(("effects.apply".into(), json!({"clips": [clip.0], "effect": effect})));
@@ -553,7 +569,7 @@ pub(crate) fn param_row(
         let key = graph_key(clip, idx, pkey);
         let open = app.ui.expanded_fx.contains(&key);
         let tw = Rect::from_center_size(pos2(r.min.x + 12.0, r.center().y), vec2(12.0, 12.0));
-        let tresp = ui.interact(tw.expand(2.0), egui::Id::new(("twirl", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Show graphs"));
+        let tresp = ui.interact(tw.expand(2.0), egui::Id::unique(("twirl", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Show graphs"));
         icons::paint(ui.painter(), tw, if open { Icon::ChevronDown } else { Icon::ChevronRight }, t.text_dim);
         app.auto.add(&format!("effectControls.{}.{}.graphs", e.effect, pkey), tw, "Show graphs");
         if tresp.clicked() {
@@ -566,7 +582,7 @@ pub(crate) fn param_row(
     }
     if pd.animatable {
         let sw = Rect::from_center_size(pos2(x, r.center().y), vec2(14.0, 14.0));
-        let resp = ui.interact(sw, egui::Id::new(("sw", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Toggle animation"));
+        let resp = ui.interact(sw, egui::Id::unique(("sw", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Toggle animation"));
         icons::paint(ui.painter(), sw, Icon::Stopwatch, if param.is_animated() { t.accent } else { t.text_dim });
         if resp.clicked() {
             actions.push(("effects.toggleAnimation".into(), with_mask(json!({"clip": clip.0, "effect": idx, "param": pd.id}))));
@@ -582,25 +598,43 @@ pub(crate) fn param_row(
             .max_rect(Rect::from_min_max(pos2(vx, r.min.y + 1.0), pos2(r.max.x - 26.0, r.max.y - 1.0)))
             .layout(egui::Layout::left_to_right(egui::Align::Center)),
     );
-    let id = egui::Id::new(("pv", clip.0, idx, pkey));
+    let id = egui::Id::unique(("pv", clip.0, idx, pkey));
     let mut set: Option<Value> = None;
     match (&pd.kind, &value) {
         (ParamKind::Float { min, max, soft_min, soft_max, unit, decimals }, ParamValue::Float(v)) => {
             let speed = ((soft_max - soft_min) / 400.0).max(0.01);
-            let (_, nv) = crate::widgets::hot_number(&mut vui, id, *v, speed, (*min, *max), *decimals as usize, unit, &t);
+            let (_, nv) = crate::widgets::hot_number(
+                &mut vui,
+                crate::i18n::t(pd.label),
+                id,
+                *v,
+                HotNumberOptions::new(speed, (*min, *max), *decimals as usize, unit, &t),
+            );
             if let Some(nv) = nv {
                 set = Some(json!(nv));
             }
         }
         (ParamKind::Angle, ParamValue::Float(v)) => {
-            let (_, nv) = crate::widgets::hot_number(&mut vui, id, *v, 0.5, (-36000.0, 36000.0), 1, "°", &t);
+            let (_, nv) = crate::widgets::hot_number(&mut vui, crate::i18n::t(pd.label), id, *v, HotNumberOptions::new(0.5, (-36000.0, 36000.0), 1, "°", &t));
             if let Some(nv) = nv {
                 set = Some(json!(nv));
             }
         }
         (ParamKind::Point, ParamValue::Vec2(p)) => {
-            let (_, nx) = crate::widgets::hot_number(&mut vui, id.with("x"), p.x, 1.0, (-100_000.0, 100_000.0), 1, "", &t);
-            let (_, ny) = crate::widgets::hot_number(&mut vui, id.with("y"), p.y, 1.0, (-100_000.0, 100_000.0), 1, "", &t);
+            let (_, nx) = crate::widgets::hot_number(
+                &mut vui,
+                &format!("{} X", crate::i18n::t(pd.label)),
+                id.with("x"),
+                p.x,
+                HotNumberOptions::new(1.0, (-100_000.0, 100_000.0), 1, "", &t),
+            );
+            let (_, ny) = crate::widgets::hot_number(
+                &mut vui,
+                &format!("{} Y", crate::i18n::t(pd.label)),
+                id.with("y"),
+                p.y,
+                HotNumberOptions::new(1.0, (-100_000.0, 100_000.0), 1, "", &t),
+            );
             if nx.is_some() || ny.is_some() {
                 set = Some(json!([nx.unwrap_or(p.x), ny.unwrap_or(p.y)]));
             }
@@ -608,7 +642,7 @@ pub(crate) fn param_row(
         (ParamKind::Bool, ParamValue::Bool(b)) => {
             let mut v = *b;
             fit_to_row(&mut vui);
-            if vui.checkbox(&mut v, "").changed() {
+            if crate::widgets::accessible_name(vui.checkbox(&mut v, ""), crate::i18n::t(pd.label)).changed() {
                 set = Some(json!(v));
             }
         }
@@ -617,13 +651,14 @@ pub(crate) fn param_row(
             fit_to_row(&mut vui);
             // (narrower when the effect list is narrow, so it stays left of the divider)
             let w = vui.available_width().min(130.0);
-            egui::ComboBox::from_id_salt(id).selected_text(opts.get(sel).map_or("", |o| crate::i18n::t(o))).width(w).show_ui(&mut vui, |ui| {
+            let combo = egui::ComboBox::from_id_salt(id).selected_text(opts.get(sel).map_or("", |o| crate::i18n::t(o))).width(w).show_ui(&mut vui, |ui| {
                 for (i, o) in opts.iter().enumerate() {
                     if ui.selectable_value(&mut sel, i, crate::i18n::t(o)).changed() {
                         set = Some(json!(i));
                     }
                 }
             });
+            crate::widgets::accessible_name(combo.response, crate::i18n::t(pd.label));
         }
         (ParamKind::Color, ParamValue::Color(c)) => {
             let mut rgba = egui::Rgba::from_rgba_unmultiplied(c[0], c[1], c[2], c[3]);
@@ -645,7 +680,7 @@ pub(crate) fn param_row(
         (ParamKind::Text, ParamValue::Text(s)) if !pd.id.ends_with("_lut") => {
             // edited in a buffer; committed (one undo step) when the field loses focus
             let mut buf = vui.data_mut(|d| d.get_temp::<String>(id)).unwrap_or_else(|| s.clone());
-            let r = vui.add(egui::TextEdit::singleline(&mut buf).desired_width(160.0));
+            let r = crate::widgets::accessible_name(vui.add(egui::TextEdit::singleline(&mut buf).desired_width(160.0)), crate::i18n::t(pd.label));
             app.auto.add(&format!("effectControls.text.{}.{}", idx, pd.id), r.rect, pd.label);
             if r.lost_focus() {
                 if buf != *s {
@@ -670,7 +705,7 @@ pub(crate) fn param_row(
     if pd.animatable && param.is_animated() {
         let at = pos2(r.max.x - 42.0, r.center().y);
         let auto = format!("effectControls.{}.{}", e.effect, pkey);
-        if keyframe_nav(app, ui, at, Some(param), mt, it, egui::Id::new(("knav", clip.0, idx, pkey)), &auto, "Add/Remove Keyframe", actions) {
+        if keyframe_nav(app, ui, at, Some(param), mt, it, egui::Id::unique(("knav", clip.0, idx, pkey)), &auto, "Add/Remove Keyframe", actions) {
             actions.push(("effects.addKeyframe".into(), with_mask(json!({"clip": clip.0, "effect": eff_json, "param": pd.id}))));
         }
     }
@@ -678,7 +713,7 @@ pub(crate) fn param_row(
     // keyframes and gets one at the playhead)
     if mask.is_none() {
         let rr = Rect::from_center_size(pos2(r.max.x - 14.0, r.center().y), vec2(12.0, 12.0));
-        let rresp = ui.interact(rr, egui::Id::new(("param-reset", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Reset Parameter"));
+        let rresp = ui.interact(rr, egui::Id::unique(("param-reset", clip.0, idx, pkey)), Sense::click()).on_hover_text(tl!("Reset Parameter"));
         icons::paint(ui.painter(), rr, Icon::Reset, if rresp.hovered() { t.text } else { t.text_dim });
         app.auto.add(&format!("effectControls.{}.{}.reset", e.effect, pkey), rr, "Reset Parameter");
         if rresp.clicked() {
@@ -695,7 +730,7 @@ pub(crate) fn param_row(
             if !(-0.01..=1.01).contains(&f) {
                 continue;
             }
-            let id = egui::Id::new(("kf", clip.0, idx, pkey, k.time.0));
+            let id = egui::Id::unique(("kf", clip.0, idx, pkey, k.time.0));
             let original = Rect::from_center_size(pos2(lane.min.x + f * lane.width(), y), vec2(15.0, 15.0));
             let resp = ui.interact(original.expand(2.0), id, Sense::click_and_drag());
             let reference = KeyframeRef { clip: clip.0, effect: idx, param: pd.id.to_string(), mask, time: k.time };
@@ -781,7 +816,7 @@ pub fn lumetri_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         for g in groups {
             let key = format!("lumetri:{g}");
             let open = !app.ui.collapsed_fx.contains(&key);
-            let (resp, now_open) = crate::widgets::section_header(ui, egui::Id::new(&key), crate::i18n::t(g), open, &t, true);
+            let (resp, now_open) = crate::widgets::section_header(ui, egui::Id::unique(&key), crate::i18n::t(g), open, &t, true);
             app.auto.add(&format!("lumetri.section.{g}"), resp.rect, g);
             if now_open != open {
                 if now_open {
@@ -801,8 +836,13 @@ pub fn lumetri_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     if let (ParamKind::Float { min, max, soft_min, soft_max, .. }, ParamValue::Float(x)) = (&pd.kind, &v) {
                         let mut val = *x;
                         let s = ui.add(egui::Slider::new(&mut val, *soft_min..=*soft_max).show_value(false));
-                        let (_, nv) =
-                            crate::widgets::hot_number(ui, egui::Id::new(("lum", pd.id)), val, (soft_max - soft_min) / 300.0, (*min, *max), 1, "", &t);
+                        let (_, nv) = crate::widgets::hot_number(
+                            ui,
+                            crate::i18n::t(pd.label),
+                            egui::Id::unique(("lum", pd.id)),
+                            val,
+                            HotNumberOptions::new((soft_max - soft_min) / 300.0, (*min, *max), 1, "", &t),
+                        );
                         if s.changed() {
                             actions.push(json!({"clip": clip.0, "effect": idx, "param": pd.id, "value": val}));
                         } else if let Some(nv) = nv {
@@ -863,7 +903,7 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if let Some((idx, c)) = reset {
             let rr = Rect::from_center_size(pos2(r.max.x - PROPS_NAV_X, r.center().y), vec2(14.0, 14.0));
             icons::paint(ui.painter(), rr, Icon::Reset, t.text_dim);
-            if ui.interact(rr, egui::Id::new(("props-reset", name, c)), Sense::click()).clicked() {
+            if ui.interact(rr, egui::Id::unique(("props-reset", name, c)), Sense::click()).clicked() {
                 actions.push(("effects.reset".into(), json!({"clip": c, "index": idx})));
             }
         }
@@ -898,9 +938,21 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     );
                     match val("motion", p) {
                         Some(ParamValue::Vec2(v)) => {
-                            let (_, nx) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp", p, "x", clip.0)), v.x, speed, range, 0, " X", &t);
+                            let (_, nx) = crate::widgets::hot_number(
+                                &mut vui,
+                                &format!("{label} X"),
+                                egui::Id::unique(("pp", p, "x", clip.0)),
+                                v.x,
+                                HotNumberOptions::new(speed, range, 0, " X", &t),
+                            );
                             vui.add_space(10.0);
-                            let (_, ny) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp", p, "y", clip.0)), v.y, speed, range, 0, " Y", &t);
+                            let (_, ny) = crate::widgets::hot_number(
+                                &mut vui,
+                                &format!("{label} Y"),
+                                egui::Id::unique(("pp", p, "y", clip.0)),
+                                v.y,
+                                HotNumberOptions::new(speed, range, 0, " Y", &t),
+                            );
                             if nx.is_some() || ny.is_some() {
                                 actions.push((
                                     "effects.setParam".into(),
@@ -911,13 +963,10 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                         Some(ParamValue::Float(v)) => {
                             let (_, nv) = crate::widgets::hot_number(
                                 &mut vui,
-                                egui::Id::new(("pp", p, clip.0)),
+                                label,
+                                egui::Id::unique(("pp", p, clip.0)),
                                 v,
-                                speed,
-                                range,
-                                if p == "scale" { 0 } else { 1 },
-                                unit,
-                                &t,
+                                HotNumberOptions::new(speed, range, if p == "scale" { 0 } else { 1 }, unit, &t),
                             );
                             if let Some(nv) = nv {
                                 actions.push(("effects.setParam".into(), json!({"clip": clip.0, "effect": "motion", "param": p, "value": nv})));
@@ -934,7 +983,13 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                         .layout(egui::Layout::left_to_right(egui::Align::Center)),
                 );
                 if let Some(ParamValue::Float(v)) = val("opacity", "opacity") {
-                    let (_, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp-op", clip.0)), v, 0.5, (0.0, 100.0), 0, " %", &t);
+                    let (_, nv) = crate::widgets::hot_number(
+                        &mut vui,
+                        tl!("Opacity"),
+                        egui::Id::unique(("pp-op", clip.0)),
+                        v,
+                        HotNumberOptions::new(0.5, (0.0, 100.0), 0, " %", &t),
+                    );
                     if let Some(nv) = nv {
                         actions.push(("effects.setParam".into(), json!({"clip": clip.0, "effect": "opacity", "param": "opacity", "value": nv})));
                     }
@@ -951,7 +1006,13 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                             .layout(egui::Layout::left_to_right(egui::Align::Center)),
                     );
                     let v = val("crop", p).and_then(|v| v.as_f64()).unwrap_or(0.0);
-                    let (_, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp-crop", p, clip.0)), v, 0.2, (0.0, 100.0), 1, " %", &t);
+                    let (_, nv) = crate::widgets::hot_number(
+                        &mut vui,
+                        label,
+                        egui::Id::unique(("pp-crop", p, clip.0)),
+                        v,
+                        HotNumberOptions::new(0.2, (0.0, 100.0), 1, " %", &t),
+                    );
                     if let Some(nv) = nv {
                         if crop.is_none() {
                             actions.push(("effects.apply".into(), json!({"clips": [clip.0], "effect": "crop"})));
@@ -975,7 +1036,13 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     .layout(egui::Layout::left_to_right(egui::Align::Center)),
             );
             let v = val("volume", "level").and_then(|v| v.as_f64()).unwrap_or(0.0);
-            let (_, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp-vol", clip.0)), v, 0.1, (-96.0, 15.0), 1, " dB", &t);
+            let (_, nv) = crate::widgets::hot_number(
+                &mut vui,
+                tl!("Level"),
+                egui::Id::unique(("pp-vol", clip.0)),
+                v,
+                HotNumberOptions::new(0.1, (-96.0, 15.0), 1, " dB", &t),
+            );
             if let Some(nv) = nv {
                 actions.push(("effects.setParam".into(), json!({"clip": clip.0, "effect": "volume", "param": "level", "value": nv})));
             }
@@ -987,7 +1054,13 @@ pub fn properties_panel(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     .layout(egui::Layout::left_to_right(egui::Align::Center)),
             );
             let v = val("panner", "balance").and_then(|v| v.as_f64()).unwrap_or(0.0);
-            let (_, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new(("pp-pan", clip.0)), v, 0.5, (-100.0, 100.0), 0, "", &t);
+            let (_, nv) = crate::widgets::hot_number(
+                &mut vui,
+                tl!("Pan"),
+                egui::Id::unique(("pp-pan", clip.0)),
+                v,
+                HotNumberOptions::new(0.5, (-100.0, 100.0), 0, "", &t),
+            );
             if let Some(nv) = nv {
                 actions.push(("effects.setParam".into(), json!({"clip": clip.0, "effect": "panner", "param": "balance", "value": nv})));
             }
@@ -1019,7 +1092,7 @@ pub(crate) fn row_fill(r: Rect) -> Rect {
 /// keeps it.
 pub(crate) fn run(app: &mut FilmcraftApp, ctx: &egui::Context, actions: Vec<(String, Value)>) {
     let (down, press) = ctx.input(|i| (i.pointer.any_down(), i.pointer.press_start_time()));
-    let key = egui::Id::new("effect-controls-drag-step");
+    let key = egui::Id::unique("effect-controls-drag-step");
     let begun = ctx.data(|d| d.get_temp::<Option<f64>>(key)).flatten();
     let mut wrote = false;
     for (cmd, mut p) in actions {
@@ -1114,7 +1187,7 @@ pub(crate) fn graph_rows(
     }
     // While the graph stays open its range only widens: refitted to the keyframes, a keyframe
     // dragged off the top or bottom edge was drawn back on that edge, the curve unchanged (#1918)
-    let range_id = egui::Id::new(("kfg-range", clip.0, idx, mask, pd.id));
+    let range_id = egui::Id::unique(("kfg-range", clip.0, idx, mask, pd.id));
     let frame = ui.ctx().cumulative_frame_nr();
     if let Some((a, b, seen)) = ui.data(|d| d.get_temp::<(f64, f64, u64)>(range_id))
         && frame.saturating_sub(seen) <= 1
@@ -1185,7 +1258,7 @@ pub(crate) fn graph_rows(
             if !v.is_finite() {
                 continue;
             }
-            let id = egui::Id::new(("kfg", clip.0, idx, mask, pd.id, k.time.0));
+            let id = egui::Id::unique(("kfg", clip.0, idx, mask, pd.id, k.time.0));
             let id = if ci == 0 { id } else { id.with(ci) };
             let dy: f32 = ui.data(|d| d.get_temp(id)).unwrap_or(0.0);
             let c = pos2(x_of(f), y_of(v) + dy);
diff --git a/crates/ui-egui/src/panels/effect_controls_selection.rs b/crates/ui-egui/src/panels/effect_controls_selection.rs
index c8db9a7d1..db539d5d5 100644
--- a/crates/ui-egui/src/panels/effect_controls_selection.rs
+++ b/crates/ui-egui/src/panels/effect_controls_selection.rs
@@ -11,8 +11,9 @@ use crate::{
     state::KeyframeRef,
 };
 
+/// Key for the keyframe-selection gesture state in egui's temp store; `begin` resets it when the clip changes.
 fn state_id() -> Id {
-    Id::new("effect-controls-keyframe-selection")
+    Id::unique("effect-controls-keyframe-selection")
 }
 
 #[derive(Clone)]
@@ -103,6 +104,8 @@ fn update(group: &mut Group, points: &[Point], pos: Pos2, shift: bool, playhead:
 }
 
 impl Interaction {
+    /// Begin keyframe selection for `clip`: reset on a clip change, cancel a gesture on Escape, start a Shift marquee from the existing selection, and keep
+    /// gestures as UI-only previews.
     pub(crate) fn begin(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect, clip: u64) -> Self {
         let mut state = ui.data(|d| d.get_temp::<State>(state_id())).unwrap_or_default();
         if state.clip != clip {
@@ -112,7 +115,7 @@ impl Interaction {
         if cancelled {
             state.gesture = None;
         }
-        let background = ui.interact(area, Id::new(("ec-select", clip)), Sense::click_and_drag());
+        let background = ui.interact(area, Id::unique(("ec-select", clip)), Sense::click_and_drag());
         if background.clicked_by(egui::PointerButton::Primary) && !ui.input(|i| i.modifiers.shift) {
             app.ui.keyframe_selection.clear();
         }
diff --git a/crates/ui-egui/src/panels/effects.rs b/crates/ui-egui/src/panels/effects.rs
index c4f5c15bb..3f897445e 100644
--- a/crates/ui-egui/src/panels/effects.rs
+++ b/crates/ui-egui/src/panels/effects.rs
@@ -87,8 +87,9 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     if resp.hovered() {
                         ui.painter().rect_filled(r, 0.0, t.hover);
                     }
-                    let x = r.min.x + 46.0;
-                    let icon_r = Rect::from_center_size(pos2(x - 10.0, r.center().y), vec2(13.0, 13.0));
+                    // inside the top folder, or inside its sub-folder
+                    let x = r.min.x + tree_x(if s.is_empty() { 1 } else { 2 }) + 30.0;
+                    let icon_r = Rect::from_center_size(pos2(x - 12.0, r.center().y), vec2(13.0, 13.0));
                     let is_tr = matches!(d.kind, filmcraft_project::EffectKind::VideoTransition | filmcraft_project::EffectKind::AudioTransition);
                     ui.painter().rect_stroke(icon_r, 2.0, egui::Stroke::new(1.0, t.text_dim), egui::StrokeKind::Inside);
                     if is_tr {
@@ -139,6 +140,13 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
+/// Where a tree row at `depth` starts (its chevron): folders at 0 (top) and 1 (sub-folders), and
+/// what a folder holds one level deeper than the folder (#2329), so an effect is never level with,
+/// or left of, the folder it is in. A row's icon is centred 18 points in, its label 30.
+pub(crate) fn tree_x(depth: usize) -> f32 {
+    8.0 + depth as f32 * 16.0
+}
+
 fn folder_row(app: &mut FilmcraftApp, ui: &mut egui::Ui, key: &str, depth: usize, filter: &str) -> bool {
     let t = app.tokens;
     let open = !filter.is_empty() || app.ui.expanded_fx.iter().any(|k| k == key);
@@ -146,7 +154,7 @@ fn folder_row(app: &mut FilmcraftApp, ui: &mut egui::Ui, key: &str, depth: usize
     if resp.hovered() {
         ui.painter().rect_filled(r, 0.0, t.hover);
     }
-    let x = r.min.x + 8.0 + depth as f32 * 16.0;
+    let x = r.min.x + tree_x(depth);
     icons::paint(
         ui.painter(),
         Rect::from_center_size(pos2(x + 4.0, r.center().y), vec2(10.0, 10.0)),
@@ -240,7 +248,8 @@ fn lumetri_rows(app: &mut FilmcraftApp, ui: &mut egui::Ui, filter: &str) -> Opti
                 ui.painter().rect_filled(r, 0.0, t.hover);
             }
             let tex = preset_texture(app, ui.ctx(), p, 64);
-            let tr = Rect::from_min_size(pos2(r.min.x + 40.0, r.min.y + 3.0), vec2(32.0, 18.0));
+            // inside a Lumetri Presets sub-folder: one level deeper than it
+            let tr = Rect::from_min_size(pos2(r.min.x + tree_x(2) + 12.0, r.min.y + 3.0), vec2(32.0, 18.0));
             ui.painter().image(tex, tr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
             ui.painter().text(pos2(tr.max.x + 8.0, r.center().y), Align2::LEFT_CENTER, crate::i18n::t(p.name), Tokens::ui(12.0), t.text);
             app.auto.add(&format!("effects.lumetriPreset.{}", p.name), r, p.name);
@@ -279,7 +288,7 @@ fn preset_grid(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect) -> Option<
         }
         let pic = Rect::from_min_size(cell.min, vec2(cw, ch));
         let tex = preset_texture(app, ui.ctx(), p, 160);
-        let resp = ui.interact(cell, egui::Id::new(("lumetri-grid", p.name)), Sense::click_and_drag()).on_hover_text(crate::i18n::t(p.description));
+        let resp = ui.interact(cell, egui::Id::unique(("lumetri-grid", p.name)), Sense::click_and_drag()).on_hover_text(crate::i18n::t(p.description));
         ui.painter().rect_filled(cell, 3.0, if resp.hovered() { t.hover } else { t.field_bg });
         ui.painter().image(tex, pic.shrink(2.0), Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
         let label = ui.painter().layout(crate::i18n::t(p.name).to_string(), Tokens::ui(11.0), t.text, cw - 6.0);
diff --git a/crates/ui-egui/src/panels/essential_sound.rs b/crates/ui-egui/src/panels/essential_sound.rs
index 958594db3..71e072288 100644
--- a/crates/ui-egui/src/panels/essential_sound.rs
+++ b/crates/ui-egui/src/panels/essential_sound.rs
@@ -64,7 +64,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let shown = if name == "Browse" { tl!("Browse") } else { tl!("Edit") };
         let g = painter.layout_no_wrap(shown.to_string(), Tokens::ui(12.5), t.text);
         let r = Rect::from_min_size(pos2(x, ty - 9.0), vec2(g.size().x, 20.0));
-        let resp = ui.interact(r, egui::Id::new(("es-tab", name)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("es-tab", name)), Sense::click());
         let col = if name == tab || resp.hovered() { t.text } else { t.text_dim };
         painter.text(pos2(x, ty), Align2::LEFT_CENTER, shown, Tokens::ui(12.5), col);
         if name == tab {
@@ -210,7 +210,7 @@ fn typed_body(ui: &mut egui::Ui, cx: &mut Ctx, st: &EssentialSound, items: &[Tra
     let mine: Vec<&es::Preset> = presets.iter().filter(|p| p.kind == kind).collect();
     let current = if st.preset.is_empty() { tl!("(Custom)").to_string() } else { crate::i18n::t(&st.preset).to_string() };
     let mut picked = None;
-    let draft_id = egui::Id::new("es-preset-draft");
+    let draft_id = egui::Id::unique("es-preset-draft");
     let mut draft: Option<String> = ui.data(|d| d.get_temp(draft_id));
     ui.horizontal(|ui| {
         let w = ui.available_width() - 56.0;
@@ -242,7 +242,10 @@ fn typed_body(ui: &mut egui::Ui, cx: &mut Ctx, st: &EssentialSound, items: &[Tra
     if let Some(mut d) = draft.take() {
         let mut done = false;
         ui.horizontal(|ui| {
-            let r = ui.add(egui::TextEdit::singleline(&mut d).hint_text(tl!("Preset name")).desired_width(ui.available_width() - 70.0));
+            let r = crate::widgets::accessible_name(
+                ui.add(egui::TextEdit::singleline(&mut d).hint_text(tl!("Preset name")).desired_width(ui.available_width() - 70.0)),
+                "Preset name",
+            );
             cx.auto.add("essentialSound.preset.name", r.rect, "Preset name");
             let ok = ui.button(tl!("Save"));
             cx.auto.add("essentialSound.preset.ok", ok.rect, "Save");
@@ -355,7 +358,7 @@ fn ducking(ui: &mut egui::Ui, cx: &mut Ctx, st: &EssentialSound, on: bool) {
     for kind in AudioType::ALL {
         let br = Rect::from_min_size(pos2(x, r.min.y + 2.0), vec2(30.0, 26.0));
         let sel = st.ducking.against.contains(&kind);
-        let resp = ui.interact(br, egui::Id::new(("es-duck", kind.id())), Sense::click());
+        let resp = ui.interact(br, egui::Id::unique(("es-duck", kind.id())), Sense::click());
         ui.painter().rect_filled(
             br,
             4.0,
@@ -381,7 +384,7 @@ fn ducking(ui: &mut egui::Ui, cx: &mut Ctx, st: &EssentialSound, on: bool) {
         x += 34.0;
     }
     let br = Rect::from_min_size(pos2(x + 4.0, r.min.y + 2.0), vec2(84.0, 26.0));
-    let resp = ui.interact(br, egui::Id::new("es-duck-untyped"), Sense::click());
+    let resp = ui.interact(br, egui::Id::unique("es-duck-untyped"), Sense::click());
     let sel = st.ducking.against_untyped;
     ui.painter().rect_filled(
         br,
@@ -463,7 +466,7 @@ fn section_header(ui: &mut egui::Ui, cx: &mut Ctx, sec: Section, open: bool, ena
 
 /// A pill switch. Returns clicked.
 fn switch(ui: &mut egui::Ui, cx: &mut Ctx, r: Rect, on: bool, id: &str, label: &str) -> bool {
-    let resp = ui.interact(r.expand(3.0), egui::Id::new(("es-sw", id)), Sense::click());
+    let resp = ui.interact(r.expand(3.0), egui::Id::unique(("es-sw", id)), Sense::click());
     let p = ui.painter();
     let rad = r.height() / 2.0;
     if on {
@@ -520,7 +523,7 @@ fn slider_track(ui: &mut egui::Ui, cx: &mut Ctx, track: Rect, key: &str, v: f64,
     let y = track.center().y;
     let f = ((v - lo) / (hi - lo)).clamp(0.0, 1.0) as f32;
     let kx = track.min.x + f * track.width();
-    let resp = ui.interact(track.expand2(vec2(6.0, 4.0)), egui::Id::new(("es-slider", key)), Sense::click_and_drag());
+    let resp = ui.interact(track.expand2(vec2(6.0, 4.0)), egui::Id::unique(("es-slider", key)), Sense::click_and_drag());
     let line = if active { cx.t.switch_border } else { cx.t.slider_disabled_track };
     ui.painter().line_segment([pos2(track.min.x, y), pos2(kx - 7.0, y)], Stroke::new(1.5, line));
     ui.painter().line_segment([pos2(kx + 7.0, y), pos2(track.max.x, y)], Stroke::new(1.5, line));
@@ -581,7 +584,7 @@ fn choice_row(ui: &mut egui::Ui, cx: &mut Ctx, key: &str, opts: &[&str], sel: us
     let w = 84.0;
     for (i, o) in opts.iter().enumerate() {
         let br = Rect::from_min_size(pos2(r.min.x + 42.0 + i as f32 * (w + 4.0), r.min.y + 3.0), vec2(w, 22.0));
-        let resp = ui.interact(br, egui::Id::new(("es-choice", key, i)), Sense::click());
+        let resp = ui.interact(br, egui::Id::unique(("es-choice", key, i)), Sense::click());
         let on = i == sel;
         ui.painter().rect_filled(
             br,
@@ -604,7 +607,7 @@ fn choice_row(ui: &mut egui::Ui, cx: &mut Ctx, key: &str, opts: &[&str], sel: us
 
 fn button(ui: &mut egui::Ui, cx: &mut Ctx, r: Rect, text: &str, id: &str) -> bool {
     let t = cx.t;
-    let resp = ui.interact(r, egui::Id::new(("es-btn", id)), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(("es-btn", id)), Sense::click());
     ui.painter().rect_filled(r, 4.0, if resp.hovered() { cx.t.button_hover } else { t.field_bg });
     ui.painter().rect_stroke(r, 4.0, Stroke::new(1.0, cx.t.button_border), StrokeKind::Inside);
     ui.painter().text(r.center(), Align2::CENTER_CENTER, text, Tokens::ui(12.0), t.text);
diff --git a/crates/ui-egui/src/panels/events.rs b/crates/ui-egui/src/panels/events.rs
index 85174e260..f0d672e3f 100644
--- a/crates/ui-egui/src/panels/events.rs
+++ b/crates/ui-egui/src/panels/events.rs
@@ -198,7 +198,7 @@ pub fn progress(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             elems.push((format!("progress.job.{id}"), r, format!("{label}: {status}")));
             if !done {
                 let cr = Rect::from_center_size(pos2(r.max.x - 18.0, bar.center().y), vec2(20.0, 20.0));
-                let resp = ui.interact(cr, egui::Id::new(("progress-cancel", id)), Sense::click());
+                let resp = ui.interact(cr, egui::Id::unique(("progress-cancel", id)), Sense::click());
                 let col = if resp.hovered() { t.danger } else { t.icon };
                 let s = Stroke::new(1.5, col);
                 ui.painter().line_segment([cr.center() + vec2(-5.0, -5.0), cr.center() + vec2(5.0, 5.0)], s);
diff --git a/crates/ui-egui/src/panels/export_mode.rs b/crates/ui-egui/src/panels/export_mode.rs
index 9dac65003..7e99a9082 100644
--- a/crates/ui-egui/src/panels/export_mode.rs
+++ b/crates/ui-egui/src/panels/export_mode.rs
@@ -336,13 +336,29 @@ fn combo_why(ui: &mut egui::Ui, reg: &mut Reg, id: &str, selected: &str, options
     chosen
 }
 
+/// Why a format cannot be exported on this machine, or None when it can. H.265 and AV1 have no
+/// software encoder: without a hardware one (NVENC on NVIDIA, VideoToolbox on macOS) they are
+/// greyed out with the reason, instead of failing at export time.
+fn unavailable_why(format: Format) -> Option<&'static str> {
+    if filmcraft_engine::export::available(format) {
+        return None;
+    }
+    Some(match format {
+        Format::Hevc => tl!(
+            "H.265 (HEVC) needs a hardware encoder (NVENC on NVIDIA GPUs, VideoToolbox on macOS); none was found on this machine, and FilmCraft has no software H.265 encoder yet. Choose H.264 or ProRes instead."
+        ),
+        Format::Av1 => tl!("AV1 needs a hardware encoder; none was found on this machine, and FilmCraft has no software AV1 encoder yet."),
+        _ => tl!("Not supported by FilmCraft's encoders yet"),
+    })
+}
+
 fn opts(labels: &[&str]) -> Vec<(String, bool)> {
     labels.iter().map(|l| (l.to_string(), true)).collect()
 }
 
 fn section(ui: &mut egui::Ui, reg: &mut Reg, open: &mut Vec<String>, key: &str, title: &str, t: &Tokens) -> bool {
     let is_open = open.iter().any(|k| k == key);
-    let (r, now) = crate::widgets::section_header(ui, egui::Id::new(("export-sec", key)), title, is_open, t, true);
+    let (r, now) = crate::widgets::section_header(ui, egui::Id::unique(("export-sec", key)), title, is_open, t, true);
     reg.add(format!("export.section.{key}"), r.rect, title);
     if now != is_open {
         if now {
@@ -380,7 +396,7 @@ fn check(ui: &mut egui::Ui, reg: &mut Reg, id: &str, v: &mut bool, label: &str)
 }
 
 fn text(ui: &mut egui::Ui, reg: &mut Reg, id: &str, v: &mut String, hint: &str) {
-    let r = ui.add(egui::TextEdit::singleline(v).hint_text(hint).desired_width(f32::INFINITY));
+    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(v).hint_text(hint).desired_width(f32::INFINITY)), hint);
     reg.add(id, r.rect, hint);
 }
 
@@ -389,9 +405,9 @@ fn text(ui: &mut egui::Ui, reg: &mut Reg, id: &str, v: &mut String, hint: &str)
 /// when that is not usable yet (emptied to retype, a half-typed path); each non-empty value is
 /// returned as it comes. Leaving shows the stored value again.
 fn draft_text(ui: &mut egui::Ui, reg: &mut Reg, id: &str, stored: &str, hint: &str) -> Option<String> {
-    let draft_id = egui::Id::new(("export-draft", id));
+    let draft_id = egui::Id::unique(("export-draft", id));
     let mut v = ui.data(|m| m.get_temp::<String>(draft_id)).unwrap_or_else(|| stored.to_string());
-    let r = ui.add(egui::TextEdit::singleline(&mut v).hint_text(hint).desired_width(f32::INFINITY));
+    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut v).hint_text(hint).desired_width(f32::INFINITY)), hint);
     reg.add(id, r.rect, hint);
     if r.has_focus() {
         ui.data_mut(|m| m.insert_temp(draft_id, v.clone()));
@@ -401,6 +417,23 @@ fn draft_text(ui: &mut egui::Ui, reg: &mut Reg, id: &str, stored: &str, hint: &s
     (r.changed() && !v.trim().is_empty()).then_some(v)
 }
 
+/// Longest folder tail the link lays out or shows on hover.
+const MAX_LOCATION_DISPLAY_BYTES: usize = 4096;
+
+/// Keep the tail of a UTF-8 folder name without copying or splitting a codepoint. Project item
+/// names can enter the generated export path, so UI display work must not scale with an arbitrary
+/// imported name.
+fn location_tail(s: &str) -> (&str, bool) {
+    if s.len() <= MAX_LOCATION_DISPLAY_BYTES {
+        return (s, false);
+    }
+    let mut start = s.len() - MAX_LOCATION_DISPLAY_BYTES;
+    while !s.is_char_boundary(start) {
+        start += 1;
+    }
+    (&s[start..], true)
+}
+
 /// The output folder as a link (folder icon, accent colour, underlined); the caller opens the save
 /// dialog on a click. A path too long for the row loses its start, so the folder's name stays.
 fn location_link(ui: &mut egui::Ui, t: &Tokens, folder: &str) -> egui::Response {
@@ -408,18 +441,34 @@ fn location_link(ui: &mut egui::Ui, t: &Tokens, folder: &str) -> egui::Response
     let col = if resp.hovered() { t.accent_hover } else { t.accent };
     crate::icons::paint(ui.painter(), Rect::from_center_size(pos2(r.min.x + 8.0, r.center().y), vec2(14.0, 14.0)), crate::icons::Icon::Folder, col);
     let room = (r.width() - 22.0).max(0.0);
+    let (folder, truncated) = location_tail(folder);
     let mut galley = ui.painter().layout_no_wrap(folder.to_string(), Tokens::ui(12.5), col);
-    for (i, _) in folder.char_indices().skip(1) {
-        if galley.size().x <= room {
-            break;
-        }
-        galley = ui.painter().layout_no_wrap(format!("…{}", folder.get(i..).unwrap_or("")), Tokens::ui(12.5), col);
+    if galley.size().x > room {
+        let starts: Vec<usize> = folder.char_indices().map(|(i, _)| i).collect();
+        let suffix = if starts.len() > 1 {
+            let mut lo = 1usize;
+            let mut hi = starts.len() - 1;
+            while lo < hi {
+                let mid = (lo + hi) / 2;
+                let candidate = format!("…{}", &folder[starts[mid]..]);
+                if ui.painter().layout_no_wrap(candidate, Tokens::ui(12.5), col).size().x <= room {
+                    hi = mid;
+                } else {
+                    lo = mid + 1;
+                }
+            }
+            format!("…{}", &folder[starts[lo]..])
+        } else {
+            "…".into()
+        };
+        galley = ui.painter().layout_no_wrap(suffix, Tokens::ui(12.5), col);
     }
     let at = pos2(r.min.x + 20.0, r.center().y - galley.size().y / 2.0);
     let underline = at.y + galley.size().y;
     ui.painter().hline(at.x..=at.x + galley.size().x, underline, egui::Stroke::new(1.0, col));
     ui.painter().galley(at, galley, col);
-    resp.on_hover_cursor(egui::CursorIcon::PointingHand).on_hover_text(folder)
+    let hover = if truncated { format!("…{folder}") } else { folder.to_string() };
+    resp.on_hover_cursor(egui::CursorIcon::PointingHand).on_hover_text(hover)
 }
 
 const RATES: [(&str, FrameRate); 11] = [
@@ -519,8 +568,9 @@ fn settings_column(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         });
         row(ui, &t, tl!("Format"), |ui| {
-            let labels: Vec<(String, bool)> = Format::ALL.iter().map(|f| (f.label().to_string(), filmcraft_engine::export::available(*f))).collect();
-            if let Some(i) = combo(ui, &mut reg, "export.format", ex.settings.format.label(), &labels, ui.available_width() - 4.0) {
+            // a format without an encoder here says why: H.265 and AV1 have hardware encoders only
+            let labels: Vec<(String, Option<&str>)> = Format::ALL.iter().map(|f| (f.label().to_string(), unavailable_why(*f))).collect();
+            if let Some(i) = combo_why(ui, &mut reg, "export.format", ex.settings.format.label(), &labels, ui.available_width() - 4.0) {
                 let f = Format::ALL[i];
                 if f != ex.settings.format {
                     // a format switch starts from that format's defaults (keeping size / rate / range)
@@ -536,6 +586,12 @@ fn settings_column(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 }
             }
         });
+        // a preset can name a format this machine cannot encode (an H.265 preset without a hardware
+        // encoder): say so where the format is chosen, before the export fails
+        if let Some(why) = unavailable_why(ex.settings.format) {
+            let r = ui.label(egui::RichText::new(why).color(t.danger).small());
+            reg.add("export.format.unavailable", r.rect, why);
+        }
         ui.add_space(8.0);
         let s = &mut ex.settings;
         if s.has_video() && section(ui, &mut reg, &mut ex.open_sections, "video", tl!("Video"), &t) {
@@ -1139,11 +1195,11 @@ fn preview_column(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq_id:
     // buttons
     let go = Rect::from_min_size(pos2(rect.max.x - 120.0, rect.max.y - 44.0), vec2(104.0, 30.0));
     let queue = Rect::from_min_size(pos2(go.min.x - 132.0, go.min.y), vec2(122.0, 30.0));
-    let qresp = ui.interact(queue, egui::Id::new("export-queue-send"), Sense::click());
+    let qresp = ui.interact(queue, egui::Id::unique("export-queue-send"), Sense::click());
     ui.painter().rect_stroke(queue, 15.0, egui::Stroke::new(1.0, if qresp.hovered() { t.text } else { t.text_dim }), egui::StrokeKind::Inside);
     ui.painter().text(queue.center(), Align2::CENTER_CENTER, tl!("Send to Queue"), Tokens::semibold(12.5), t.text);
     reg.add("export.sendToQueue", queue, "Send to Queue");
-    let resp = ui.interact(go, egui::Id::new("export-go"), Sense::click());
+    let resp = ui.interact(go, egui::Id::unique("export-go"), Sense::click());
     ui.painter().rect_filled(go, 15.0, if resp.hovered() { t.accent_hover } else { t.accent });
     ui.painter().text(go.center(), Align2::CENTER_CENTER, tl!("Export"), Tokens::semibold(13.0), Color32::WHITE);
     reg.add("export.button", go, "Export");
@@ -1200,8 +1256,8 @@ fn preset_manager(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let favorite = |n: &str| app.session.export_presets.is_favorite(n);
     let q = m.query.to_lowercase();
     egui::Window::new(tl!("Preset Manager"))
-        .id(egui::Id::new("Preset Manager"))
-        .id(egui::Id::new("preset-manager"))
+        .id(egui::Id::unique("Preset Manager"))
+        .id(egui::Id::unique("preset-manager"))
         .open(&mut open)
         .collapsible(false)
         .resizable(true)
@@ -1259,7 +1315,10 @@ fn preset_manager(app: &mut FilmcraftApp, ctx: &egui::Context) {
             }
             ui.horizontal(|ui| {
                 ui.label(tl!("Save current settings as:"));
-                let r = ui.add(egui::TextEdit::singleline(&mut m.save_name).hint_text(tl!("Preset name")).desired_width(200.0));
+                let r = crate::widgets::accessible_name(
+                    ui.add(egui::TextEdit::singleline(&mut m.save_name).hint_text(tl!("Preset name")).desired_width(200.0)),
+                    "Preset name",
+                );
                 reg.add("presetManager.saveName", r.rect, "Preset name");
                 let r = ui.add_enabled(!m.save_name.trim().is_empty(), egui::Button::new(tl!("Save")));
                 reg.add("presetManager.save", r.rect, "Save");
@@ -1375,13 +1434,15 @@ fn quick_file(app: &FilmcraftApp, path: &str, seq_name: &str, ext: &str) -> Opti
     let p = std::path::Path::new(path);
     let folder = path.ends_with(['/', '\\']);
     let dir = if folder { Some(p) } else { p.parent() }.filter(|d| !d.as_os_str().is_empty());
-    let name = if folder { None } else { p.file_name().and_then(|n| n.to_str()) }.filter(|n| !n.trim().is_empty());
-    let cur = name.and_then(|n| std::path::Path::new(n).extension()).and_then(|e| e.to_str()).unwrap_or("");
+    let name = if folder { None } else { p.file_name().and_then(std::ffi::OsStr::to_str) }.filter(|n| !n.trim().is_empty());
+    let cur = name.and_then(|n| std::path::Path::new(n).extension()).and_then(std::ffi::OsStr::to_str).unwrap_or("");
     if dir.is_some() && name.is_some() && cur.eq_ignore_ascii_case(ext) {
         return None;
     }
     let file = match name {
-        None => format!("{seq_name}.{ext}"),
+        // Sequence names come from the project, not from this Quick Export interaction. Keep
+        // metadata in one filename component before joining it to the selected/default folder.
+        None => format!("{}.{}", filmcraft_engine::export_tools::file_safe(seq_name), ext),
         Some(n) if cur.eq_ignore_ascii_case(ext) => n.to_string(),
         Some(n) if !cur.is_empty() && app.session.export_presets.all().iter().any(|x| x.settings.extension().eq_ignore_ascii_case(cur)) => {
             std::path::Path::new(n).with_extension(ext).to_string_lossy().to_string()
@@ -1428,7 +1489,7 @@ pub fn quick_export(app: &mut FilmcraftApp, ctx: &egui::Context, anchor: egui::P
     let mut browse = false;
     let mut typed: Option<String> = None;
     let q = &mut app.ui.export;
-    let area = egui::Area::new(egui::Id::new("quick-export")).order(egui::Order::Foreground).fixed_pos(anchor).show(ctx, |ui| {
+    let area = egui::Area::new(egui::Id::unique("quick-export")).order(egui::Order::Foreground).fixed_pos(anchor).show(ctx, |ui| {
         egui::Frame::popup(ui.style()).show(ui, |ui| {
             ui.set_width(340.0);
             ui.horizontal(|ui| {
@@ -1468,7 +1529,7 @@ pub fn quick_export(app: &mut FilmcraftApp, ctx: &egui::Context, anchor: egui::P
     });
     let clicked_elsewhere = area.response.clicked_elsewhere();
     // the header click that opened the popup is not a click elsewhere
-    let toggled = ctx.data_mut(|d| d.remove_temp::<bool>(egui::Id::new("quick-export-toggled")).unwrap_or(false));
+    let toggled = ctx.data_mut(|d| d.remove_temp::<bool>(egui::Id::unique("quick-export-toggled")).unwrap_or(false));
     reg.flush(app);
     if let Some(v) = typed {
         // a file name goes in the shown folder; a typed or pasted path replaces both
@@ -1504,3 +1565,18 @@ fn list_row(ui: &mut egui::Ui, t: &Tokens, selected: bool, text: &str, width: f3
     ui.painter().text(pos2(r.min.x + 6.0, r.center().y), Align2::LEFT_CENTER, text, Tokens::ui(12.5), if selected { Color32::WHITE } else { t.text });
     resp
 }
+
+#[cfg(test)]
+mod location_tests {
+    use super::*;
+
+    #[test]
+    fn location_tail_is_bounded_and_keeps_utf8_intact() {
+        let input = format!("/{}終", "é".repeat(MAX_LOCATION_DISPLAY_BYTES));
+        let (tail, truncated) = location_tail(&input);
+        assert!(truncated);
+        assert!(tail.len() <= MAX_LOCATION_DISPLAY_BYTES);
+        assert!(tail.ends_with('終'));
+        assert!(std::str::from_utf8(tail.as_bytes()).is_ok());
+    }
+}
diff --git a/crates/ui-egui/src/panels/file_dialogs.rs b/crates/ui-egui/src/panels/file_dialogs.rs
index 23905b4ba..5c60b2b8e 100644
--- a/crates/ui-egui/src/panels/file_dialogs.rs
+++ b/crates/ui-egui/src/panels/file_dialogs.rs
@@ -42,7 +42,7 @@ pub fn show_recovery(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     }
     let mut choice = app.file_dialogs.recovery_choice.min(items.len() - 1);
     let mut open = true;
-    egui::Modal::new(egui::Id::new("recovery-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
+    egui::Modal::new(egui::Id::unique("recovery-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
         ui.set_width(520.0);
         Frame::new().inner_margin(Margin { left: 28, right: 28, top: 24, bottom: 20 }).show(ui, |ui| {
             ui.label(RichText::new(tl!("Recover Unsaved Changes")).size(18.0).strong().color(t.text));
@@ -108,7 +108,7 @@ pub fn show_revert(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let t = app.tokens;
     let file = app.session.path.as_deref().and_then(|p| std::path::Path::new(p).file_name()).map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
     let mut open = true;
-    let r = egui::Modal::new(egui::Id::new("revert-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
+    let r = egui::Modal::new(egui::Id::unique("revert-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
         ui.set_width(460.0);
         Frame::new().inner_margin(Margin { left: 28, right: 28, top: 24, bottom: 20 }).show(ui, |ui| {
             ui.label(RichText::new(tl!("Revert")).size(18.0).strong().color(t.text));
diff --git a/crates/ui-egui/src/panels/frame_export.rs b/crates/ui-egui/src/panels/frame_export.rs
index 5e20887e3..59e9d14c0 100644
--- a/crates/ui-egui/src/panels/frame_export.rs
+++ b/crates/ui-egui/src/panels/frame_export.rs
@@ -20,7 +20,7 @@ struct Draft {
     replace: Option<String>,
 }
 fn draft_id() -> egui::Id {
-    egui::Id::new("frame-export-draft")
+    egui::Id::unique("frame-export-draft")
 }
 fn clean(name: &str) -> String {
     name.trim().chars().map(|c| if matches!(c, '/' | '\\' | ':' | '*' | '?' | '"' | '<' | '>' | '|') { '_' } else { c }).collect()
@@ -41,7 +41,7 @@ pub fn open(app: &mut FilmcraftApp, ctx: &egui::Context, params: &Value) -> Resu
     } else if app.playback.playing {
         app.stop();
     }
-    let folder = ctx.data(|m| m.get_temp::<String>(egui::Id::new("frame-export-folder"))).unwrap_or_else(|| {
+    let folder = ctx.data(|m| m.get_temp::<String>(egui::Id::unique("frame-export-folder"))).unwrap_or_else(|| {
         if cfg!(target_arch = "wasm32") {
             return "/exports".into();
         }
@@ -65,11 +65,11 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut elems = Vec::new();
     let mut popup_rects = Vec::new();
     let frame = egui::Frame::new().fill(app.tokens.panel_bg).inner_margin(0).corner_radius(6);
-    let position_id = egui::Id::new("frame-export-position");
+    let position_id = egui::Id::unique("frame-export-position");
     let position = ctx.data(|m| m.get_temp::<egui::Pos2>(position_id));
     let mut movement = egui::Vec2::ZERO;
     // Only the custom white header moves the window; form controls keep their own gestures.
-    let window_id = egui::Id::new("frame-export-window");
+    let window_id = egui::Id::unique("frame-export-window");
     let mut window = egui::Window::new("Export Frame")
         .id(window_id)
         .title_bar(false)
@@ -95,20 +95,20 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         );
         let x = egui::Rect::from_center_size(bar.right_center() - egui::vec2(16.0, 0.0), egui::vec2(24.0, 24.0));
         let header = egui::Rect::from_min_max(bar.min, egui::pos2(x.left(), bar.bottom()));
-        let drag = ui.interact(header, egui::Id::new("export-frame-header"), egui::Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
+        let drag = ui.interact(header, egui::Id::unique("export-frame-header"), egui::Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
         if drag.dragged() {
             movement = drag.drag_delta();
             ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
         }
         elems.push(("exportFrame.header".into(), header, "Move Export Frame".into()));
-        let response = ui.interact(x, egui::Id::new("export-frame-close"), egui::Sense::click()).on_hover_text("Close");
+        let response = ui.interact(x, egui::Id::unique("export-frame-close"), egui::Sense::click()).on_hover_text("Close");
         icons::paint(ui.painter(), x.shrink(7.0), Icon::Close, egui::Color32::from_gray(90));
         elems.push(("exportFrame.close".to_string(), x, "Close".to_string()));
         close = response.clicked();
         egui::Frame::NONE.inner_margin(14).show(ui, |ui| {
             egui::Grid::new("frame-export-settings").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
                 ui.label("Name:");
-                let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0)), "Name");
                 elems.push(("exportFrame.name".into(), r.rect, d.name.clone()));
                 ui.end_row();
                 ui.label("Format:");
@@ -144,7 +144,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 elems.push(("exportFrame.depth".into(), combo.response.rect, format!("{} Bit", d.depth)));
                 ui.end_row();
                 ui.label("Path:");
-                let r = ui.add(egui::TextEdit::singleline(&mut d.folder).desired_width(300.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.folder).desired_width(300.0)), "Path");
                 elems.push(("exportFrame.path".into(), r.rect, d.folder.clone()));
                 ui.end_row();
             });
@@ -255,7 +255,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
             match app.session.execute("file.exportFrame", params) {
                 Ok(result) => {
                     app.ui.status = format!("Exported frame to {}", result["path"].as_str().unwrap_or_default());
-                    ctx.data_mut(|m| m.insert_temp(egui::Id::new("frame-export-folder"), d.folder.clone()));
+                    ctx.data_mut(|m| m.insert_temp(egui::Id::unique("frame-export-folder"), d.folder.clone()));
                     close = true;
                 }
                 Err(e) => app.ui.status = e.to_string(),
diff --git a/crates/ui-egui/src/panels/graphics.rs b/crates/ui-egui/src/panels/graphics.rs
index 1b9e5438c..0c54f2231 100644
--- a/crates/ui-egui/src/panels/graphics.rs
+++ b/crates/ui-egui/src/panels/graphics.rs
@@ -10,7 +10,7 @@
 //!   field. Double-clicking a text layer with the Selection tool also edits it.
 //! - **Selection tool:** click selects a layer (bounding box with handles and anchor point); drag
 //!   moves it; drag the anchor point to move that alone. What a handle does depends on the layer
-//!   (see [`HandleDrag`]): point text scales about its anchor point, a paragraph-text box is
+//!   (see `HandleDrag`): point text scales about its anchor point, a paragraph-text box is
 //!   resized and its text re-wraps, a shape stretches away from its opposite side. A rectangle
 //!   also has four small circles just inside its corners: dragging one rounds all four corners.
 //! - **Rectangle / Ellipse tools:** drag out a shape. **Pen tool:** click points; click the first
@@ -22,7 +22,9 @@
 //! `program.textEdit`, `graphics.*` in the panels.
 
 use crate::widgets::CenteredDialog as _;
+use egui::ime_context::ImeTarget;
 use egui::{Align2, Color32, Pos2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use filmcraft_engine::Session;
 use filmcraft_geom::{Affine, Vec2};
 use filmcraft_project::graphic::{self, LayerContent, LayerSpec, eval_layer, layer_display_name, layer_indices};
 use filmcraft_project::{ClipId, EffectInstance, ItemKind, ParamValue, TrackItem};
@@ -34,6 +36,7 @@ use crate::FilmcraftApp;
 use crate::icons::{self, Icon};
 use crate::state::{GfxEdit, TextPropsDialog, Tool};
 use crate::theme::Tokens;
+use crate::widgets::HotNumberOptions;
 
 /// A graphic layer visible at the playhead, with its layer→screen transform.
 pub struct LayerView {
@@ -46,6 +49,92 @@ pub struct LayerView {
     pub local: [f32; 4],
 }
 
+/// The Program monitor editor drawn in one pass, remembered so the end-of-pass IME check can run
+/// after that pass's control requests have been drained. It holds only geometry, never a copy of
+/// the layer's text.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct DrawnImeEditor {
+    pub viewport: egui::ViewportId,
+    pub pass_nr: u64,
+    pub document_epoch: u64,
+    pub sequence: Option<u64>,
+    pub target: ImeTarget,
+    pub clip: u64,
+    pub layer: usize,
+    /// Identity of the layer drawn at that index; a reorder after the draw is detected here even
+    /// when the numeric index (and therefore a uid-less owner key) stayed the same.
+    pub fingerprint: u64,
+    /// Identity of the committed text drawn in this pass. A control request that changes the
+    /// text after the draw must not publish the old cursor geometry with the new text; the next
+    /// pass draws and publishes it. A caret/selection-only change keeps the text, so the IME
+    /// context stays.
+    pub text_stamp: u64,
+    /// Every layout-affecting layer property drawn in this pass, evaluated at the playhead. A
+    /// same-pass control request can change the font, style, alignment, spacing, box or transform
+    /// without changing the committed text or the layer identity; the cursor rectangle from the
+    /// old layout must then not be published with the new one.
+    pub layout_fingerprint: u64,
+}
+
+/// The most marked text drawn; an input method's composition is a few words.
+const MAX_PREEDIT_BYTES: usize = 1024;
+
+/// What [`draw_preedit`] drew, for automation: the plate with the marked text, and the active
+/// clause's rectangle and text.
+struct DrawnPreedit {
+    plate: Rect,
+    text: String,
+    clause: Option<(Rect, String)>,
+}
+
+/// Draw the marked text from the caret line `top`–`bottom` until it commits: on a dark plate,
+/// underlined, with a heavier underline under the clause being converted, or a caret where an
+/// empty active range puts it.
+fn draw_preedit(painter: &egui::Painter, top: Pos2, bottom: Pos2, preedit: craft_ui::ime::Preedit<'_>) -> DrawnPreedit {
+    let text = preedit.text.get(..char_boundary_floor(preedit.text, MAX_PREEDIT_BYTES)).unwrap_or_default();
+    let chars = text.chars().count();
+    let active = preedit.active.map(|r| {
+        let start = r.start.min(chars);
+        start..r.end.clamp(start, chars)
+    });
+    let height = (bottom - top).length();
+    let size = if height.is_finite() { (height * 0.8).clamp(8.0, 256.0) } else { 12.0 };
+    let galley = painter.layout_no_wrap(text.to_string(), egui::FontId::proportional(size), Color32::WHITE);
+    // centred on the caret line, where the committed text will be
+    let rise = bottom.y - top.y;
+    let at = top + vec2(0.0, if rise.is_finite() { (rise - galley.size().y) / 2.0 } else { 0.0 });
+    let plate = Rect::from_min_size(at, galley.size());
+    painter.rect_filled(plate.expand(2.0), 2.0, Color32::from_black_alpha(160));
+    let x = |i: usize| at.x + galley.pos_from_cursor(egui::text::CCursor::new(i)).min.x;
+    let y = plate.bottom();
+    painter.line_segment([pos2(plate.left(), y), pos2(plate.right(), y)], Stroke::new(1.0, Color32::WHITE));
+    let mut clause = None;
+    match active {
+        Some(r) if r.start < r.end => {
+            let (from, to) = (x(r.start), x(r.end));
+            painter.line_segment([pos2(from, y), pos2(to, y)], Stroke::new(3.0, Color32::WHITE));
+            clause = Some((Rect::from_min_max(pos2(from, plate.top()), pos2(to, y)), text.chars().skip(r.start).take(r.len()).collect()));
+        }
+        Some(r) => {
+            let caret = x(r.start);
+            painter.line_segment([pos2(caret, plate.top()), pos2(caret, y)], Stroke::new(1.5, Color32::WHITE));
+        }
+        None => {}
+    }
+    painter.galley(at, galley, Color32::WHITE);
+    DrawnPreedit { plate, text: text.to_string(), clause }
+}
+
+/// Identity of committed text alone (no caret or selection).
+fn ime_text_stamp(text: &str) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for &b in text.as_bytes() {
+        h ^= u64::from(b);
+        h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    h ^ (text.len() as u64).wrapping_mul(0x9e37_79b9_7f4a_7c15)
+}
+
 impl LayerView {
     pub fn quad(&self) -> [Pos2; 4] {
         let b = self.local;
@@ -163,7 +252,7 @@ fn next_boundary(s: &str, i: usize) -> usize {
 #[derive(Clone, Copy, Debug)]
 enum DragKind {
     Move,
-    /// Handle `n` of the layer's box (see [`handle_points`] and [`HandleDrag`]).
+    /// Handle `n` of the layer's box (see [`handle_points`] and `HandleDrag`).
     Handle(usize),
     /// The layer's anchor point: it moves, the layer stays where it is.
     Anchor,
@@ -503,12 +592,46 @@ fn new_text_action(app: &FilmcraftApp, pic: Rect, frame: (u32, u32), at: Pos2, c
     ("graphics.newText#edit".into(), prm)
 }
 
-const TEXT_EDIT_ID: &str = "gfx-text-edit";
+pub(crate) const TEXT_EDIT_ID: &str = "gfx-text-edit";
 
+/// End text editing: type the marked text still being composed, clear `gfx_edit`, invalidate any
+/// in-flight IME composition, surrender focus and forget the panel tag so a late commit cannot
+/// reach the next editor.
 fn end_edit(app: &mut FilmcraftApp, ui: &egui::Ui) {
+    commit_marked_text(app, ui.ctx());
     app.ui.gfx_edit = None;
-    ui.memory_mut(|m| m.surrender_focus(egui::Id::new(TEXT_EDIT_ID)));
-    ui.data_mut(|d| d.remove::<crate::dock::PanelKind>(egui::Id::new(TEXT_EDIT_ID).with("panel")));
+    // Any composition that was in flight belongs to the editor that just ended; a late commit
+    // must not be inserted into whatever is edited next.
+    app.invalidate_ime_composition();
+    ui.memory_mut(|m| m.surrender_focus(egui::Id::unique(TEXT_EDIT_ID)));
+    ui.data_mut(|d| d.remove::<crate::dock::PanelKind>(egui::Id::unique(TEXT_EDIT_ID).with("panel")));
+}
+
+/// End the composer's composition. Its marked text, when it is the edit's live composition, goes
+/// into the layer's text at the caret, over the selection, as one `graphics.setText`: Korean
+/// commits a syllable only when the next one starts, so the last one would be lost (#2445). The
+/// composer drops the input method's late commit of that text.
+fn commit_marked_text(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    let target = app.ui.gfx_edit.as_ref().and_then(|ed| current_graphics_ime_target(app, ed.clip, ed.layer));
+    let live = target.is_some_and(|target| composing_live(app, ctx, target));
+    let Some(marked) = app.ime_composer.end(ctx).filter(|_| live) else { return };
+    let Some(ed) = app.ui.gfx_edit.as_ref() else { return };
+    let Some(mut text) = current_layer_text(&app.session, ed.clip, ed.layer).map(str::to_string) else { return };
+    let marked: String = marked.chars().filter(|c| !c.is_control()).collect();
+    let (a, b) = (char_boundary_floor(&text, ed.caret.min(ed.anchor)), char_boundary_floor(&text, ed.caret.max(ed.anchor)));
+    text.replace_range(a..b, &marked);
+    let params = json!({"clip": ed.clip, "layer": ed.layer, "text": text, "merge": true});
+    if let Err(e) = app.session.execute("graphics.setText", params) {
+        app.ui.status = e.to_string();
+    }
+}
+
+/// Whether the composer's marked text is `target`'s composition in `ctx`'s viewport, not one a
+/// command, a control request or a caret move retired.
+fn composing_live(app: &FilmcraftApp, ctx: &egui::Context, target: ImeTarget) -> bool {
+    app.ime_composer_target == Some(target)
+        && app.ime_composition == Some(crate::ImeComposition::Active(target))
+        && app.ime_composition_viewport == Some(ctx.viewport_id())
 }
 
 /// A click on the Program monitor's empty space (the picture's, or around it): end the text edit
@@ -525,6 +648,9 @@ pub(crate) fn deselect_on_monitor(app: &mut FilmcraftApp, ui: &egui::Ui) {
 
 /// Draw the overlay and handle graphics tools on the Program monitor picture `pic`.
 pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, frame: (u32, u32)) {
+    // A project command may have reordered or deleted layers since the last pass. Follow the
+    // edited layer (or end the edit) before anything reads `gfx_edit`.
+    reconcile_gfx_edit(app);
     let t = app.tokens;
     let views = visible_layers(app, pic, frame);
     let tool = app.ui.tool;
@@ -588,7 +714,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
             }
         }
     }
-    let id = egui::Id::new("gfx-overlay");
+    let id = egui::Id::unique("gfx-overlay");
     let resp = ui.interact(pic, id, if graphics_tool { Sense::click_and_drag() } else { Sense::hover() });
     let hover = resp.hover_pos();
     let mut actions: Vec<(String, Value)> = Vec::new();
@@ -624,7 +750,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
     // ---- text editing
     if let Some(ed) = editing.clone() {
         match views.iter().find(|v| v.clip.0 == ed.clip && v.layer == ed.layer && v.is_text()) {
-            Some(v) => text_edit(app, ui, v, ed, &resp, &mut actions),
+            Some(v) => text_edit(app, ui, v, ed, &resp),
             None => end_edit(app, ui),
         }
     }
@@ -644,10 +770,14 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
             {
                 let l = text_layout(tp);
                 if let Some((x, y)) = v.to_local(p) {
+                    let previous_selection = (ed.caret, ed.anchor);
                     ed.caret = l.hit(x, y);
                     if !shift {
                         ed.anchor = ed.caret;
                     }
+                    if previous_selection != (ed.caret, ed.anchor) {
+                        app.invalidate_ime_composition();
+                    }
                     app.ui.gfx_edit = Some(ed);
                 }
                 drag = Some(DragState { kind: DragKind::TextSelect, clip: v.clip, layer: v.layer, start: p });
@@ -756,7 +886,11 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
                 {
                     let l = text_layout(tp);
                     if let Some((x, y)) = v.to_local(cur) {
+                        let previous_selection = (ed.caret, ed.anchor);
                         ed.caret = l.hit(x, y);
+                        if previous_selection != (ed.caret, ed.anchor) {
+                            app.invalidate_ime_composition();
+                        }
                         app.ui.gfx_edit = Some(ed);
                     }
                 }
@@ -831,7 +965,24 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
         let p = resp.interact_pointer_pos().unwrap_or(pic.center());
         let in_edit = edit_view.is_some_and(|v| v.hit(p));
         match tool {
-            _ if in_edit => {}
+            // a click in the text being edited puts the caret there (Shift extends the selection),
+            // as a press that becomes a drag already does (#2430)
+            _ if in_edit => {
+                if let (Some(v), Some(mut ed)) = (edit_view, editing.clone())
+                    && let Some(tp) = text_of(&v.spec)
+                    && let Some((x, y)) = v.to_local(p)
+                {
+                    let previous_selection = (ed.caret, ed.anchor);
+                    ed.caret = text_layout(tp).hit(x, y);
+                    if !ui.input(|i| i.modifiers.shift) {
+                        ed.anchor = ed.caret;
+                    }
+                    if previous_selection != (ed.caret, ed.anchor) {
+                        app.invalidate_ime_composition();
+                    }
+                    app.ui.gfx_edit = Some(ed);
+                }
+            }
             Tool::Type | Tool::VerticalType => {
                 if let Some(v) = views.iter().find(|v| v.is_text() && v.hit(p)) {
                     start_edit_at(app, ui, v, p, &mut actions);
@@ -898,34 +1049,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
     } else if tool != Tool::Pen && !app.ui.pen_points.is_empty() {
         app.ui.pen_points.clear();
     }
-    // ---- caret / selection drawing
-    if let Some(ed) = app.ui.gfx_edit.clone()
-        && let Some(v) = views.iter().find(|v| v.clip.0 == ed.clip && v.layer == ed.layer)
-        && let Some(tp) = text_of(&v.spec)
-    {
-        let l = text_layout(tp);
-        let caret = ed.caret.min(tp.text.len());
-        for r in l.selection_rects(ed.anchor.min(tp.text.len()), caret) {
-            let q = [(r[0], r[1]), (r[2], r[1]), (r[2], r[3]), (r[0], r[3])].map(|(x, y)| sp(&v.to_screen, x, y));
-            painter.add(egui::Shape::convex_polygon(q.to_vec(), Color32::from_rgba_unmultiplied(80, 140, 255, 90), Stroke::NONE));
-        }
-        let (x, base, li) = l.caret(caret);
-        let line = &l.lines[li.min(l.lines.len() - 1)];
-        let (a, b) = (sp(&v.to_screen, x, base - line.ascent), sp(&v.to_screen, x, base + line.descent));
-        painter.line_segment([a, b], Stroke::new(1.5, Color32::WHITE));
-        painter.line_segment([a + vec2(1.0, 0.0), b + vec2(1.0, 0.0)], Stroke::new(0.5, Color32::BLACK));
-        let er = Rect::from_points(&v.quad()).union(Rect::from_two_pos(a, b));
-        app.auto.add("program.textEdit", er, &tp.text);
-        ui.ctx().output_mut(|o| {
-            o.ime = Some(egui::output::IMEOutput {
-                purpose: Default::default(),
-                rect: er,
-                cursor_rect: Rect::from_two_pos(a, b),
-                should_interrupt_composition: false,
-            })
-        });
-    }
-    // ---- run
+    // ---- run accepted actions before drawing the caret
     for (cmd, p) in actions {
         let (cmd, then_edit) = match cmd.strip_suffix("#edit") {
             Some(c) => (c.to_string(), true),
@@ -934,13 +1058,153 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
         match app.session.execute(&cmd, p) {
             Ok(r) => {
                 if then_edit && let (Some(c), Some(l)) = (r["clip"].as_u64(), r["layer"].as_u64()) {
-                    app.ui.gfx_edit = Some(GfxEdit { clip: c, layer: l as usize, caret: 0, anchor: 0 });
+                    app.restart_ime_target();
+                    let uid = current_layer_uid(&app.session, c, l as usize).unwrap_or(0);
+                    app.ui.gfx_edit = Some(GfxEdit { clip: c, layer: l as usize, caret: 0, anchor: 0, uid, fingerprint: 0 });
                     app.ui.focused = crate::dock::PanelKind::Program;
                 }
             }
             Err(e) => app.ui.status = e.to_string(),
         }
     }
+    // The model may have changed above; draw the post-action caret and committed text.
+    let views = visible_layers(app, pic, frame);
+    if let Some(ed) = app.ui.gfx_edit.clone()
+        && let Some(v) = views.iter().find(|v| v.clip.0 == ed.clip && v.layer == ed.layer)
+        && let Some(tp) = text_of(&v.spec)
+    {
+        let l = text_layout(tp);
+        let caret = char_boundary_floor(&tp.text, ed.caret);
+        let anchor = char_boundary_floor(&tp.text, ed.anchor);
+        for r in l.selection_rects(anchor, caret) {
+            let q = [(r[0], r[1]), (r[2], r[1]), (r[2], r[3]), (r[0], r[3])].map(|(x, y)| sp(&v.to_screen, x, y));
+            painter.add(egui::Shape::convex_polygon(q.to_vec(), Color32::from_rgba_unmultiplied(80, 140, 255, 90), Stroke::NONE));
+        }
+        let (x, base, li) = l.caret(caret);
+        let (ascent, descent) = l.lines.get(li.min(l.lines.len().saturating_sub(1))).map_or((0.0, 0.0), |line| (line.ascent, line.descent));
+        let (a, b) = (sp(&v.to_screen, x, base - ascent), sp(&v.to_screen, x, base + descent));
+        let cursor_rect = Rect::from_two_pos(a, b);
+        let sequence = app.session.state.active_sequence.map_or(0, |sequence| sequence.0);
+        let target = graphics_ime_target(sequence, v.clip.0, v.layer, v.spec.uid, app.ime_replacement_epoch);
+        let live = composing_live(app, ui.ctx(), target);
+        match app.ime_composer.preedit().filter(|_| live).map(|preedit| draw_preedit(&painter, a, b, preedit)) {
+            Some(drawn) => {
+                app.auto.add("program.textEdit.preedit", drawn.plate, &drawn.text);
+                if let Some((rect, clause)) = drawn.clause {
+                    app.auto.add("program.textEdit.preedit.clause", rect, &clause);
+                }
+            }
+            None => {
+                painter.line_segment([a, b], Stroke::new(1.5, Color32::WHITE));
+                painter.line_segment([a + vec2(1.0, 0.0), b + vec2(1.0, 0.0)], Stroke::new(0.5, Color32::BLACK));
+            }
+        }
+        let er = Rect::from_points(&v.quad()).union(cursor_rect);
+        app.auto.add("program.textEdit", er, &tp.text);
+        // `drain_ui_requests` later in this pass may run a command or replace `gfxEdit`:
+        // `finish_graphics_ime` checks the post-drain state against this one.
+        note_graphics_ime_editor(app, ui, v, cursor_rect);
+    }
+}
+
+/// Remember the focused Program monitor editor drawn in this pass, for [`finish_graphics_ime`]
+/// after the pass's control requests have run, and put the candidate window at its caret.
+pub(crate) fn note_graphics_ime_editor(app: &mut FilmcraftApp, ui: &egui::Ui, v: &LayerView, cursor_rect: Rect) {
+    let ctx = ui.ctx();
+    app.ime_composer.set_caret(ctx, cursor_rect);
+    let viewport = ctx.viewport_id();
+    let pass_nr = ctx.cumulative_pass_nr_for(viewport);
+    let sequence = app.session.state.active_sequence.map(|sequence| sequence.0);
+    let target = graphics_ime_target(sequence.unwrap_or(0), v.clip.0, v.layer, v.spec.uid, app.ime_replacement_epoch);
+    let fingerprint = current_layer_fingerprint(&app.session, v.clip.0, v.layer).unwrap_or(0);
+    let layout_fingerprint = current_layer_layout_fingerprint(&app.session, v.clip.0, v.layer).unwrap_or(0);
+    let text_stamp = text_of(&v.spec).map_or(0, |tp| ime_text_stamp(&tp.text));
+    app.ime_drawn_editor = Some(DrawnImeEditor {
+        viewport,
+        pass_nr,
+        document_epoch: app.session.document_epoch,
+        sequence,
+        target,
+        clip: v.clip.0,
+        layer: v.layer,
+        fingerprint,
+        text_stamp,
+        layout_fingerprint,
+    });
+}
+
+/// The end-of-pass check of the editor drawn in `ctx`'s viewport, after the pass's commands
+/// ran. Returns whether the editor drawn there in this pass keeps the composer's descriptor.
+/// Otherwise the composer turns the IME off: when the editor was drawn there, or, with `last`
+/// (the main window's pass, which ends after every native window's), when it was drawn nowhere.
+///
+/// The composer's descriptor goes only with the editor's current target: a document, sequence,
+/// target, text or layout replaced since the overlay drew turns it off for this pass instead of
+/// pairing the old caret with the new model.
+pub(crate) fn finish_graphics_ime(app: &mut FilmcraftApp, ctx: &egui::Context, last: bool) -> bool {
+    let viewport = ctx.viewport_id();
+    let drawn = match app.ime_drawn_editor {
+        Some(drawn) if drawn.viewport != viewport => return false,
+        None if !last => return false,
+        drawn => drawn.filter(|drawn| drawn.pass_nr == ctx.cumulative_pass_nr_for(viewport)),
+    };
+    let eligible = drawn.is_some_and(|drawn| graphics_ime_eligible(app, ctx, &drawn));
+    if !eligible {
+        // The editor is gone or replaced: the marked text goes with it.
+        let _ = app.ime_composer.update(ctx, false);
+        return false;
+    }
+    app.note_ime_viewport(viewport);
+    // In the main window the composer wrote its descriptor itself; a native window's goes out
+    // after its last body.
+    let owner = app.ime_composer_target.map(|target| target.owner);
+    if let Some(output) = ctx.output(|o| o.ime.as_ref().filter(|ime| Some(ime.owner) == owner).map(crate::ime_reset::OutputContext::of)) {
+        app.ime_reset.produced(output);
+    }
+    true
+}
+
+/// Whether the editor drawn in this pass is still the one being edited, unchanged since it drew.
+fn graphics_ime_eligible(app: &mut FilmcraftApp, ctx: &egui::Context, drawn: &DrawnImeEditor) -> bool {
+    // A picker or in-app modal opened after the overlay drew owns input for the rest of this
+    // pass, so this editor cannot attach an already queued reset under the modal. Core may still
+    // carry that un-taken request to a later stock descriptor (the accepted attachment
+    // limitation); the next eligible pass rearms this guard explicitly.
+    if app.ime_modal_blocks_input() {
+        return false;
+    }
+    if drawn.document_epoch != app.session.document_epoch || drawn.sequence != app.session.state.active_sequence.map(|sequence| sequence.0) {
+        return false;
+    }
+    if ctx.memory(|m| m.focused() != Some(egui::Id::unique(TEXT_EDIT_ID))) {
+        return false;
+    }
+    let Some(ed) = app.ui.gfx_edit.clone() else { return false };
+    if ed.clip != drawn.clip || ed.layer != drawn.layer {
+        return false;
+    }
+    let (Some(sequence), Some(uid)) = (app.session.state.active_sequence, current_layer_uid(&app.session, ed.clip, ed.layer)) else {
+        return false;
+    };
+    let target = graphics_ime_target(sequence.0, ed.clip, ed.layer, uid, app.ime_replacement_epoch);
+    if target != drawn.target || current_layer_fingerprint(&app.session, ed.clip, ed.layer).is_none_or(|fingerprint| fingerprint != drawn.fingerprint) {
+        // A control request replaced the edit target, reordered the layers, or changed the
+        // document after the overlay drew.
+        return false;
+    }
+    let Some(text) = current_layer_text(&app.session, ed.clip, ed.layer) else { return false };
+    if ime_text_stamp(text) != drawn.text_stamp {
+        // A same-pass control request changed the text after the overlay drew. The caret
+        // belongs to the old text, and so does the composition: its next delete, preedit or
+        // commit must not be inserted into the new text.
+        app.invalidate_ime_composition();
+        return false;
+    }
+    // A same-pass control request that changed a layout-affecting property (font, style,
+    // alignment, spacing, box, transform, per-character style or pin) moved the caret: the next
+    // pass draws and publishes the new one. A caret or selection move alone keeps the
+    // descriptor, with a caret one pass old.
+    current_layer_layout_fingerprint(&app.session, ed.clip, ed.layer).is_some_and(|fingerprint| fingerprint == drawn.layout_fingerprint)
 }
 
 fn layer_display_name_view(app: &FilmcraftApp, v: &LayerView) -> String {
@@ -970,13 +1234,16 @@ fn finish_pen(app: &mut FilmcraftApp, pic: Rect, frame: (u32, u32), actions: &mu
     actions.push(("graphics.newShape".into(), p));
 }
 
+/// Start editing a text layer at screen point `p` (caret at the text hit, else the end), restart the IME target, record clip/layer/uid and select the layer.
 fn start_edit_at(app: &mut FilmcraftApp, ui: &egui::Ui, v: &LayerView, p: Pos2, actions: &mut Vec<(String, Value)>) {
     let Some(tp) = text_of(&v.spec) else { return };
     let l = text_layout(tp);
     let caret = v.to_local(p).map_or(tp.text.len(), |(x, y)| l.hit(x, y));
-    app.ui.gfx_edit = Some(GfxEdit { clip: v.clip.0, layer: v.layer, caret, anchor: caret });
+    // the marked text still being composed goes into the layer it was typed into
+    commit_marked_text(app, ui.ctx());
+    app.restart_ime_target();
+    app.ui.gfx_edit = Some(GfxEdit { clip: v.clip.0, layer: v.layer, caret, anchor: caret, uid: v.spec.uid, fingerprint: 0 });
     app.ui.focused = crate::dock::PanelKind::Program;
-    let _ = ui;
     actions.push(("graphics.selectLayer".into(), json!({"clip": v.clip.0, "layers": [v.layer]})));
 }
 
@@ -991,168 +1258,1023 @@ pub(crate) fn select_all_edited_text(app: &mut FilmcraftApp) -> bool {
     let Some(effect) = layer_indices(&it.effects).get(layer).and_then(|&i| it.effects.get(i)) else { return false };
     let Some(len) = eval_layer(effect, it.source_time_at(t), (*width, *height)).as_ref().and_then(text_of).map(|tp| tp.text.len()) else { return false };
     let Some(ed) = app.ui.gfx_edit.as_mut() else { return false };
+    let moved = (ed.anchor, ed.caret) != (0, len);
     (ed.anchor, ed.caret) = (0, len);
+    if moved {
+        app.invalidate_ime_composition();
+    }
     true
 }
 
+/// The effect instance of layer `layer` of `clip` when it is enabled and on screen.
+///
+/// This is the read-only path for the IME producer: it never evaluates a `LayerSpec` (which
+/// clones the layer's full text) just to read an identity or a committed-text window.
+fn current_layer_effect(session: &Session, clip: u64, layer: usize) -> Option<&EffectInstance> {
+    let seq = session.active_sequence()?;
+    let (_, it) = seq.find_item(ClipId(clip))?;
+    if !it.enabled {
+        return None;
+    }
+    let &effect_index = layer_indices(&it.effects).get(layer)?;
+    let effect = it.effects.get(effect_index)?;
+    effect.enabled.then_some(effect)
+}
+
+/// Borrowed committed text of the edited layer at the playhead (no `TextProps`/full-text copy).
+fn current_layer_text(session: &Session, clip: u64, layer: usize) -> Option<&str> {
+    let seq = session.active_sequence()?;
+    let t = session.playhead();
+    let (_, it) = seq.find_item(ClipId(clip))?;
+    if !it.enabled {
+        return None;
+    }
+    let &effect_index = layer_indices(&it.effects).get(layer)?;
+    let effect = it.effects.get(effect_index)?;
+    if !effect.enabled || effect.effect != graphic::TEXT_LAYER {
+        return None;
+    }
+    effect.params.get("text")?.text_ref_at(it.source_time_at(t))
+}
+
+/// Stable uid of the enabled layer at index `layer`, or 0 when that layer has no uid; `None`
+/// when the clip, item or layer is missing or disabled.
+fn current_layer_uid(session: &Session, clip: u64, layer: usize) -> Option<u64> {
+    current_layer_effect(session, clip, layer).map(|effect| effect.layer.as_ref().map_or(0, |x| x.uid))
+}
+
+/// A compact identity for a layer that survives reorder/delete/undo when the layer has no uid.
+///
+/// It uses static parameter values only, so a keyframed or animating position at the playhead
+/// does not make the target look new, and it deliberately excludes the editable text, so typing
+/// does not either.
+fn layer_fingerprint(effect: &EffectInstance) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    let mut hash = |bytes: &[u8]| {
+        for &b in bytes {
+            h ^= u64::from(b);
+            h = h.wrapping_mul(0x0000_0100_0000_01b3);
+        }
+    };
+    hash(effect.effect.as_bytes());
+    hash(&[u8::from(effect.enabled)]);
+    hash(&effect.layer.as_ref().map_or(0, |x| x.uid).to_le_bytes());
+    if let Some(name) = effect.params.get("name").and_then(|p| match &p.value {
+        ParamValue::Text(s) => Some(s.as_str()),
+        _ => None,
+    }) {
+        hash(name.as_bytes());
+    }
+    for id in ["position", "size", "box_width", "box_height", "shape", "sides", "corner_radius", "vertical"] {
+        let Some(value) = effect.params.get(id).map(|p| &p.value) else { continue };
+        match value {
+            ParamValue::Float(v) => hash(&v.to_bits().to_le_bytes()),
+            ParamValue::Vec2(v) => {
+                hash(&v.x.to_bits().to_le_bytes());
+                hash(&v.y.to_bits().to_le_bytes());
+            }
+            ParamValue::Choice(v) => hash(&u64::from(*v).to_le_bytes()),
+            ParamValue::Bool(v) => hash(&[u8::from(*v)]),
+            ParamValue::Text(s) => hash(s.as_bytes()),
+            _ => {}
+        }
+    }
+    h
+}
+
+/// Static-identity fingerprint of the enabled layer at `layer`, or `None` when it is not
+/// present. Editable text is excluded by [`layer_fingerprint`], so typing does not change it.
+fn current_layer_fingerprint(session: &Session, clip: u64, layer: usize) -> Option<u64> {
+    current_layer_effect(session, clip, layer).map(layer_fingerprint)
+}
+
+/// Stable uid and identity fingerprint of the layer currently at `layer`.
+///
+/// A control request that explicitly names a clip and numeric layer means that index now, not
+/// whichever layer an older edit session happened to own at that index.
+pub(crate) fn current_layer_identity(session: &Session, clip: u64, layer: usize) -> Option<(u64, u64)> {
+    current_layer_effect(session, clip, layer).map(|effect| (effect.layer.as_ref().map_or(0, |extra| extra.uid), layer_fingerprint(effect)))
+}
+
+/// Properties that change a text or shape layer's layout, and therefore the caret and candidate
+/// rectangle, without necessarily changing its committed text or stable identity. Both static
+/// values and keyframes at the playhead are included.
+const LAYOUT_PARAMS: &[&str] = &[
+    // Text layout.
+    "font",
+    "font_style",
+    "size",
+    "align",
+    "tracking",
+    "kerning",
+    "ligatures",
+    "leading",
+    "baseline_shift",
+    "faux_bold",
+    "faux_italic",
+    "caps",
+    "underline",
+    "box_width",
+    "box_height",
+    "vertical",
+    // Shape geometry.
+    "shape",
+    "sides",
+    "corner_radius",
+    "points",
+    // Transform.
+    "position",
+    "anchor",
+    "scale",
+    "scale_width",
+    "uniform_scale",
+    "rotation",
+];
+
+/// Fold `bytes` into the FNV-1a-style hash accumulator `h`, allowing callers to chain fields.
+fn hash_bytes(h: &mut u64, bytes: &[u8]) {
+    for &b in bytes {
+        *h ^= u64::from(b);
+        *h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+}
+
+/// Hash the bits of a finite `f64`; all non-finite values share one representation so NaN
+/// payloads or evaluation details cannot change a layout identity.
+fn hash_f64(h: &mut u64, v: f64) {
+    // Normalise non-finite values: NaN is "auto" for point parameters and must not make the
+    // fingerprint depend on payload bits or an evaluation detail.
+    if v.is_finite() {
+        hash_bytes(h, &v.to_bits().to_le_bytes());
+    } else {
+        hash_bytes(h, b"non-finite");
+    }
+}
+
+/// Hash an `f32` widened to `f64`, keeping the non-finite normalization of [`hash_f64`].
+fn hash_f32(h: &mut u64, v: f32) {
+    hash_f64(h, f64::from(v));
+}
+
+/// Hash an optional value with an explicit presence byte, followed by the inner value only
+/// when it is present. This keeps `None` distinct from any hashed `Some` payload.
+fn hash_option<T>(h: &mut u64, value: Option<T>, hash: impl FnOnce(&mut u64, T)) {
+    match value {
+        Some(v) => {
+            hash_bytes(h, &[1]);
+            hash(h, v);
+        }
+        None => hash_bytes(h, &[0]),
+    }
+}
+
+/// Hash a layout parameter by kind and value. Non-finite floats normalize through
+/// [`hash_f64`]; path payloads contribute only a tag because layout parameters do not use
+/// mask paths.
+fn hash_param_value(h: &mut u64, value: &ParamValue) {
+    match value {
+        ParamValue::Float(v) => {
+            hash_bytes(h, b"f");
+            hash_f64(h, *v);
+        }
+        ParamValue::Vec2(v) => {
+            hash_bytes(h, b"v");
+            hash_f64(h, v.x);
+            hash_f64(h, v.y);
+        }
+        ParamValue::Color(c) => {
+            hash_bytes(h, b"c");
+            for v in c {
+                hash_f32(h, *v);
+            }
+        }
+        ParamValue::Bool(v) => {
+            hash_bytes(h, b"b");
+            hash_bytes(h, &[u8::from(*v)]);
+        }
+        ParamValue::Choice(v) => {
+            hash_bytes(h, b"o");
+            hash_bytes(h, &u64::from(*v).to_le_bytes());
+        }
+        ParamValue::Text(v) => {
+            hash_bytes(h, b"t");
+            hash_bytes(h, v.as_bytes());
+        }
+        ParamValue::Curve(points) => {
+            hash_bytes(h, b"u");
+            hash_bytes(h, &(points.len() as u64).to_le_bytes());
+            for p in points {
+                hash_f32(h, p[0]);
+                hash_f32(h, p[1]);
+            }
+        }
+        // Mask paths are not used by layer layout parameters.
+        ParamValue::Path(_) => hash_bytes(h, b"p"),
+    }
+}
+
+/// Fingerprint every layout-affecting value of `effect` at tick `t`: the layout parameters
+/// evaluated at the playhead, character runs and pin data. Non-finite floats normalize, and
+/// the committed text bytes are not hashed directly, so caret/selection changes do not churn
+/// the fingerprint; a value or run change that can move the caret does.
+fn layout_fingerprint(effect: &EffectInstance, t: Tick) -> u64 {
+    let mut h: u64 = 0x9e37_79b9_7f4a_7c15;
+    hash_bytes(&mut h, effect.effect.as_bytes());
+    hash_bytes(&mut h, &[u8::from(effect.enabled)]);
+    for id in LAYOUT_PARAMS {
+        let Some(param) = effect.params.get(*id) else { continue };
+        hash_bytes(&mut h, id.as_bytes());
+        hash_param_value(&mut h, &param.value_at(t));
+    }
+    if let Some(extra) = &effect.layer {
+        hash_bytes(&mut h, b"runs");
+        hash_bytes(&mut h, &(extra.runs.len() as u64).to_le_bytes());
+        for run in &extra.runs {
+            hash_bytes(&mut h, &(run.start as u64).to_le_bytes());
+            hash_bytes(&mut h, &(run.end as u64).to_le_bytes());
+            hash_option(&mut h, run.style.font.as_ref(), |h, v| hash_bytes(h, v.as_bytes()));
+            hash_option(&mut h, run.style.font_style.as_ref(), |h, v| hash_bytes(h, v.as_bytes()));
+            hash_option(&mut h, run.style.size, hash_f32);
+            hash_option(&mut h, run.style.fill, |h, v| {
+                for c in v {
+                    hash_f32(h, c);
+                }
+            });
+            hash_option(&mut h, run.style.faux_bold, |h, v| hash_bytes(h, &[u8::from(v)]));
+            hash_option(&mut h, run.style.faux_italic, |h, v| hash_bytes(h, &[u8::from(v)]));
+            hash_option(&mut h, run.style.underline, |h, v| hash_bytes(h, &[u8::from(v)]));
+            hash_option(&mut h, run.style.tracking, hash_f32);
+            hash_option(&mut h, run.style.baseline_shift, hash_f32);
+            hash_option(&mut h, run.style.caps, |h, v| hash_bytes(h, &u64::from(v).to_le_bytes()));
+        }
+        hash_bytes(&mut h, b"pin");
+        match &extra.pin {
+            Some(pin) => {
+                hash_bytes(&mut h, &[1]);
+                match pin.to {
+                    filmcraft_project::graphic_design::PinTarget::Frame => hash_bytes(&mut h, b"frame"),
+                    filmcraft_project::graphic_design::PinTarget::Layer(uid) => {
+                        hash_bytes(&mut h, b"layer");
+                        hash_bytes(&mut h, &uid.to_le_bytes());
+                    }
+                }
+                hash_bytes(&mut h, &[u8::from(pin.left), u8::from(pin.top), u8::from(pin.right), u8::from(pin.bottom)]);
+                for offset in pin.offsets {
+                    hash_f64(&mut h, offset);
+                }
+            }
+            None => hash_bytes(&mut h, &[0]),
+        }
+    }
+    h
+}
+
+/// Layout fingerprint of the layer at `layer` evaluated at the playhead's source time;
+/// `None` when the sequence, clip or layer is missing.
+fn current_layer_layout_fingerprint(session: &Session, clip: u64, layer: usize) -> Option<u64> {
+    let sequence = session.active_sequence()?;
+    let t = session.playhead();
+    let (_, item) = sequence.find_item(ClipId(clip))?;
+    let &effect_index = layer_indices(&item.effects).get(layer)?;
+    let effect = item.effects.get(effect_index)?;
+    Some(layout_fingerprint(effect, item.source_time_at(t)))
+}
+
+/// Follow the edited layer through a real project edit (reorder, delete, undo/redo).
+///
+/// A stable uid wins. For a uid-less layer the compact fingerprint finds the same layer at its
+/// new index; with no candidate the layer was deleted (or replaced), so the edit is ended rather
+/// than silently retargeted to whatever now occupies the old index.
+fn resolve_gfx_edit(session: &Session, ed: &GfxEdit) -> Option<(usize, u64, u64)> {
+    let seq = session.active_sequence()?;
+    let (_, it) = seq.find_item(ClipId(ed.clip))?;
+    let indices = layer_indices(&it.effects);
+    let resolved = if ed.uid != 0 {
+        indices.iter().position(|&ei| it.effects.get(ei).and_then(|e| e.layer.as_ref()).is_some_and(|x| x.uid == ed.uid))
+    } else {
+        let at = |i: usize| it.effects.get(indices[i]).map(layer_fingerprint);
+        let mut found = indices.get(ed.layer).and_then(|_| at(ed.layer)).filter(|fp| ed.fingerprint == 0 || *fp == ed.fingerprint).map(|_| ed.layer);
+        if found.is_none() && ed.fingerprint != 0 {
+            let mut best: Option<(usize, usize)> = None;
+            for i in 0..indices.len() {
+                if at(i) == Some(ed.fingerprint) {
+                    let distance = i.abs_diff(ed.layer);
+                    if best.is_none_or(|(d, _)| distance < d) {
+                        best = Some((distance, i));
+                    }
+                }
+            }
+            found = best.map(|(_, i)| i);
+        }
+        found
+    }?;
+    let effect = it.effects.get(*indices.get(resolved)?)?;
+    let uid = effect.layer.as_ref().map_or(0, |x| x.uid);
+    Some((resolved, uid, layer_fingerprint(effect)))
+}
+
+/// Keep `gfx_edit` on the layer it started on. Called before the overlay draws, so a command run
+/// between two passes (arrange/delete/undo or a control edit) cannot shift the caret into another
+/// layer.
+fn reconcile_gfx_edit(app: &mut FilmcraftApp) {
+    let Some(ed) = app.ui.gfx_edit.clone() else { return };
+    match resolve_gfx_edit(&app.session, &ed) {
+        Some((layer, uid, fingerprint)) => {
+            // A uid-less owner key includes the index, so an index change is a new context. A
+            // stable uid layer keeps the same owner and its composition may continue.
+            if layer != ed.layer && ed.uid == 0 {
+                app.invalidate_ime_composition();
+            }
+            app.ui.gfx_edit = Some(GfxEdit { layer, uid, fingerprint, ..ed });
+        }
+        None => {
+            app.ui.gfx_edit = None;
+            app.invalidate_ime_composition();
+        }
+    }
+}
+
+/// Owner for the graphics text editor: sequence, clip and stable layer uid, falling back to
+/// the numeric layer index only when `uid` is 0. The replacement epoch is explicit. Caret,
+/// selection, text, revision, geometry, visual order and pointers are excluded so those
+/// changes do not churn the IME owner.
+fn graphics_ime_target(sequence: u64, clip: u64, layer: usize, uid: u64, replacement_epoch: u64) -> ImeTarget {
+    // The owner excludes caret, selection, text, revision, geometry, visual order and pointers.
+    // `uid` is the stable layer component id; zero means "none", where the layer index is the
+    // only component identity available.
+    let component_uid = (uid != 0).then_some(uid);
+    let component_index = (uid == 0).then_some(layer as u64);
+    ImeTarget::new(egui::Id::unique(("filmcraft.graphics.ime", sequence, clip, component_uid, component_index)), replacement_epoch)
+}
+
+/// Current editor owner for the layer, using its live uid and the app's replacement epoch;
+/// `None` when there is no active sequence or the layer is unavailable.
+fn current_graphics_ime_target(app: &FilmcraftApp, clip: u64, layer: usize) -> Option<ImeTarget> {
+    let sequence = app.session.state.active_sequence?.0;
+    let uid = current_layer_uid(&app.session, clip, layer)?;
+    Some(graphics_ime_target(sequence, clip, layer, uid, app.ime_replacement_epoch))
+}
+
+/// Outside the keyboard reducer the actual engine/UI edit state is authoritative.
+pub(crate) fn current_reset_destination(app: &FilmcraftApp) -> Option<crate::ime_reset::Destination> {
+    let ed = app.ui.gfx_edit.as_ref()?;
+    let target = current_graphics_ime_target(app, ed.clip, ed.layer)?;
+    let text = current_layer_text(&app.session, ed.clip, ed.layer)?;
+    Some(local_reset_destination(app, ed, text, target))
+}
+
+/// Build the admission destination from the local edit and current document epoch, stamping
+/// the committed `text` while carrying the caret and anchor separately.
+fn local_reset_destination(app: &FilmcraftApp, ed: &GfxEdit, text: &str, target: ImeTarget) -> crate::ime_reset::Destination {
+    crate::ime_reset::Destination { document: app.session.document_epoch, target, caret: ed.caret, anchor: ed.anchor, text: ime_text_stamp(text) }
+}
+
+/// Is this IME commit/delete left over from a composition whose target or caret/focus was
+/// interrupted? A terminal-pending composition still owns its pending commit/delete after an empty
+/// preedit. `None` (no preedit was seen) still accepts a direct commit.
+fn ime_event_is_stale(app: &FilmcraftApp, target: ImeTarget) -> bool {
+    match app.ime_composition {
+        Some(crate::ImeComposition::Stale) => true,
+        Some(crate::ImeComposition::Active(active) | crate::ImeComposition::TerminalPending(active)) => active != target,
+        None => false,
+    }
+}
+
+/// Whether an event was fully handled or must skip the per-event IME destination update, which
+/// mirrors the original loop's `continue` paths.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum EventFlow {
+    Applied,
+    Skip,
+}
+
+/// Mutable state for one batch of text-editor events: the committed text and caret/selection.
+struct TextEditState {
+    ed: GfxEdit,
+    text: String,
+    changed: bool,
+    stop: bool,
+    custom_mutations: bool,
+}
+
+impl TextEditState {
+    /// The caret/anchor pair sorted into a forward `(start, end)` selection range.
+    fn selection(&self) -> (usize, usize) {
+        (self.ed.caret.min(self.ed.anchor), self.ed.caret.max(self.ed.anchor))
+    }
+
+    /// Delete the sorted selection in place, collapse caret and anchor to its start and report
+    /// whether anything was removed. This does not set the batch's changed flags; callers do.
+    fn delete_selection(&mut self) -> bool {
+        let (a, b) = self.selection();
+        if a == b {
+            return false;
+        }
+        self.text.replace_range(a..b, "");
+        self.ed.caret = a;
+        self.ed.anchor = a;
+        true
+    }
+}
+
+/// The per-event prologue: sync the live destination, consume IME-reset completions, and reject
+/// events while a reset blocks IME input. `None` is the original loop's `continue`.
+fn begin_text_event(app: &mut FilmcraftApp, ui: &egui::Ui, state: &TextEditState, target: ImeTarget, event: &egui::Event) -> Option<(bool, bool)> {
+    let destination = local_reset_destination(app, &state.ed, &state.text, target);
+    if state.custom_mutations {
+        app.sync_live_ime_destination(ui.ctx(), destination);
+    }
+    if let egui::Event::ImeResetCompleted { request_id } = event {
+        if state.custom_mutations && app.ime_reset.complete(ui.ctx(), *request_id, destination) && app.ime_composition_viewport == Some(ui.ctx().viewport_id())
+        {
+            app.ime_composition = None;
+            app.ime_composition_viewport = None;
+        }
+        return None;
+    }
+    if !state.custom_mutations || (app.ime_reset.blocked(ui.ctx().viewport_id()) && matches!(event, egui::Event::Ime(_))) {
+        return None;
+    }
+    let from_ime = matches!(event, egui::Event::Ime(_));
+    let terminal = matches!(event, egui::Event::Ime(egui::ImeEvent::Commit(_)));
+    Some((from_ime, terminal))
+}
+
+/// The per-step epilogue: remember or terminal-acknowledge an IME step's destination, or keep
+/// the live destination in sync for ordinary application edits.
+fn finish_text_event(app: &mut FilmcraftApp, ui: &egui::Ui, state: &TextEditState, target: ImeTarget, from_ime: bool, terminal: bool) {
+    let current = local_reset_destination(app, &state.ed, &state.text, target);
+    if from_ime {
+        if terminal {
+            app.ime_reset.terminal(ui.ctx().viewport_id());
+        } else {
+            app.ime_reset.remember(ui.ctx().viewport_id(), current);
+        }
+    } else if state.custom_mutations {
+        app.sync_live_ime_destination(ui.ctx(), current);
+    }
+}
+
+/// Track this viewport's IME preedit target. Empty preedit becomes `TerminalPending` so a
+/// following empty commit still belongs to the same composition; non-empty becomes `Active`.
+fn apply_preedit(app: &mut FilmcraftApp, viewport: egui::ViewportId, target: ImeTarget, text: &str) {
+    app.ime_composition_viewport = Some(viewport);
+    if text.is_empty() {
+        app.ime_composition = Some(crate::ImeComposition::TerminalPending(target));
+    } else {
+        app.ime_composition = Some(crate::ImeComposition::Active(target));
+    }
+}
+
+/// Apply a UTF-8 byte-count surrounding deletion after the staleness check. Only whole
+/// characters fully inside the reported byte ranges are removed, the selection is preserved
+/// and a stale event skips.
+fn apply_delete_surrounding_bytes(app: &FilmcraftApp, state: &mut TextEditState, target: ImeTarget, before_bytes: usize, after_bytes: usize) -> EventFlow {
+    if ime_event_is_stale(app, target) {
+        return EventFlow::Skip;
+    }
+    let (a, b) = state.selection();
+    let (before, after) = surrounding_byte_deletion_ranges(&state.text, a, b, before_bytes, after_bytes);
+    if !before.is_empty() || !after.is_empty() {
+        apply_surrounding_deletion(&mut state.text, &mut state.ed, before, after);
+        state.changed = true;
+    }
+    EventFlow::Applied
+}
+
+/// Apply a character-count surrounding deletion after the staleness check. The selection is
+/// preserved, deletion stops at either text end, and a stale event skips.
+fn apply_delete_surrounding_chars(app: &FilmcraftApp, state: &mut TextEditState, target: ImeTarget, before_chars: usize, after_chars: usize) -> EventFlow {
+    if ime_event_is_stale(app, target) {
+        return EventFlow::Skip;
+    }
+    let (a, b) = state.selection();
+    let before = prev_n_chars(&state.text, a, before_chars)..a;
+    let after = b..next_n_chars(&state.text, b, after_chars);
+    if !before.is_empty() || !after.is_empty() {
+        apply_surrounding_deletion(&mut state.text, &mut state.ed, before, after);
+        state.changed = true;
+    }
+    EventFlow::Applied
+}
+
+/// Insert application-origin typing or paste: strip control characters except newline,
+/// replace the selection and move the caret to the end. Input that sanitizes to nothing is
+/// skipped.
+fn apply_text_input(state: &mut TextEditState, input: &str) -> EventFlow {
+    let s: String = input.chars().filter(|c| !c.is_control() || *c == '\n').collect();
+    if s.is_empty() {
+        return EventFlow::Skip;
+    }
+    state.delete_selection();
+    let at = state.ed.caret;
+    state.text.insert_str(at, &s);
+    state.ed.caret += s.len();
+    state.ed.anchor = state.ed.caret;
+    state.changed = true;
+    EventFlow::Applied
+}
+
+/// Apply an IME commit after the staleness check: clear the composition, insert sanitized
+/// committed text, or delete the selection when the commit is empty; a stale commit skips.
+fn apply_ime_commit(app: &mut FilmcraftApp, state: &mut TextEditState, target: ImeTarget, input: &str) -> EventFlow {
+    if ime_event_is_stale(app, target) {
+        return EventFlow::Skip;
+    }
+    app.ime_composition = None;
+    app.ime_composition_viewport = None;
+    let s: String = input.chars().filter(|c| !c.is_control() || *c == '\n').collect();
+    if s.is_empty() {
+        // A commit replaces the selection even when the input method produced no text
+        // (for example DeleteSurroundingBytes followed by an empty commit). An empty
+        // commit with no selection stays a no-op.
+        if state.delete_selection() {
+            state.changed = true;
+        }
+    } else {
+        state.delete_selection();
+        let at = state.ed.caret;
+        state.text.insert_str(at, &s);
+        state.ed.caret += s.len();
+        state.ed.anchor = state.ed.caret;
+        state.changed = true;
+    }
+    EventFlow::Applied
+}
+
+/// Copy the sorted selection, and for Cut delete it. An empty selection is a no-op.
+fn apply_copy_cut(ui: &egui::Ui, state: &mut TextEditState, cut: bool) -> EventFlow {
+    let (a, b) = state.selection();
+    if a < b {
+        ui.ctx().copy_text(state.text[a..b].to_string());
+        if cut && state.delete_selection() {
+            state.changed = true;
+        }
+    }
+    EventFlow::Applied
+}
+
+/// Caret destination for Left: with no Shift collapse a selection to its start, otherwise
+/// move to the line start (Command), previous word (Alt) or previous character boundary.
+fn left_target(state: &TextEditState, layout: &filmcraft_text::Layout, shift: bool, command: bool, alt: bool) -> usize {
+    let (a, _) = state.selection();
+    if !shift && state.ed.caret != state.ed.anchor {
+        a
+    } else if command {
+        layout.lines[layout.caret(state.ed.caret).2].range.start
+    } else if alt {
+        word_left(&state.text, state.ed.caret)
+    } else {
+        prev_boundary(&state.text, state.ed.caret)
+    }
+}
+
+/// Caret destination for Right: with no Shift collapse a selection to its end, otherwise
+/// move to the line end (Command), next word (Alt) or next character boundary.
+fn right_target(state: &TextEditState, layout: &filmcraft_text::Layout, shift: bool, command: bool, alt: bool) -> usize {
+    let (_, b) = state.selection();
+    if !shift && state.ed.caret != state.ed.anchor {
+        b
+    } else if command {
+        layout.lines[layout.caret(state.ed.caret).2].range.end
+    } else if alt {
+        word_right(&state.text, state.ed.caret)
+    } else {
+        next_boundary(&state.text, state.ed.caret)
+    }
+}
+
+/// Caret destination for Up/Down: hit-test the same x on the adjacent line's baseline,
+/// clamping to the text start/end when there is no line in that direction.
+fn vertical_target(state: &TextEditState, layout: &filmcraft_text::Layout, up: bool) -> usize {
+    let (x, _, line) = layout.caret(state.ed.caret);
+    let target = if up { line.checked_sub(1) } else { Some(line + 1).filter(|next| *next < layout.lines.len()) };
+    match target {
+        Some(next) => layout.hit(x, layout.lines[next].baseline),
+        None if up => 0,
+        None => state.text.len(),
+    }
+}
+
+/// Apply a layout-derived caret destination after re-clamping it to a UTF-8 boundary in the
+/// current (possibly already edited) text. Without Shift the anchor collapses to the caret;
+/// any actual selection change invalidates the IME composition.
+fn apply_moved_caret(app: &mut FilmcraftApp, state: &mut TextEditState, moved: Option<usize>, shift: bool) {
+    if let Some(m) = moved {
+        let previous_selection = (state.ed.caret, state.ed.anchor);
+        // `m` comes from the layout of the text at the start of this batch, but an
+        // earlier Text/Paste/IME event may already have changed `text`; clamp to a
+        // UTF-8 boundary in the current text before a later event slices or inserts.
+        state.ed.caret = char_boundary_floor(&state.text, m);
+        if !shift {
+            state.ed.anchor = state.ed.caret;
+        }
+        if previous_selection != (state.ed.caret, state.ed.anchor) {
+            app.invalidate_ime_composition();
+        }
+    }
+}
+
+/// Apply one non-IME key press to the local edit: Enter/Backspace/Delete mutate text,
+/// Command+A selects all and arrows/Home/End move the caret. Text edits mark an application
+/// mutation; Escape stops editing and suspends IME input. Only Escape returns `Skip`.
+fn apply_key_event(
+    app: &mut FilmcraftApp,
+    ui: &egui::Ui,
+    state: &mut TextEditState,
+    layout: &filmcraft_text::Layout,
+    key: egui::Key,
+    modifiers: egui::Modifiers,
+) -> EventFlow {
+    let shift = modifiers.shift;
+    let mut moved = None;
+    match key {
+        egui::Key::Escape => {
+            // Escape cancels the edit now: a commit later in the same raw batch must
+            // not still be inserted after the user cancelled.
+            state.stop = true;
+            state.custom_mutations = false;
+            app.suspend_ime_input(ui.ctx());
+            return EventFlow::Skip;
+        }
+        egui::Key::Enter => {
+            state.delete_selection();
+            let at = state.ed.caret;
+            state.text.insert(at, '\n');
+            state.ed.caret += 1;
+            state.ed.anchor = state.ed.caret;
+            state.changed = true;
+        }
+        egui::Key::Backspace => {
+            let mut did = state.delete_selection();
+            if !did && state.ed.caret > 0 {
+                let p = if modifiers.alt || modifiers.command { word_left(&state.text, state.ed.caret) } else { prev_boundary(&state.text, state.ed.caret) };
+                let end = state.ed.caret;
+                state.text.replace_range(p..end, "");
+                state.ed.caret = p;
+                state.ed.anchor = p;
+                did = true;
+            }
+            if did {
+                state.changed = true;
+            }
+        }
+        egui::Key::Delete => {
+            let mut did = state.delete_selection();
+            if !did && state.ed.caret < state.text.len() {
+                let n = next_boundary(&state.text, state.ed.caret);
+                let at = state.ed.caret;
+                state.text.replace_range(at..n, "");
+                did = true;
+            }
+            if did {
+                state.changed = true;
+            }
+        }
+        egui::Key::A if modifiers.command => {
+            let moved = (state.ed.anchor, state.ed.caret) != (0, state.text.len());
+            state.ed.anchor = 0;
+            state.ed.caret = state.text.len();
+            if moved {
+                app.invalidate_ime_composition();
+            }
+        }
+        egui::Key::ArrowLeft => {
+            moved = Some(left_target(state, layout, shift, modifiers.command, modifiers.alt));
+        }
+        egui::Key::ArrowRight => {
+            moved = Some(right_target(state, layout, shift, modifiers.command, modifiers.alt));
+        }
+        egui::Key::ArrowUp | egui::Key::ArrowDown => {
+            moved = Some(vertical_target(state, layout, key == egui::Key::ArrowUp));
+        }
+        egui::Key::Home => moved = Some(layout.lines[layout.caret(state.ed.caret).2].range.start),
+        egui::Key::End => moved = Some(layout.lines[layout.caret(state.ed.caret).2].range.end),
+        _ => {}
+    }
+    apply_moved_caret(app, state, moved, shift);
+    EventFlow::Applied
+}
+
+/// One step for the editor, in the order the platform sent its events: an edit from
+/// [`craft_ui::ime::Composer`], or an empty input-method commit with nothing composing, which
+/// the composer drops but which replaces the selection here.
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum TextStep {
+    Edit(craft_ui::ime::Edit),
+    EmptyCommit,
+}
+
+/// Run the admitted events through the composer. Returns the steps and whether the composer
+/// ended a composition the platform input method may still hold.
+fn compose(composer: &mut craft_ui::ime::Composer, events: &[egui::Event], time: f64) -> (Vec<TextStep>, bool) {
+    let mut steps = Vec::new();
+    let mut interrupted = false;
+    let mut start = 0;
+    for (i, event) in events.iter().enumerate() {
+        if !matches!(event, egui::Event::Ime(egui::ImeEvent::Commit(text)) if text.is_empty()) {
+            continue;
+        }
+        steps.extend(composer.process(events.get(start..i).unwrap_or_default(), time).edits.into_iter().map(TextStep::Edit));
+        interrupted |= composer.interrupted();
+        if composer.is_composing() {
+            start = i;
+        } else {
+            let _ = composer.process(std::slice::from_ref(event), time);
+            steps.push(TextStep::EmptyCommit);
+            start = i.saturating_add(1);
+        }
+    }
+    steps.extend(composer.process(events.get(start..).unwrap_or_default(), time).edits.into_iter().map(TextStep::Edit));
+    (steps, interrupted || composer.interrupted())
+}
+
+/// Whether a step is the input method's (`from_ime`) and ends its composition (`terminal`). An
+/// insert is the input method's when it is one of the batch's committed texts, which it takes.
+fn step_origin(step: &TextStep, commits: &mut Vec<String>) -> (bool, bool) {
+    use craft_ui::ime::Edit;
+    match step {
+        TextStep::EmptyCommit => (true, true),
+        TextStep::Edit(Edit::Insert(text)) => match commits.iter().position(|commit| commit == text) {
+            Some(i) => {
+                commits.remove(i);
+                (true, true)
+            }
+            None => (false, false),
+        },
+        TextStep::Edit(Edit::Preedit { .. } | Edit::DeleteSurrounding { .. } | Edit::DeleteSurroundingBytes { .. }) => (true, false),
+        TextStep::Edit(_) => (false, false),
+    }
+}
+
+/// Apply one step. `Skip` is a stale or empty input-method or text step, which leaves the IME
+/// destination as it was.
+fn apply_text_step(
+    app: &mut FilmcraftApp,
+    ui: &egui::Ui,
+    state: &mut TextEditState,
+    target: ImeTarget,
+    layout: &filmcraft_text::Layout,
+    step: TextStep,
+    from_ime: bool,
+) -> EventFlow {
+    use craft_ui::ime::Edit;
+    let viewport = ui.ctx().viewport_id();
+    let edit = match step {
+        TextStep::EmptyCommit => return apply_ime_commit(app, state, target, ""),
+        TextStep::Edit(edit) => edit,
+    };
+    match edit {
+        Edit::Preedit { text, .. } => {
+            apply_preedit(app, viewport, target, &text);
+            EventFlow::Applied
+        }
+        // text-input-v3/Wayland delete-surrounding arrives in UTF-8 bytes. Only whole
+        // characters fully inside the reported range are deleted: a byte count that ends
+        // inside a character leaves that character (the fork's contract), so a combining
+        // accent or the letter next to an emoji is preserved.
+        Edit::DeleteSurroundingBytes { before_bytes, after_bytes } => apply_delete_surrounding_bytes(app, state, target, before_bytes, after_bytes),
+        Edit::DeleteSurrounding { before_chars, after_chars } => apply_delete_surrounding_chars(app, state, target, before_chars, after_chars),
+        // an input method (Chinese, Japanese, Korean) hands over its finished text as a commit (#1083)
+        Edit::Insert(text) if from_ime => apply_ime_commit(app, state, target, &text),
+        // ordinary typing, paste and marked text the composer kept as typed are application-origin
+        Edit::Insert(text) | Edit::Paste(text) => apply_text_input(state, &text),
+        Edit::Copy => apply_copy_cut(ui, state, false),
+        Edit::Cut => apply_copy_cut(ui, state, true),
+        Edit::Key { key, modifiers, .. } => apply_key_event(app, ui, state, layout, key, modifiers),
+        Edit::LineBreak { modifiers } => apply_key_event(app, ui, state, layout, egui::Key::Enter, modifiers),
+    }
+}
+
 /// Keyboard handling while a text layer is being edited.
-fn text_edit(app: &mut FilmcraftApp, ui: &mut egui::Ui, v: &LayerView, mut ed: GfxEdit, resp: &egui::Response, actions: &mut Vec<(String, Value)>) {
+fn text_edit(app: &mut FilmcraftApp, ui: &mut egui::Ui, v: &LayerView, ed: GfxEdit, resp: &egui::Response) {
     let _ = resp;
+    let window_focused = ui.input(|input| input.viewport().focused.unwrap_or(input.focused));
+    if !window_focused || app.ime_modal_blocks_input() || !ui.is_enabled() {
+        ime_off(app, ui);
+        return;
+    }
     // moving to another panel ends the edit; Properties and Essential Graphics style the text
     // being edited, so working there keeps it (#683). Only a move counts: an edit started with
     // another panel focused (an agent's `ui.set`) goes on until the focus moves.
     use crate::dock::PanelKind;
-    let panel_id = egui::Id::new(TEXT_EDIT_ID).with("panel");
+    let panel_id = egui::Id::unique(TEXT_EDIT_ID).with("panel");
     let before = ui.data(|d| d.get_temp::<PanelKind>(panel_id));
     ui.data_mut(|d| d.insert_temp(panel_id, app.ui.focused));
     if before.is_some_and(|b| b != app.ui.focused) && !matches!(app.ui.focused, PanelKind::Program | PanelKind::Properties | PanelKind::EssentialGraphics) {
         end_edit(app, ui);
+        ime_off(app, ui);
         return;
     }
-    let eid = egui::Id::new(TEXT_EDIT_ID);
+    let eid = egui::Id::unique(TEXT_EDIT_ID);
     // a real (non-clickable) widget holds keyboard focus so shortcuts pause while typing
     let fr = ui.interact(Rect::from_points(&v.quad()), eid, Sense::focusable_noninteractive());
-    fr.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, true, "Text layer"));
+    fr.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, true, "Text layer"));
     // while another field has the keyboard (a value typed in Properties) the keys are its own;
     // the text takes the keyboard back once nothing has it (#683)
     if ui.memory(|m| m.focused().is_some_and(|f| f != eid)) {
+        ime_off(app, ui);
         return;
     }
     ui.memory_mut(|m| {
         m.request_focus(eid);
         m.set_focus_lock_filter(eid, egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true });
     });
-    let Some(tp) = text_of(&v.spec) else { return };
-    let mut text = tp.text.clone();
-    ed.caret = ed.caret.min(text.len());
-    ed.anchor = ed.anchor.min(text.len());
-    let l = text_layout(tp);
-    let events = ui.input(|i| i.events.clone());
-    let mut changed = false;
-    let mut stop = false;
-    let sel = |ed: &GfxEdit| (ed.caret.min(ed.anchor), ed.caret.max(ed.anchor));
-    let delete_sel = |text: &mut String, ed: &mut GfxEdit| -> bool {
-        let (a, b) = sel(ed);
-        if a == b {
-            return false;
-        }
-        text.replace_range(a..b, "");
-        ed.caret = a;
-        ed.anchor = a;
-        true
+    let Some(tp) = text_of(&v.spec) else {
+        ime_off(app, ui);
+        return;
     };
+    let mut state = TextEditState { ed, text: tp.text.clone(), changed: false, stop: false, custom_mutations: true };
+    // `ui.set.gfxEdit` accepts arbitrary byte offsets. Clamp both ends to UTF-8 boundaries here,
+    // before any slice/replace_range/insert_str, so hostile offsets can never panic the editor.
+    clamp_edit_offsets(&state.text, &mut state.ed);
+    let l = text_layout(tp);
+    let (events, time) = ui.input(|i| (i.events.clone(), i.time));
+    let sequence = app.session.state.active_sequence.map_or(0, |sequence| sequence.0);
+    let composition_target = graphics_ime_target(sequence, state.ed.clip, state.ed.layer, v.spec.uid, app.ime_replacement_epoch);
+    let viewport = ui.ctx().viewport_id();
+    if app.ime_composer_target != Some(composition_target) {
+        app.ime_composer.discard(ui.ctx());
+        app.ime_composer = craft_ui::ime::Composer::new().with_owner(composition_target.owner);
+        app.ime_composer_target = Some(composition_target);
+    }
+    // A command, a control request or a caret move ended the composition: the composer drops
+    // its copy of the marked text, and a late commit of it.
+    if app.ime_composer.is_composing()
+        && !(app.ime_composition == Some(crate::ImeComposition::Active(composition_target)) && app.ime_composition_viewport == Some(viewport))
+    {
+        app.ime_composer.discard(ui.ctx());
+    }
+    // The composer turns the IME on and publishes its descriptor; the editor runs the events
+    // through it below, between the fence's per-event checks.
+    let held = ui.ctx().input_mut(|i| std::mem::take(&mut i.events));
+    let _ = app.ime_composer.update(ui.ctx(), true);
+    ui.ctx().input_mut(|i| i.events = held);
+    // Reset completions and the fence's admission run per raw event. A pointer press is
+    // handled later in this pass (caret placement, another layer, or ending the edit): the
+    // composer sees it, so a composition keeps its marked text, and the events after it
+    // belong to the new target.
+    let mut admitted = Vec::new();
+    let mut pressed = false;
     for ev in events {
-        match ev {
-            // an input method (Chinese, Japanese, Korean) hands over its finished text as a commit (#1083)
-            egui::Event::Text(s) | egui::Event::Paste(s) | egui::Event::Ime(egui::ImeEvent::Commit(s)) => {
-                let s: String = s.chars().filter(|c| !c.is_control() || *c == '\n').collect();
-                if s.is_empty() {
-                    continue;
-                }
-                delete_sel(&mut text, &mut ed);
-                text.insert_str(ed.caret, &s);
-                ed.caret += s.len();
-                ed.anchor = ed.caret;
-                changed = true;
-            }
-            egui::Event::Copy | egui::Event::Cut => {
-                let (a, b) = sel(&ed);
-                if a < b {
-                    ui.ctx().copy_text(text[a..b].to_string());
-                    if matches!(ev, egui::Event::Cut) {
-                        changed |= delete_sel(&mut text, &mut ed);
-                    }
-                }
-            }
-            egui::Event::Key { key, pressed: true, modifiers, .. } => {
-                let shift = modifiers.shift;
-                let mut moved = None;
-                match key {
-                    egui::Key::Escape => stop = true,
-                    egui::Key::Enter => {
-                        delete_sel(&mut text, &mut ed);
-                        text.insert(ed.caret, '\n');
-                        ed.caret += 1;
-                        ed.anchor = ed.caret;
-                        changed = true;
-                    }
-                    egui::Key::Backspace => {
-                        if !delete_sel(&mut text, &mut ed) && ed.caret > 0 {
-                            let p = if modifiers.alt || modifiers.command { word_left(&text, ed.caret) } else { prev_boundary(&text, ed.caret) };
-                            text.replace_range(p..ed.caret, "");
-                            ed.caret = p;
-                            ed.anchor = p;
-                        }
-                        changed = true;
-                    }
-                    egui::Key::Delete => {
-                        if !delete_sel(&mut text, &mut ed) && ed.caret < text.len() {
-                            let n = next_boundary(&text, ed.caret);
-                            text.replace_range(ed.caret..n, "");
-                        }
-                        changed = true;
-                    }
-                    egui::Key::A if modifiers.command => {
-                        ed.anchor = 0;
-                        ed.caret = text.len();
-                    }
-                    egui::Key::ArrowLeft => {
-                        let (a, _) = sel(&ed);
-                        moved = Some(if !shift && ed.caret != ed.anchor {
-                            a
-                        } else if modifiers.command {
-                            l.lines[l.caret(ed.caret).2].range.start
-                        } else if modifiers.alt {
-                            word_left(&text, ed.caret)
-                        } else {
-                            prev_boundary(&text, ed.caret)
-                        });
-                    }
-                    egui::Key::ArrowRight => {
-                        let (_, b) = sel(&ed);
-                        moved = Some(if !shift && ed.caret != ed.anchor {
-                            b
-                        } else if modifiers.command {
-                            l.lines[l.caret(ed.caret).2].range.end
-                        } else if modifiers.alt {
-                            word_right(&text, ed.caret)
-                        } else {
-                            next_boundary(&text, ed.caret)
-                        });
-                    }
-                    egui::Key::ArrowUp | egui::Key::ArrowDown => {
-                        let (x, _, li) = l.caret(ed.caret);
-                        let target = if key == egui::Key::ArrowUp { li.checked_sub(1) } else { Some(li + 1).filter(|n| *n < l.lines.len()) };
-                        moved = Some(match target {
-                            Some(n) => l.hit(x, l.lines[n].baseline),
-                            None if key == egui::Key::ArrowUp => 0,
-                            None => text.len(),
-                        });
-                    }
-                    egui::Key::Home => moved = Some(l.lines[l.caret(ed.caret).2].range.start),
-                    egui::Key::End => moved = Some(l.lines[l.caret(ed.caret).2].range.end),
-                    _ => {}
-                }
-                if let Some(m) = moved {
-                    ed.caret = m.min(text.len());
-                    if !shift {
-                        ed.anchor = ed.caret;
-                    }
-                }
-            }
-            _ => {}
+        if begin_text_event(app, ui, &state, composition_target, &ev).is_none() {
+            continue;
+        }
+        pressed = matches!(ev, egui::Event::PointerButton { pressed: true, .. });
+        admitted.push(ev);
+        if pressed {
+            break;
         }
     }
-    if changed && text != tp.text {
-        actions.push(("graphics.setText".into(), json!({"clip": ed.clip, "layer": ed.layer, "text": text, "merge": true})));
+    let mut commits: Vec<String> = admitted
+        .iter()
+        .filter_map(|ev| match ev {
+            egui::Event::Ime(egui::ImeEvent::Commit(text)) if !text.is_empty() => Some(text.clone()),
+            _ => None,
+        })
+        .collect();
+    let (steps, interrupted) = compose(&mut app.ime_composer, &admitted, time);
+    for step in steps {
+        if !state.custom_mutations {
+            break;
+        }
+        let (from_ime, terminal) = step_origin(&step, &mut commits);
+        app.sync_live_ime_destination(ui.ctx(), local_reset_destination(app, &state.ed, &state.text, composition_target));
+        if from_ime && app.ime_reset.blocked(viewport) {
+            continue;
+        }
+        if apply_text_step(app, ui, &mut state, composition_target, &l, step, from_ime) == EventFlow::Skip {
+            continue;
+        }
+        finish_text_event(app, ui, &state, composition_target, from_ime, terminal);
     }
-    if stop {
+    if pressed {
+        state.custom_mutations = false;
+        app.suspend_ime_input(ui.ctx());
+    } else if interrupted && matches!(app.ime_composition, Some(crate::ImeComposition::Active(_) | crate::ImeComposition::TerminalPending(_))) {
+        // The composer kept the marked text as typed (a bare line break confirmed it): the
+        // platform input method drops its copy.
+        app.invalidate_ime_composition();
+    }
+    // Written now, not queued with the pass's other actions: an edit that ends later in this pass
+    // (Escape, a click elsewhere, another layer) types the marked text into this text.
+    if state.changed && state.text != tp.text {
+        let text = std::mem::take(&mut state.text);
+        if let Err(e) = app.session.execute("graphics.setText", json!({"clip": state.ed.clip, "layer": state.ed.layer, "text": text, "merge": true})) {
+            app.ui.status = e.to_string();
+        }
+    }
+    app.ui.gfx_edit = Some(state.ed);
+    if state.stop {
         end_edit(app, ui);
-    } else {
-        app.ui.gfx_edit = Some(ed);
     }
 }
 
+/// The editor doesn't take the keyboard in this pass: the composer turns the IME off, and the
+/// fence's controls stay inert.
+fn ime_off(app: &mut FilmcraftApp, ui: &egui::Ui) {
+    let _ = app.ime_composer.update(ui.ctx(), false);
+    app.suspended_ime_controls(ui.ctx());
+}
+
+/// Clamp an edit caret/anchor to valid UTF-8 boundaries (hostile `ui.set.gfxEdit` offsets).
+fn clamp_edit_offsets(text: &str, ed: &mut GfxEdit) {
+    ed.caret = char_boundary_floor(text, ed.caret);
+    ed.anchor = char_boundary_floor(text, ed.anchor);
+}
+
+/// The two ranges `DeleteSurroundingBytes` deletes: whole characters fully contained in the
+/// bytes before and after the sorted selection. The selection itself and any pre-edit (absent
+/// from FilmCraft's committed model) are excluded. A byte count that ends inside a character
+/// leaves that character whole.
+fn surrounding_byte_deletion_ranges(
+    text: &str,
+    a: usize,
+    b: usize,
+    before_bytes: usize,
+    after_bytes: usize,
+) -> (core::ops::Range<usize>, core::ops::Range<usize>) {
+    let a = char_boundary_floor(text, a);
+    let b = char_boundary_ceil(text, b).max(a);
+    let from = a.saturating_sub(before_bytes);
+    let before_chars = text[..a].char_indices().rev().take_while(|(index, _)| *index >= from).count();
+    let after_chars = text[b..].char_indices().take_while(|(index, c)| index + c.len_utf8() <= after_bytes).count();
+    (prev_n_chars(text, a, before_chars)..a, b..next_n_chars(text, b, after_chars))
+}
+
+/// Apply the two delete-surrounding ranges while preserving the selection's direction.
+///
+/// Delete after the selection first, then before it, so the selection remains intact and both
+/// endpoints shift only by the preceding deletion. This mirrors the stock `TextEdit`: a
+/// surrounding deletion does not consume the selection, and the commit that usually follows
+/// replaces it.
+fn apply_surrounding_deletion(text: &mut String, ed: &mut GfxEdit, before: core::ops::Range<usize>, after: core::ops::Range<usize>) {
+    let before_end = before.end;
+    let before_len = before.len();
+    if !after.is_empty() {
+        text.replace_range(after, "");
+    }
+    if !before.is_empty() {
+        text.replace_range(before, "");
+    }
+    let shift = |offset: usize| {
+        let offset = if offset >= before_end { offset - before_len } else { offset };
+        offset.min(text.len())
+    };
+    ed.caret = shift(ed.caret);
+    ed.anchor = shift(ed.anchor);
+}
+
+/// Largest char boundary not after `i`.
+fn char_boundary_floor(s: &str, mut i: usize) -> usize {
+    i = i.min(s.len());
+    while i > 0 && !s.is_char_boundary(i) {
+        i -= 1;
+    }
+    i
+}
+
+/// Smallest char boundary not before `i`.
+fn char_boundary_ceil(s: &str, mut i: usize) -> usize {
+    i = i.min(s.len());
+    while i < s.len() && !s.is_char_boundary(i) {
+        i += 1;
+    }
+    i
+}
+
+/// Move `i` to a character boundary and then back up to `n` whole characters, stopping at
+/// the start. Hostile offsets and counts are clamped instead of slicing inside a character.
+fn prev_n_chars(s: &str, mut i: usize, n: usize) -> usize {
+    i = char_boundary_floor(s, i);
+    for _ in 0..n {
+        if i == 0 {
+            break;
+        }
+        i = match s[..i].char_indices().next_back() {
+            Some((j, _)) => j,
+            None => 0,
+        };
+    }
+    i
+}
+
+/// Move `i` to a character boundary and then forward up to `n` whole characters, stopping at
+/// the end. Hostile offsets and counts are clamped instead of slicing inside a character.
+fn next_n_chars(s: &str, mut i: usize, n: usize) -> usize {
+    i = char_boundary_ceil(s, i);
+    for _ in 0..n {
+        if i >= s.len() {
+            break;
+        }
+        i = match s[i..].char_indices().nth(1) {
+            Some((j, _)) => i + j,
+            None => s.len(),
+        };
+    }
+    i
+}
+
 fn word_left(s: &str, i: usize) -> usize {
     let mut j = i;
     let b: Vec<(usize, char)> = s[..i].char_indices().collect();
@@ -1195,9 +2317,20 @@ fn color32(c: [f32; 4]) -> Color32 {
     Color32::from_rgba_unmultiplied(q(c[0]), q(c[1]), q(c[2]), q(c[3]))
 }
 
+/// The formatting knobs of an inline graphics number field.
+struct NumberField<'a> {
+    id: &'a str,
+    speed: f64,
+    range: (f64, f64),
+    decimals: usize,
+    unit: &'a str,
+}
+
 struct Ctx<'a> {
     clip: ClipId,
     layer: usize,
+    /// The layer's index in the clip's effect list (what `effects.toggleAnimation` addresses).
+    eidx: usize,
     e: &'a EffectInstance,
     mt: Tick,
     t: Tokens,
@@ -1245,47 +2378,85 @@ impl Ctx<'_> {
         );
         (r, v)
     }
+    /// The stopwatch in front of an animatable property's label (#2358): turns keyframing on or
+    /// off at the playhead, like the one in Effect Controls. While a property animates, changing
+    /// it here adds or updates a keyframe at the playhead instead of changing it everywhere. A
+    /// Type-tool selection edits the selected characters, which have no keyframes: no stopwatch.
+    fn stopwatch(&mut self, ui: &egui::Ui, row: Rect, id: &str) {
+        let animatable = self.e.def().and_then(|d| d.param(id)).is_some_and(|d| d.animatable);
+        if !animatable || (self.range.is_some() && char_style_key(id).is_some()) {
+            return;
+        }
+        let animated = self.e.params.get(id).is_some_and(|p| p.is_animated());
+        let sw = Rect::from_center_size(pos2(row.min.x + 8.0, row.center().y), vec2(12.0, 12.0));
+        let resp = ui.interact(sw.expand(2.0), egui::Id::unique(("gfxsw", self.clip.0, self.layer, id)), Sense::click()).on_hover_text(tl!("Toggle animation"));
+        let tint = if animated {
+            self.t.accent
+        } else if resp.hovered() {
+            self.t.text
+        } else {
+            self.t.text_faint
+        };
+        icons::paint(ui.painter(), sw, Icon::Stopwatch, tint);
+        self.autos.push((format!("graphics.prop.{id}.stopwatch"), sw, "Toggle animation".to_string()));
+        if resp.clicked() {
+            self.actions.push(("effects.toggleAnimation".into(), json!({"clip": self.clip.0, "effect": self.eidx, "param": id})));
+        }
+    }
+    /// Draw a labeled hot number for this clip/layer/`id`, register it for automation and emit the changed value through `Ctx::set`; `range` bounds typed and
+    /// dragged input.
     fn number(&mut self, ui: &mut egui::Ui, label: &str, id: &str, speed: f64, range: (f64, f64), dec: usize, unit: &str) {
         let v = pv(self.e, id, self.mt).as_f64().unwrap_or(0.0);
         let (r, mut vui) = self.row(ui, label);
-        let (resp, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new(("gfxp", self.clip.0, self.layer, id)), v, speed, range, dec, unit, &self.t);
+        let (resp, nv) = crate::widgets::hot_number(
+            &mut vui,
+            label,
+            egui::Id::unique(("gfxp", self.clip.0, self.layer, id)),
+            v,
+            HotNumberOptions::new(speed, range, dec, unit, &self.t),
+        );
         self.auto(id, resp.rect, label);
-        let _ = r;
+        self.stopwatch(ui, r, id);
         if let Some(nv) = nv {
             self.set(id, json!(nv));
         }
     }
-    fn number_in(&mut self, vui: &mut egui::Ui, id: &str, speed: f64, range: (f64, f64), dec: usize, unit: &str) {
+    /// Draw an inline numeric field without a label row or stopwatch, register it for automation
+    /// and emit the edited value through `Ctx::set` when it changes.
+    fn number_in(&mut self, vui: &mut egui::Ui, label: &str, field: NumberField<'_>) {
+        let NumberField { id, speed, range, decimals, unit } = field;
         let v = pv(self.e, id, self.mt).as_f64().unwrap_or(0.0);
-        let (resp, nv) = crate::widgets::hot_number(vui, egui::Id::new(("gfxp", self.clip.0, self.layer, id)), v, speed, range, dec, unit, &self.t);
+        let (resp, nv) = crate::widgets::hot_number(
+            vui,
+            label,
+            egui::Id::unique(("gfxp", self.clip.0, self.layer, id)),
+            v,
+            HotNumberOptions::new(speed, range, decimals, unit, &self.t),
+        );
         self.auto(id, resp.rect, id);
         if let Some(nv) = nv {
             self.set(id, json!(nv));
         }
     }
+    /// Draw X and Y hot numbers for this clip/layer/`id` with independent ids and ±100,000 bounds, register both and emit both components when either changes.
     fn point(&mut self, ui: &mut egui::Ui, label: &str, id: &str) {
         let v = pv(self.e, id, self.mt).as_vec2().unwrap_or_default();
-        let (_, mut vui) = self.row(ui, label);
+        let (r, mut vui) = self.row(ui, label);
+        self.stopwatch(ui, r, id);
         let (rx, nx) = crate::widgets::hot_number(
             &mut vui,
-            egui::Id::new(("gfxp", self.clip.0, self.layer, id, "x")),
+            &format!("{label} X"),
+            egui::Id::unique(("gfxp", self.clip.0, self.layer, id, "x")),
             v.x,
-            1.0,
-            (-100_000.0, 100_000.0),
-            1,
-            " X",
-            &self.t,
+            HotNumberOptions::new(1.0, (-100_000.0, 100_000.0), 1, " X", &self.t),
         );
         vui.add_space(10.0);
         let (ry, ny) = crate::widgets::hot_number(
             &mut vui,
-            egui::Id::new(("gfxp", self.clip.0, self.layer, id, "y")),
+            &format!("{label} Y"),
+            egui::Id::unique(("gfxp", self.clip.0, self.layer, id, "y")),
             v.y,
-            1.0,
-            (-100_000.0, 100_000.0),
-            1,
-            " Y",
-            &self.t,
+            HotNumberOptions::new(1.0, (-100_000.0, 100_000.0), 1, " Y", &self.t),
         );
         self.auto(&format!("{id}.x"), rx.rect, label);
         self.auto(&format!("{id}.y"), ry.rect, label);
@@ -1312,7 +2483,10 @@ impl Ctx<'_> {
             self.set(id, json!(format!("#{r8:02x}{g8:02x}{b8:02x}")));
         }
     }
-    fn choice(&mut self, vui: &mut egui::Ui, id: &str, opts: &[&str], width: f32) {
+    /// Draw a combo box for a choice parameter, register it for automation and emit the selected
+    /// index through `Ctx::set` when it changes. An out-of-range current value displays as an
+    /// empty selection.
+    fn choice(&mut self, vui: &mut egui::Ui, id: &str, label: &str, opts: &[&str], width: f32) {
         let cur = match pv(self.e, id, self.mt) {
             ParamValue::Choice(c) => c as usize,
             _ => 0,
@@ -1326,7 +2500,8 @@ impl Ctx<'_> {
                     ui.selectable_value(&mut sel, i, crate::i18n::t(o));
                 }
             });
-        self.auto(id, r.response.rect, id);
+        let response = crate::widgets::accessible_name(r.response, label);
+        self.auto(id, response.rect, id);
         if sel != cur {
             self.set(id, json!(sel));
         }
@@ -1532,7 +2707,7 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 ui.painter().text(pos2(r.min.x + 38.0, r.center().y), Align2::LEFT_CENTER, layer_display_name(e, li), Tokens::ui(12.0), t.text);
                 // visibility
                 let er = Rect::from_center_size(pos2(r.max.x - 14.0, r.center().y), vec2(16.0, 16.0));
-                let eresp = ui.interact(er, egui::Id::new(("gfx-eye", clip.0, li)), Sense::click());
+                let eresp = ui.interact(er, egui::Id::unique(("gfx-eye", clip.0, li)), Sense::click());
                 icons::paint(ui.painter(), er.shrink(2.0), if e.enabled { Icon::Eye } else { Icon::EyeOff }, t.text_dim);
                 autos.push((format!("graphics.layers.{li}.visible"), er, "Toggle visibility".into()));
                 autos.push((format!("graphics.layers.{li}"), r, layer_display_name(e, li)));
@@ -1565,7 +2740,7 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let ch = |b: usize| text.get(..b.min(text.len())).map_or(0, |s| s.chars().count());
             Some((ch(ed.caret.min(ed.anchor)), ch(ed.caret.max(ed.anchor))))
         });
-        let mut cx = Ctx { clip, layer: l, e, mt, t, actions: Vec::new(), autos: Vec::new(), range };
+        let mut cx = Ctx { clip, layer: l, eidx: idx[l], e, mt, t, actions: Vec::new(), autos: Vec::new(), range };
         if section(ui, app, "Responsive Design - Position", &t) {
             crate::panels::graphics_templates::responsive_position(app, ui, clip, &it, l, &mut cx.autos, &mut cx.actions);
         }
@@ -1607,7 +2782,7 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let (open, head) = section_header(ui, app, "Text", &t);
             // Text Properties: the layer type (point / paragraph) and text styling
             let wr = Rect::from_center_size(pos2(head.max.x - 16.0, head.center().y), vec2(22.0, 22.0));
-            let wresp = ui.interact(wr, egui::Id::new(("gfx-text-props", clip.0, l)), Sense::click());
+            let wresp = ui.interact(wr, egui::Id::unique(("gfx-text-props", clip.0, l)), Sense::click());
             icons::paint(ui.painter(), wr.shrink(4.0), Icon::Wrench, if wresp.hovered() { t.text } else { t.text_dim });
             cx.autos.push(("graphics.textProperties".into(), wr, "Text Properties".into()));
             if wresp.on_hover_text(tl!("Text Properties")).clicked() {
@@ -1633,7 +2808,10 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let before = s.clone();
             ui.horizontal(|ui| {
                 ui.add_space(14.0);
-                let r = ui.add(egui::TextEdit::multiline(&mut s).desired_rows(2).desired_width(ui.available_width() - 8.0).font(Tokens::ui(12.0)));
+                let r = crate::widgets::accessible_name(
+                    ui.add(egui::TextEdit::multiline(&mut s).desired_rows(2).desired_width(ui.available_width() - 8.0).font(Tokens::ui(12.0))),
+                    "Source Text",
+                );
                 cx.autos.push(("graphics.sourceText".into(), r.rect, "Source Text".into()));
             });
             if s != before {
@@ -1659,7 +2837,8 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     }
                 }
             });
-            cx.auto("font", r.response.rect, "Font");
+            let response = crate::widgets::accessible_name(r.response, "Font");
+            cx.auto("font", response.rect, "Font");
             let styles: Vec<String> = fams.iter().find(|(f, _)| f.eq_ignore_ascii_case(&family)).map(|(_, s)| s.clone()).unwrap_or_default();
             let (_, mut vui) = cx.row(ui, tl!("Font Style"));
             let r = egui::ComboBox::from_id_salt(("gfx-style", clip.0, l)).selected_text(&style).width(170.0).show_ui(&mut vui, |ui| {
@@ -1679,7 +2858,8 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     }
                 }
             });
-            cx.auto("font_style", r.response.rect, "Font Style");
+            let response = crate::widgets::accessible_name(r.response, "Font Style");
+            cx.auto("font_style", response.rect, "Font Style");
             cx.number(ui, tl!("Font Size"), "size", 0.5, (1.0, 2000.0), 0, "");
             let align = match pv(e, "align", mt) {
                 ParamValue::Choice(c) => c,
@@ -1742,7 +2922,7 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         if e.effect == graphic::SHAPE_LAYER && section(ui, app, "Shape", &t) {
             let (_, mut vui) = cx.row(ui, tl!("Shape"));
-            cx.choice(&mut vui, "shape", graphic::SHAPE_OPTS, 120.0);
+            cx.choice(&mut vui, "shape", tl!("Shape"), graphic::SHAPE_OPTS, 120.0);
             cx.point(ui, tl!("Size"), "size");
             cx.number(ui, tl!("Corner Radius"), "corner_radius", 0.5, (0.0, 10_000.0), 0, "");
             cx.number(ui, tl!("Polygon Sides"), "sides", 0.05, (3.0, 64.0), 0, "");
@@ -1754,7 +2934,7 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             cx.color(&mut vui, "fill_color");
             if fill_on {
                 vui.add_space(6.0);
-                cx.choice(&mut vui, "fill_kind", graphic::FILL_KIND_OPTS, 130.0);
+                cx.choice(&mut vui, "fill_kind", tl!("Fill Type"), graphic::FILL_KIND_OPTS, 130.0);
             }
             let fill_kind = match pv(e, "fill_kind", mt) {
                 ParamValue::Choice(c) => c,
@@ -1766,17 +2946,17 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 cx.color(&mut vui, "gradient_end");
                 cx.number(ui, tl!("   Angle"), "gradient_angle", 0.5, (-3600.0, 3600.0), 0, " °");
             }
-            for (on, col, w, kind, label) in [
-                ("stroke", "stroke_color", "stroke_width", "stroke_type", tl!("Stroke")),
-                ("stroke2", "stroke2_color", "stroke2_width", "stroke2_type", tl!("Stroke 2")),
+            for (on, col, w, kind, label, width_label, type_label) in [
+                ("stroke", "stroke_color", "stroke_width", "stroke_type", tl!("Stroke"), tl!("Stroke Width"), tl!("Stroke Type")),
+                ("stroke2", "stroke2_color", "stroke2_width", "stroke2_type", tl!("Stroke 2"), tl!("Stroke 2 Width"), tl!("Stroke 2 Type")),
             ] {
                 let (_, mut vui) = cx.row(ui, label);
                 cx.check(&mut vui, on, "");
                 cx.color(&mut vui, col);
                 vui.add_space(6.0);
-                cx.number_in(&mut vui, w, 0.2, (0.0, 1000.0), 1, "");
+                cx.number_in(&mut vui, width_label, NumberField { id: w, speed: 0.2, range: (0.0, 1000.0), decimals: 1, unit: "" });
                 vui.add_space(6.0);
-                cx.choice(&mut vui, kind, graphic::STROKE_OPTS, 70.0);
+                cx.choice(&mut vui, kind, type_label, graphic::STROKE_OPTS, 70.0);
             }
             let (_, mut vui) = cx.row(ui, tl!("Background"));
             let bg = cx.check(&mut vui, "background", "");
@@ -1804,13 +2984,13 @@ pub fn properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         app.auto.add(&id, r, &label);
     }
     let (down, press) = ui.ctx().input(|i| (i.pointer.any_down(), i.pointer.press_start_time()));
-    let key = egui::Id::new("gfx-props-drag-step");
+    let key = egui::Id::unique("gfx-props-drag-step");
     let begun = ui.ctx().data(|d| d.get_temp::<Option<f64>>(key)).flatten();
     let mut wrote = false;
     for (cmd, mut p) in actions {
         // a drag of a property is one undo step: the first change of each press begins a new one,
         // the rest fold into it (like Effect Controls, #201 / #887)
-        if cmd == "graphics.set" && down {
+        if matches!(cmd.as_str(), "graphics.set" | "graphics.setCharStyle") && down {
             p["merge"] = json!(true);
             p["begin"] = json!(begun != press);
             wrote = true;
@@ -1833,7 +3013,7 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut close = crate::widgets::escape_closes(ctx);
     let mut ok = false;
     let name = |paragraph: bool| if paragraph { tl!("Paragraph Text") } else { tl!("Point Text") };
-    let id = egui::Id::new("gfx-text-properties");
+    let id = egui::Id::unique("gfx-text-properties");
     egui::Window::new(tl!("Text Properties")).id(id).collapsible(false).resizable(false).centered(ctx).show(ctx, |ui| {
         ui.label(tl!("Text Layer Type"));
         let r = egui::ComboBox::from_id_salt("gfx-text-type").selected_text(name(d.paragraph)).width(190.0).show_ui(ui, |ui| {
@@ -1885,3 +3065,170 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
     }
     app.ui.text_props_dialog = if ok || close { None } else { Some(d) };
 }
+
+#[cfg(test)]
+mod ime_byte_delete_tests {
+    use super::{
+        GfxEdit, apply_surrounding_deletion, char_boundary_ceil, char_boundary_floor, clamp_edit_offsets, graphics_ime_target, next_n_chars, prev_n_chars,
+        surrounding_byte_deletion_ranges,
+    };
+
+    /// Floor/ceil byte offsets clamp to UTF-8 character boundaries, including offsets past the
+    /// end and offsets inside a multi-byte character.
+    #[test]
+    fn byte_boundaries_never_split_a_code_point() {
+        let s = "aé😀z"; // 1 + 2 + 4 + 1 bytes
+        assert_eq!(char_boundary_floor(s, 2), 1);
+        assert_eq!(char_boundary_ceil(s, 2), 3);
+        assert_eq!(char_boundary_floor(s, 4), 3);
+        assert_eq!(char_boundary_ceil(s, 4), 7);
+        assert_eq!(char_boundary_floor(s, 999), s.len());
+    }
+
+    /// Byte-count surrounding deletion removes only whole characters: a partial é or emoji byte
+    /// count deletes nothing, and the selection itself is always excluded.
+    #[test]
+    fn deleting_surrounding_bytes_leaves_partial_characters() {
+        let s = "aé😀z"; // a=1, é=1..3, 😀=3..7, z=7..8
+        // A cursor after "aé" (byte 3): one byte of "é" is not a whole character, so nothing is
+        // deleted; two bytes are exactly "é".
+        assert_eq!(surrounding_byte_deletion_ranges(s, 3, 3, 1, 0), (3..3, 3..3));
+        assert_eq!(surrounding_byte_deletion_ranges(s, 3, 3, 2, 0), (1..3, 3..3));
+        assert_eq!(&s[1..3], "é");
+        // After the cursor: the 4-byte emoji is only deleted when all four bytes are reported.
+        for partial in 1..4 {
+            assert_eq!(surrounding_byte_deletion_ranges(s, 3, 3, 0, partial), (3..3, 3..3), "after_bytes={partial}");
+        }
+        assert_eq!(surrounding_byte_deletion_ranges(s, 3, 3, 0, 4), (3..3, 3..7));
+        // The selection itself is excluded; only its surroundings are deleted.
+        assert_eq!(surrounding_byte_deletion_ranges(s, 1, 3, 0, 0), (1..1, 3..3));
+        assert_eq!(surrounding_byte_deletion_ranges(s, 1, 3, 1, 4), (0..1, 3..7));
+    }
+
+    /// Applying before/after surrounding deletions preserves a reversed selection's direction
+    /// while shifting both endpoints by the preceding deletion.
+    #[test]
+    fn surrounding_deletion_keeps_reversed_selection_direction() {
+        let mut text = "aé😀z".to_string();
+        let mut ed = GfxEdit { clip: 1, layer: 0, caret: 3, anchor: 1, ..Default::default() };
+        let (before, after) = surrounding_byte_deletion_ranges(&text, 1, 3, 1, 4);
+        apply_surrounding_deletion(&mut text, &mut ed, before, after);
+        assert_eq!(text, "éz");
+        assert_eq!((ed.caret, ed.anchor), (2, 0), "primary caret stays after the anchor");
+    }
+
+    /// Hostile `gfxEdit` caret/anchor offsets inside multi-byte characters clamp to boundaries
+    /// without panicking.
+    #[test]
+    fn hostile_edit_offsets_are_clamped_to_char_boundaries() {
+        let s = "é😀";
+        let mut ed = GfxEdit { clip: 1, layer: 0, caret: 1, anchor: 3, ..Default::default() };
+        clamp_edit_offsets(s, &mut ed);
+        assert_eq!((ed.caret, ed.anchor), (0, 2), "offsets inside the two characters move to boundaries");
+        assert_eq!(s.get(ed.caret..ed.anchor), Some("é"));
+    }
+
+    /// Character-count deletion stops at both text ends and never splits a character, even for
+    /// counts larger than the text.
+    #[test]
+    fn character_deletion_is_bounded() {
+        let s = "aé😀z".to_string();
+        assert_eq!(prev_n_chars(&s, s.len(), 99), 0);
+        assert_eq!(next_n_chars(&s, 0, 2), "aé".len());
+        assert_eq!(prev_n_chars(&s, 5, 1), 1);
+        assert_eq!(next_n_chars(&s, 1, 1), 3);
+    }
+
+    /// The graphics IME owner prefers stable uid identity, falls back to the layer index only
+    /// without a uid, and separates sequence and replacement epochs.
+    #[test]
+    fn ime_owner_uses_stable_component_identity_and_explicit_replacement() {
+        let a = graphics_ime_target(7, 11, 3, 42, 5);
+        let b = graphics_ime_target(7, 11, 9, 42, 5);
+        assert_eq!(a, b, "the stable layer uid, not the mutable layer index, is the component");
+        assert_ne!(a, graphics_ime_target(7, 11, 3, 42, 6), "replacement epoch is explicit");
+        assert_ne!(a, graphics_ime_target(7, 11, 3, 43, 5), "a different component is a different owner");
+        assert_ne!(a, graphics_ime_target(8, 11, 3, 42, 5), "sequence identity is part of the owner");
+        let no_uid = graphics_ime_target(7, 11, 3, 0, 5);
+        assert_ne!(no_uid, graphics_ime_target(7, 11, 4, 0, 5), "without a layer uid, the index is the identity");
+    }
+
+    /// A pointer-down starts a new target, so later Text, Paste and IME events in the same raw
+    /// batch must not be applied to the layer that was being edited before the click. The old loop
+    /// cleared `custom_mutations` here; the extracted helper once fell through to `Applied` and
+    /// typed every later event into the old layer.
+    #[test]
+    fn pointer_press_rejects_text_paste_and_ime_later_in_the_same_raw_batch() {
+        use filmcraft_geom::{Affine, Vec2};
+        use filmcraft_project::ClipId;
+        use filmcraft_project::graphic::{Appearance, LayerContent, LayerSpec, LayerTransform, TextProps};
+
+        let mut app = crate::FilmcraftApp::new(filmcraft_engine::Session::default());
+        let ed = GfxEdit { clip: 1, layer: 0, caret: 3, anchor: 3, ..Default::default() };
+        app.ui.gfx_edit = Some(ed.clone());
+        let props = TextProps {
+            text: "old".into(),
+            font: String::new(),
+            style: String::new(),
+            size: 72.0,
+            align: 0,
+            tracking: 0.0,
+            kerning: true,
+            ligatures: true,
+            leading: 0.0,
+            baseline_shift: 0.0,
+            faux_bold: false,
+            faux_italic: false,
+            caps: 0,
+            underline: false,
+            box_width: 0.0,
+            box_height: 0.0,
+            vertical: false,
+            runs: Vec::new(),
+        };
+        let view = super::LayerView {
+            clip: ClipId(1),
+            layer: 0,
+            spec: LayerSpec {
+                name: "Text".into(),
+                enabled: true,
+                uid: 0,
+                pin: None,
+                content: LayerContent::Text(props),
+                appearance: Appearance { fill: None, gradient: None, strokes: Vec::new(), background: None, shadow: None },
+                transform: LayerTransform { position: Vec2::ZERO, anchor: Vec2::ZERO, scale: Vec2::new(1.0, 1.0), rotation: 0.0, opacity: 1.0 },
+            },
+            to_screen: Affine::IDENTITY,
+            canvas_to_screen: Affine::IDENTITY,
+            local: [-50.0, -25.0, 50.0, 25.0],
+        };
+
+        let ctx = egui::Context::default();
+        let raw = egui::RawInput {
+            focused: true,
+            events: vec![
+                egui::Event::PointerButton {
+                    pos: egui::pos2(20.0, 20.0),
+                    button: egui::PointerButton::Primary,
+                    pressed: true,
+                    modifiers: egui::Modifiers::NONE,
+                },
+                egui::Event::Text("typed".into()),
+                egui::Event::Paste("pasted".into()),
+                egui::Event::Ime(egui::ImeEvent::Commit("committed".into())),
+            ],
+            ..Default::default()
+        };
+        let mut focused = false;
+        let mut out = ctx.run_ui(raw, |ui| {
+            let response = ui.allocate_response(egui::vec2(100.0, 100.0), egui::Sense::click());
+            super::text_edit(&mut app, ui, &view, ed.clone(), &response);
+            focused = ui.memory(|m| m.has_focus(egui::Id::unique(super::TEXT_EDIT_ID)));
+        });
+        out.textures_delta.clear();
+
+        assert!(focused, "the text editor must own input for this batch");
+        // the session has no such clip: a `graphics.setText` would have failed into the status
+        assert!(app.ui.status.is_empty(), "the pointer press must stop Text, Paste and IME editing the old layer: {}", app.ui.status);
+    }
+}
diff --git a/crates/ui-egui/src/panels/graphics_templates.rs b/crates/ui-egui/src/panels/graphics_templates.rs
index 0aafa2eec..483658fdd 100644
--- a/crates/ui-egui/src/panels/graphics_templates.rs
+++ b/crates/ui-egui/src/panels/graphics_templates.rs
@@ -86,7 +86,7 @@ type Elems = Vec<(String, Rect, String)>;
 struct Lib(Arc<(f64, Vec<LibraryEntry>)>);
 
 fn lib_id() -> egui::Id {
-    egui::Id::new("gfx-template-library")
+    egui::Id::unique("gfx-template-library")
 }
 
 /// The template library, re-read at most every two seconds (or after [`invalidate`]).
@@ -110,7 +110,7 @@ const THUMB_W: u32 = 192;
 
 fn thumb_texture(ctx: &egui::Context, e: &LibraryEntry) -> egui::TextureHandle {
     let px = thumbnail_cached(&e.template, THUMB_W);
-    let key = egui::Id::new(("gfx-thumb", e.template.id.as_str(), Arc::as_ptr(&px) as usize));
+    let key = egui::Id::unique(("gfx-thumb", e.template.id.as_str(), Arc::as_ptr(&px) as usize));
     if let Some(t) = ctx.data(|d| d.get_temp::<egui::TextureHandle>(key)) {
         return t;
     }
@@ -125,7 +125,7 @@ fn thumb_texture(ctx: &egui::Context, e: &LibraryEntry) -> egui::TextureHandle {
 // ------------------------------------------------------------------------------------------------
 
 fn tab_button(ui: &mut egui::Ui, r: Rect, label: &str, on: bool, t: &Tokens) -> egui::Response {
-    let resp = ui.interact(r, egui::Id::new(("eg-tab", label)), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(("eg-tab", label)), Sense::click());
     if on {
         ui.painter().line_segment([pos2(r.min.x + 6.0, r.max.y - 1.5), pos2(r.max.x - 6.0, r.max.y - 1.5)], Stroke::new(2.0, t.accent));
     }
@@ -177,7 +177,10 @@ fn browse(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     b.set_clip_rect(rect);
     let st = &mut app.ui.gfx_templates;
     b.horizontal(|ui| {
-        let r = ui.add(egui::TextEdit::singleline(&mut st.query).hint_text(tl!("Search templates")).desired_width((ui.available_width() - 230.0).max(110.0)));
+        let r = crate::widgets::accessible_name(
+            ui.add(egui::TextEdit::singleline(&mut st.query).hint_text(tl!("Search templates")).desired_width((ui.available_width() - 230.0).max(110.0))),
+            "Search templates",
+        );
         elems.push(("gfxTemplates.search".into(), r.rect, "Search".into()));
         let cur = if st.category.is_empty() { tl!("All Categories").to_string() } else { crate::i18n::t(&st.category).to_string() };
         let r = egui::ComboBox::from_id_salt("gfx-cat").selected_text(cur).width(130.0).show_ui(ui, |ui| {
@@ -186,7 +189,8 @@ fn browse(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 ui.selectable_value(&mut st.category, c.clone(), crate::i18n::t(c));
             }
         });
-        elems.push(("gfxTemplates.category".into(), r.response.rect, "Category".into()));
+        let r = crate::widgets::accessible_name(r.response, "Category");
+        elems.push(("gfxTemplates.category".into(), r.rect, "Category".into()));
         let r = ui.button(tl!("Install…")).on_hover_text(tl!("Install Motion Graphics Template (.fcgt)"));
         elems.push(("gfxTemplates.install".into(), r.rect, "Install".into()));
         install = r.clicked();
@@ -360,7 +364,10 @@ pub fn template_controls(
             let r = ui
                 .horizontal(|ui| {
                     ui.add_space(14.0);
-                    ui.add(egui::TextEdit::multiline(&mut s).desired_rows(rows).desired_width(ui.available_width() - 8.0))
+                    crate::widgets::accessible_name(
+                        ui.add(egui::TextEdit::multiline(&mut s).desired_rows(rows).desired_width(ui.available_width() - 8.0)),
+                        c.name.clone(),
+                    )
                 })
                 .inner;
             autos.push((id, r.rect, c.name.clone()));
@@ -387,7 +394,7 @@ pub fn template_controls(
                     _ => String::new(),
                 };
                 let before = s.clone();
-                let r = vui.add(egui::TextEdit::singleline(&mut s).desired_width(vui.available_width() - 4.0));
+                let r = crate::widgets::accessible_name(vui.add(egui::TextEdit::singleline(&mut s).desired_width(vui.available_width() - 4.0)), c.name.clone());
                 autos.push((id, r.rect, c.name.clone()));
                 if s != before {
                     set(json!(s), actions);
@@ -647,7 +654,7 @@ fn export_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut elems: Elems = Vec::new();
     let mut action: Option<bool> = None;
     egui::Window::new(tl!("Export As Motion Graphics Template"))
-        .id(egui::Id::new("Export As Motion Graphics Template"))
+        .id(egui::Id::unique("Export As Motion Graphics Template"))
         .collapsible(false)
         .resizable(false)
         .default_width(420.0)
@@ -655,15 +662,15 @@ fn export_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
         .show(ctx, |ui| {
             egui::Grid::new("gfx-export-grid").num_columns(2).show(ui, |ui| {
                 ui.label(tl!("Name:"));
-                let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(260.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(260.0)), "Name");
                 elems.push(("exportTemplate.name".into(), r.rect, "Name".into()));
                 ui.end_row();
                 ui.label(tl!("Category:"));
-                let r = ui.add(egui::TextEdit::singleline(&mut d.category).desired_width(260.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.category).desired_width(260.0)), "Category");
                 elems.push(("exportTemplate.category".into(), r.rect, "Category".into()));
                 ui.end_row();
                 ui.label(tl!("Description:"));
-                let r = ui.add(egui::TextEdit::singleline(&mut d.description).desired_width(260.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.description).desired_width(260.0)), "Description");
                 elems.push(("exportTemplate.description".into(), r.rect, "Description".into()));
                 ui.end_row();
             });
@@ -674,7 +681,10 @@ fn export_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
                     ui.horizontal(|ui| {
                         let r = ui.checkbox(&mut c.on, "");
                         elems.push((format!("exportTemplate.control.{n}"), r.rect, c.name.clone()));
-                        ui.add(egui::TextEdit::singleline(&mut c.name).desired_width(220.0));
+                        crate::widgets::accessible_name(
+                            ui.add(egui::TextEdit::singleline(&mut c.name).desired_width(220.0)),
+                            format!("{} property name", c.param),
+                        );
                         ui.label(egui::RichText::new(c.param.replace('_', " ")).weak());
                     });
                 }
@@ -726,7 +736,7 @@ fn replace_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut elems: Elems = Vec::new();
     let mut action: Option<bool> = None;
     egui::Window::new(tl!("Replace Fonts in Projects"))
-        .id(egui::Id::new("Replace Fonts in Projects"))
+        .id(egui::Id::unique("Replace Fonts in Projects"))
         .collapsible(false)
         .resizable(false)
         .default_width(440.0)
diff --git a/crates/ui-egui/src/panels/import_mode.rs b/crates/ui-egui/src/panels/import_mode.rs
index 2af12cada..8f0e42714 100644
--- a/crates/ui-egui/src/panels/import_mode.rs
+++ b/crates/ui-egui/src/panels/import_mode.rs
@@ -28,7 +28,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let cw = 260.0;
     for (i, (title, cmd, sub)) in cards.iter().enumerate() {
         let r = Rect::from_min_size(rect.min + vec2(24.0 + i as f32 * (cw + 16.0), 90.0), vec2(cw, 150.0));
-        let resp = ui.interact(r, egui::Id::new(("imp", *cmd)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("imp", *cmd)), Sense::click());
         app.auto.add(&format!("import.{cmd}"), r, title);
         ui.painter().rect_filled(r, 8.0, if resp.hovered() { t.hover } else { t.tl_header_bg });
         ui.painter().text(r.min + vec2(16.0, 110.0), Align2::LEFT_CENTER, *title, Tokens::semibold(14.0), t.text);
@@ -56,7 +56,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let label = if primary { tl!("Join us on Discord") } else { crate::i18n::t(label) };
         let g = ui.painter().layout_no_wrap(label.to_string(), Tokens::ui(13.0), t.text);
         let r = Rect::from_min_size(pos2(x, rect.min.y + y + 18.0), vec2(g.size().x + 44.0, 34.0));
-        let resp = ui.interact(r, egui::Id::new(("imp-link", *id)), Sense::click()).on_hover_text(*url);
+        let resp = ui.interact(r, egui::Id::unique(("imp-link", *id)), Sense::click()).on_hover_text(*url);
         app.auto.add(&format!("import.link.{}", id.trim_start_matches("help.")), r, label);
         let (bg, fg) = if primary {
             (if resp.hovered() { t.accent_hover } else { t.accent }, Color32::WHITE)
@@ -92,7 +92,7 @@ fn recent(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, y: f32) -> f32
         let row =
             Rect::from_min_size(rect.min + vec2(16.0, y + 16.0 + i as f32 * RECENT_ROW_H), vec2(560.0_f32.min(rect.width() - 32.0).max(0.0), RECENT_ROW_H));
         let name = crate::menus::recent_name(path);
-        let resp = ui.interact(row, egui::Id::new(("imp-recent", i)), Sense::click()).on_hover_text(path.as_str());
+        let resp = ui.interact(row, egui::Id::unique(("imp-recent", i)), Sense::click()).on_hover_text(path.as_str());
         app.auto.add(&format!("import.recent.{i}"), row, &name);
         if resp.hovered() {
             ui.painter().rect_filled(row, 4.0, t.hover);
diff --git a/crates/ui-egui/src/panels/interchange_export.rs b/crates/ui-egui/src/panels/interchange_export.rs
index 5095d6813..c83e55a6a 100644
--- a/crates/ui-egui/src/panels/interchange_export.rs
+++ b/crates/ui-egui/src/panels/interchange_export.rs
@@ -29,7 +29,7 @@ struct Draft {
 }
 
 fn draft_id() -> egui::Id {
-    egui::Id::new("interchange-export-draft")
+    egui::Id::unique("interchange-export-draft")
 }
 
 const RATES: [u32; 4] = [32_000, 44_100, 48_000, 96_000];
@@ -64,14 +64,14 @@ pub fn is_open(ctx: &egui::Context) -> bool {
 
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(Some(mut d)) = ctx.data(|m| m.get_temp::<Option<Draft>>(draft_id())) else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("interchange-export-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("interchange-export-before-drag"), &mut d);
     let p = if d.omf { "omfExport" } else { "aafExport" };
     let mut close = false;
     let mut apply = false;
     let mut elems: Vec<(String, egui::Rect, String)> = Vec::new();
     let title = if d.omf { "OMF Export Settings" } else { "AAF Export Settings" };
     let shown = if d.omf { tl!("OMF Export Settings") } else { tl!("AAF Export Settings") };
-    egui::Window::new(shown).id(egui::Id::new(title)).collapsible(false).resizable(false).centered(ctx).show(ctx, |ui| {
+    egui::Window::new(shown).id(egui::Id::unique(title)).collapsible(false).resizable(false).centered(ctx).show(ctx, |ui| {
         ui.set_min_width(380.0);
         egui::Grid::new("interchange-export-grid").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
             if d.omf {
diff --git a/crates/ui-egui/src/panels/keyboard.rs b/crates/ui-egui/src/panels/keyboard.rs
index bdf744196..e4655370d 100644
--- a/crates/ui-egui/src/panels/keyboard.rs
+++ b/crates/ui-egui/src/panels/keyboard.rs
@@ -18,6 +18,7 @@
 //! | `timeline.nextScreen` / `timeline.prevScreen` | Show Next / Previous Screen | PageDown / PageUp (Timeline) |
 //! | `projectPanel.*` | Project panel: List / Icon / Toggle View, Hover Scrub, thumbnail size, Move / Extend Selection | (Project) |
 //! | `textPanel.*` | Text panel transcript: word / line / segment navigation and selection, Delete, Ripple Delete, Show Program Transcript | (Text) |
+//! | `mixer.showHideTracks` / `mixer.meterInputOnly` | Audio Track Mixer: Show/Hide Tracks / Meter Input(s) Only | Cmd+Alt+T / Ctrl+Shift+I (Audio Track Mixer) |
 //! | `graphics.beginTextEditing` | Begin Text Editing for a Graphic Layer | Cmd+Alt+' |
 //! | `help.filmcraftHelp` | Help (Premiere Help…) | F1 |
 //! | `app.quit` | Quit | Cmd+Q |
@@ -127,6 +128,8 @@ pub const COMMANDS: &[UiCommand] = &[
     uic!("textPanel.delete", "Delete", [], None),
     uic!("textPanel.rippleDelete", "Ripple Delete", [], None),
     uic!("textPanel.showProgramTranscript", "Show Program Transcript", [], None),
+    uic!("mixer.showHideTracks", "Show/Hide Tracks…", [], None),
+    uic!("mixer.meterInputOnly", "Meter Input(s) Only", [], None),
     uic!("graphics.beginTextEditing", "Begin Text Editing for a Graphic Layer", [], Some("Cmd+Alt+'")),
     uic!("help.filmcraftHelp", "FilmCraft Help…", ["Help"], Some("F1")),
     uic!("app.quit", "Quit FilmCraft", [], Some("Cmd+Q")),
@@ -208,6 +211,8 @@ pub fn route(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, params: &Val
             tv.target_scroll = (tv.target_scroll + d).max(0.0);
             Ok(json!({"scroll": tv.target_scroll}))
         }
+        "mixer.showHideTracks" => Ok(crate::panels::mixer::open_show_hide_tracks(app, ctx)),
+        "mixer.meterInputOnly" => crate::panels::mixer::set_meter_input_only(app, params),
         "graphics.beginTextEditing" => begin_text_editing(app),
         "help.filmcraftHelp" => {
             crate::links::open(app, ctx, HELP_URL);
@@ -233,10 +238,12 @@ pub fn route(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, params: &Val
 // ------------------------------------------------------------------ frames and panels
 
 /// Maximize `p`, or restore the layout when a panel is maximized (also the panel menu's Maximize /
-/// Restore Frame). A maximized panel that has since been closed counts as restored.
+/// Restore Frame). Only a docked panel maximizes; a maximized panel that has since been closed or
+/// floated counts as restored.
 pub(crate) fn toggle_maximize(app: &mut FilmcraftApp, p: PanelKind) -> Value {
-    let current = app.ui.keys.maximized.filter(|q| app.ui.dock.contains(*q) || app.ui.floating.iter().any(|g| g.panels.contains(q)));
-    app.ui.keys.maximized = if current.is_some() { None } else { Some(p) };
+    use crate::dock::LayoutExt as _;
+    let current = app.ui.keys.maximized.filter(|q| app.ui.dock.is_docked(*q));
+    app.ui.keys.maximized = if current.is_some() || !app.ui.dock.is_docked(p) { None } else { Some(p) };
     if let Some(p) = app.ui.keys.maximized {
         let _ = app.apply_dock(craft_ui::docking::Action::Activate { panel: p });
         app.ui.focused = p;
@@ -244,22 +251,27 @@ pub(crate) fn toggle_maximize(app: &mut FilmcraftApp, p: PanelKind) -> Value {
     json!({"maximized": app.ui.keys.maximized.map(|p| p.title())})
 }
 
-/// The visible panel under the pointer (from last frame's automation rects).
+/// The visible panel under the pointer (from last frame's automation rects). Each native
+/// floating window has its own coordinates, so only rects of the window holding the pointer
+/// count.
 fn panel_under_pointer(app: &FilmcraftApp, ctx: &egui::Context) -> Option<PanelKind> {
-    let pos = ctx.input(|i| i.pointer.latest_pos())?;
-    app.auto.query("panel.").into_iter().rev().find_map(|e| {
+    let panels = app.auto.query("panel.");
+    let pointer = |viewport| ctx.input_for(viewport, |i| i.pointer.latest_pos()).map(|pos| (viewport, pos));
+    let (viewport, pos) =
+        pointer(egui::ViewportId::ROOT).or_else(|| panels.iter().map(|e| e.viewport).filter(|v| *v != egui::ViewportId::ROOT).find_map(pointer))?;
+    panels.into_iter().rev().filter(|e| e.viewport == viewport).find_map(|e| {
         let r = egui::Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]));
         r.contains(pos).then(|| PanelKind::from_name(&e.id["panel.".len()..])).flatten()
     })
 }
 
-/// Visible panels in layout order (the active tab of each frame).
+/// Visible panels in layout order (the active tab of each frame), without the narrow Tools and
+/// Audio Meters strips, which panel cycling skips.
 fn visible_panels(app: &FilmcraftApp) -> Vec<PanelKind> {
-    let mut all = Vec::new();
-    app.ui.dock.panels(&mut all);
-    let mut visible: Vec<_> = all.into_iter().filter(|p| app.ui.dock.is_visible(*p) && !p.compact()).collect();
-    visible.extend(app.ui.floating.iter().filter_map(|group| group.panels.get(group.active).copied()).filter(|panel| !panel.compact()));
-    visible
+    use crate::dock::LayoutExt as _;
+    let mut v = app.ui.dock.visible_panels();
+    v.retain(|p| !matches!(p, PanelKind::Tools | PanelKind::AudioMeters));
+    v
 }
 
 fn cycle_panel(app: &mut FilmcraftApp, next: bool) -> Value {
@@ -278,7 +290,7 @@ fn focus_find_box(app: &mut FilmcraftApp, ctx: &egui::Context) -> Value {
     let p = app.ui.focused;
     let rect =
         app.auto.find(&format!("panel.{}", p.id())).map(|e| egui::Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])));
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new(FOCUS_SEARCH), rect.unwrap_or(egui::Rect::EVERYTHING)));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique(FOCUS_SEARCH), rect.unwrap_or(egui::Rect::EVERYTHING)));
     json!({"panel": p.title()})
 }
 
@@ -287,7 +299,7 @@ pub const FOCUS_SEARCH: &str = "fc-focus-search";
 
 /// Called by search fields: take focus when Select Find Box targets the panel they sit in.
 pub fn take_search_focus(ui: &egui::Ui, field: egui::Rect, resp: &egui::Response) {
-    let id = egui::Id::new(FOCUS_SEARCH);
+    let id = egui::Id::unique(FOCUS_SEARCH);
     let Some(panel) = ui.ctx().data(|d| d.get_temp::<egui::Rect>(id)) else { return };
     if panel.contains(field.center()) {
         resp.request_focus();
@@ -355,7 +367,8 @@ fn begin_text_editing(app: &mut FilmcraftApp) -> Result<Value, String> {
     let len = pick["text"].as_str().map_or(0, str::len);
     app.session.execute("graphics.selectLayer", json!({"clip": clip, "layers": [layer]})).map_err(|e| e.to_string())?;
     // like Premiere, the whole text is selected so typing replaces it
-    app.ui.gfx_edit = Some(crate::state::GfxEdit { clip, layer, caret: len, anchor: 0 });
+    app.restart_ime_target();
+    app.ui.gfx_edit = Some(crate::state::GfxEdit { clip, layer, caret: len, anchor: 0, ..Default::default() });
     app.show_panel(PanelKind::Program);
     Ok(json!({"clip": clip, "layer": layer}))
 }
diff --git a/crates/ui-egui/src/panels/lumetri.rs b/crates/ui-egui/src/panels/lumetri.rs
index 084d7d81a..bd42b5d2c 100644
--- a/crates/ui-egui/src/panels/lumetri.rs
+++ b/crates/ui-egui/src/panels/lumetri.rs
@@ -17,6 +17,7 @@ use crate::FilmcraftApp;
 use crate::icons::{self, Icon};
 use crate::native_dialogs::FileDialog;
 use crate::theme::Tokens;
+use crate::widgets::HotNumberOptions;
 
 type Actions = Vec<Value>;
 
@@ -127,7 +128,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         if open_section(ui, app, &e, "Curves", "curves_on", "curves", &mut sections) {
             sub(ui, &t, tl!("RGB Curves"));
-            let key = egui::Id::new("lumetri-curve-channel");
+            let key = egui::Id::unique("lumetri-curve-channel");
             let mut ch: usize = ui.data(|d| d.get_temp(key)).unwrap_or(0);
             ui.horizontal(|ui| {
                 for (i, c) in
@@ -345,7 +346,7 @@ fn section(ui: &mut egui::Ui, app: &mut FilmcraftApp, name: &str, on: bool) -> (
     ui.painter().text(pos2(r.min.x + 20.0, r.center().y), Align2::LEFT_CENTER, crate::i18n::t(name), Tokens::semibold(13.0), t.text);
     // enable switch (section bypass)
     let sw = Rect::from_center_size(pos2(r.max.x - 18.0, r.center().y), vec2(26.0, 14.0));
-    let sw_resp = ui.interact(sw.expand(3.0), egui::Id::new(("lumetri-switch", name)), Sense::click());
+    let sw_resp = ui.interact(sw.expand(3.0), egui::Id::unique(("lumetri-switch", name)), Sense::click());
     ui.painter().rect_filled(sw, 7.0, if on { t.accent } else { Color32::from_rgb(0x55, 0x55, 0x55) });
     ui.painter().circle_filled(pos2(if on { sw.max.x - 7.0 } else { sw.min.x + 7.0 }, sw.center().y), 5.0, Color32::WHITE);
     app.auto.add(&format!("lumetri.switch.{name}"), sw.expand(3.0), &format!("{name} on/off"));
@@ -421,7 +422,7 @@ fn slider(
     let f = ((v - soft_min) / (soft_max - soft_min)).clamp(0.0, 1.0) as f32;
     let kx = track.min.x + f * track.width();
     let hit = Rect::from_min_max(pos2(track.min.x - 6.0, row.min.y), pos2(track.max.x + 6.0, row.max.y));
-    let resp = ui.interact(hit, egui::Id::new(("lslider", clip.0, id)), Sense::click_and_drag());
+    let resp = ui.interact(hit, egui::Id::unique(("lslider", clip.0, id)), Sense::click_and_drag());
     ui.painter().circle_filled(pos2(kx, track.center().y), 5.0, t.panel_bg);
     ui.painter().circle_stroke(
         pos2(kx, track.center().y),
@@ -443,8 +444,13 @@ fn slider(
             .max_rect(Rect::from_min_max(pos2(row.max.x - 52.0, row.min.y + 3.0), pos2(row.max.x, row.max.y - 3.0)))
             .layout(egui::Layout::right_to_left(egui::Align::Center)),
     );
-    let (_, nv) =
-        crate::widgets::hot_number(&mut vui, egui::Id::new(("lval", clip.0, id)), v, (soft_max - soft_min) / 300.0, (min, max), decimals as usize, "", t);
+    let (_, nv) = crate::widgets::hot_number(
+        &mut vui,
+        label,
+        egui::Id::unique(("lval", clip.0, id)),
+        v,
+        HotNumberOptions::new((soft_max - soft_min) / 300.0, (min, max), decimals as usize, "", t),
+    );
     if let Some(nv) = out.or(nv) {
         actions.push(json!({"clip": clip.0, "effect": idx, "param": id, "value": (nv * 10f64.powi(decimals as i32)).round() / 10f64.powi(decimals as i32)}));
     }
@@ -510,7 +516,7 @@ fn curve_editor(ui: &mut egui::Ui, e: &EffectInstance, id: &str, hue: bool, col:
     };
     let line: Vec<Pos2> = lut.iter().enumerate().map(|(i, y)| to_screen([i as f32 / 127.0, y.clamp(0.0, 1.0)])).collect();
     p.add(egui::Shape::line(line, Stroke::new(1.5, col)));
-    let drag_key = egui::Id::new(("curve-drag", clip.0, id));
+    let drag_key = egui::Id::unique(("curve-drag", clip.0, id));
     let mut dragging: Option<usize> = ui.data(|d| d.get_temp(drag_key));
     let mut new_pts = pts.clone();
     let mut changed = false;
@@ -612,7 +618,7 @@ fn color_wheel(ui: &mut egui::Ui, e: &EffectInstance, mt: Tick, id: &str, lid: &
     p.rect_filled(track, 2.0, Color32::from_rgb(0x4b, 0x4b, 0x4b));
     let ky = track.center().y - l / 100.0 * track.height() / 2.0;
     p.circle_stroke(pos2(track.center().x, ky), 4.0, Stroke::new(1.5, Color32::from_rgb(0xb0, 0xb0, 0xb0)));
-    let lr = ui.interact(track.expand2(vec2(6.0, 0.0)), egui::Id::new(("wl", clip.0, lid)), Sense::click_and_drag());
+    let lr = ui.interact(track.expand2(vec2(6.0, 0.0)), egui::Id::unique(("wl", clip.0, lid)), Sense::click_and_drag());
     if (lr.dragged() || lr.clicked())
         && let Some(pos) = lr.interact_pointer_pos()
     {
@@ -627,8 +633,8 @@ fn color_wheel(ui: &mut egui::Ui, e: &EffectInstance, mt: Tick, id: &str, lid: &
 fn match_controls(ui: &mut egui::Ui, app: &mut FilmcraftApp, out: &mut Vec<(&'static str, Value)>) {
     let t = app.tokens;
     sub(ui, &t, tl!("Color Match"));
-    let key = egui::Id::new("lumetri-match-ref");
-    let fd_key = egui::Id::new("lumetri-match-face");
+    let key = egui::Id::unique("lumetri-match-ref");
+    let fd_key = egui::Id::unique("lumetri-match-face");
     let mut tc: String = ui.data(|d| d.get_temp(key)).unwrap_or_else(|| "00:00:00:00".to_string());
     let mut face: bool = ui.data(|d| d.get_temp(fd_key)).unwrap_or(true);
     // Comparison View: the Program monitor shows the reference frame next to the current one, and
@@ -645,7 +651,7 @@ fn match_controls(ui: &mut egui::Ui, app: &mut FilmcraftApp, out: &mut Vec<(&'st
     }
     ui.horizontal(|ui| {
         ui.add_sized(vec2(110.0, 20.0), egui::Label::new(egui::RichText::new(tl!("Reference")).color(t.text_dim)));
-        let r = ui.add(egui::TextEdit::singleline(&mut tc).desired_width(96.0));
+        let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut tc).desired_width(96.0)), "Reference timecode");
         app.auto.add("lumetri.match.reference", r.rect, "Reference timecode");
     });
     let r = ui.checkbox(&mut face, tl!("Face Detection (protect skin tones)"));
diff --git a/crates/ui-egui/src/panels/masks.rs b/crates/ui-egui/src/panels/masks.rs
index a25e93643..d4f6c61d1 100644
--- a/crates/ui-egui/src/panels/masks.rs
+++ b/crates/ui-egui/src/panels/masks.rs
@@ -1,13 +1,14 @@
 //! Effect masks in the UI: the mask rows of Effect Controls (create ellipse / 4-point polygon /
 //! pen masks, per-mask Path / Feather / Opacity / Expansion / Inverted / mode) and on-monitor
 //! editing on the Program monitor (drag vertices, Bézier handles, the whole mask, feather,
-//! expansion and corner-roundness handles; the pen places a free-draw Bézier mask).
+//! expansion and corner-roundness handles; a marquee or Shift-click selects several vertices,
+//! which move together; the pen places a free-draw Bézier mask).
 //!
 //! Automation ids: `effectControls.<effect>.mask.{ellipse,polygon,pen}`,
 //! `effectControls.<effect>.mask<k>` (+ `.mode`, `.inverted`, `.delete`, and the parameter rows
 //! `effectControls.<effect>.mask<k>.<param>.*`), `program.mask.vertex.<i>`, `program.mask.in.<i>`,
 //! `program.mask.out.<i>`, `program.mask.body`, `program.mask.feather`, `program.mask.expansion`,
-//! `program.mask.roundness`, `program.maskPen`.
+//! `program.mask.roundness`, `program.mask.marquee`, `program.maskPen`.
 
 use egui::{Align2, Color32, Pos2, Rect, Sense, Stroke, pos2, vec2};
 use filmcraft_geom::{Affine, Vec2};
@@ -57,7 +58,7 @@ pub(crate) fn effect_rows(
     .enumerate()
     {
         let br = Rect::from_center_size(pos2(r.min.x + 40.0 + i as f32 * 24.0, r.center().y), vec2(20.0, 18.0));
-        let resp = ui.interact(br, egui::Id::new(("mask-new", clip.0, idx, kind)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(br, egui::Id::unique(("mask-new", clip.0, idx, kind)), Sense::click()).on_hover_text(tip);
         if resp.hovered() {
             ui.painter().rect_filled(br, 3.0, t.hover);
         }
@@ -90,7 +91,7 @@ pub(crate) fn effect_rows(
         crate::panels::effect_controls::row_line(ui, r, lane, &t);
         let tw = Rect::from_center_size(pos2(r.min.x + 26.0, r.center().y), vec2(10.0, 10.0));
         icons::paint(ui.painter(), tw, if open { Icon::ChevronDown } else { Icon::ChevronRight }, t.text_dim);
-        let twresp = ui.interact(tw.expand(3.0), egui::Id::new(("mask-twirl", clip.0, idx, k)), Sense::click());
+        let twresp = ui.interact(tw.expand(3.0), egui::Id::unique(("mask-twirl", clip.0, idx, k)), Sense::click());
         // shape glyph: ellipse for smooth paths, square for polygons
         let path = m.path_at(mt);
         let glyph = Rect::from_center_size(pos2(r.min.x + 42.0, r.center().y), vec2(12.0, 12.0));
@@ -118,13 +119,15 @@ pub(crate) fn effect_rows(
         let mut mui = ui.new_child(egui::UiBuilder::new().max_rect(mr).layout(egui::Layout::left_to_right(egui::Align::Center)));
         let mut mode = m.mode;
         crate::panels::effect_controls::fit_to_row(&mut mui);
-        egui::ComboBox::from_id_salt(("mask-mode", clip.0, idx, k)).selected_text(crate::i18n::t(mode.label())).width(88.0).show_ui(&mut mui, |ui| {
-            for md in MaskMode::ALL {
-                if ui.selectable_value(&mut mode, md, crate::i18n::t(md.label())).changed() {
-                    actions.push(("masks.set".into(), json!({"clip": clip.0, "effect": idx, "mask": k, "mode": md.label()})));
+        let combo =
+            egui::ComboBox::from_id_salt(("mask-mode", clip.0, idx, k)).selected_text(crate::i18n::t(mode.label())).width(88.0).show_ui(&mut mui, |ui| {
+                for md in MaskMode::ALL {
+                    if ui.selectable_value(&mut mode, md, crate::i18n::t(md.label())).changed() {
+                        actions.push(("masks.set".into(), json!({"clip": clip.0, "effect": idx, "mask": k, "mode": md.label()})));
+                    }
                 }
-            }
-        });
+            });
+        crate::widgets::accessible_name(combo.response, "Mask mode");
         app.auto.add(&format!("{base}.mode"), mr, "Mask mode");
         if twresp.clicked() {
             if open {
@@ -166,7 +169,7 @@ pub(crate) fn effect_rows(
         let mut cui = ui.new_child(egui::UiBuilder::new().max_rect(cr).layout(egui::Layout::left_to_right(egui::Align::Center)));
         crate::panels::effect_controls::fit_to_row(&mut cui);
         let mut inv = m.inverted;
-        if cui.checkbox(&mut inv, "").changed() {
+        if crate::widgets::accessible_name(cui.checkbox(&mut inv, ""), "Invert").changed() {
             actions.push(("masks.set".into(), json!({"clip": clip.0, "effect": idx, "mask": k, "inverted": inv})));
         }
         app.auto.add(&format!("{base}.inverted"), cr, "Inverted");
@@ -286,7 +289,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
         }
         v
     };
-    let gesture_id = egui::Id::new("mask-gesture");
+    let gesture_id = egui::Id::unique("mask-gesture");
     // one gesture (undo step) per pointer press
     let mut gesture: u64 = ui.data(|d| d.get_temp(gesture_id)).unwrap_or(0);
     if ui.input(|i| i.pointer.any_pressed()) {
@@ -297,17 +300,40 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
         let v = lin_inv.apply(Vec2::new(d.x as f64, d.y as f64));
         [v.x, v.y]
     };
+    // ---- vertex marquee: a drag that starts on the picture outside the shape (under every
+    // handle, so they come first; Selection tool only, the Hand pans). It sits over the graphics
+    // overlay, so it leaves graphic layers to it and takes over its click on empty space. Where the
+    // marquee started (stored for the gesture, until the button is up) keeps it registered over a
+    // layer through the release.
+    let marquee_id = egui::Id::unique("mask-marquee");
+    let marquee_from = egui::Id::unique("mask-marquee-from");
+    let selection_tool = app.ui.tool == crate::state::Tool::Selection;
+    if !ui.input(|i| i.pointer.primary_down() || i.pointer.primary_released()) {
+        ui.data_mut(|d| d.remove::<Pos2>(marquee_from));
+    }
+    let marquee_on = ui.data(|d| d.get_temp::<Pos2>(marquee_from)).is_some();
+    let on_layer = |p: Pos2| pic.contains(p) && crate::panels::graphics::visible_layers(app, pic, frame).iter().any(|v| v.hit(p));
+    let marquee = (selection_tool && (marquee_on || !ui.input(|i| i.pointer.hover_pos()).is_some_and(on_layer)))
+        .then(|| ui.interact(pic, marquee_id, Sense::click_and_drag()));
+    if let Some(r) = &marquee {
+        app.auto.add("program.mask.marquee", pic, "Mask vertex marquee");
+        if r.clicked() {
+            crate::panels::graphics::deselect_on_monitor(app, ui);
+        }
+    }
     // ---- whole mask (drag inside)
     let bb = Rect::from_points(&screen).expand(2.0).intersect(pic);
-    let body = ui.interact(bb, egui::Id::new("mask-body"), Sense::click_and_drag());
+    let body = ui.interact(bb, egui::Id::unique("mask-body"), Sense::click_and_drag());
     app.auto.add("program.mask.body", bb, &m.name);
     let ptr_in = |p: Option<Pos2>| p.is_some_and(|p| inside(&flat, to_clip.apply(Vec2::new(p.x as f64, p.y as f64))));
     if body.drag_started_by(LEFT) {
         let ok = ptr_in(body.interact_pointer_pos());
         ui.data_mut(|d| d.insert_temp(gesture_id.with("body"), ok));
     }
+    // (inside the outline's box but outside the shape, the drag is a marquee too)
+    let body_marquee = selection_tool && !ui.data(|d| d.get_temp::<bool>(gesture_id.with("body"))).unwrap_or(false);
     if body.dragged_by(LEFT) && ui.data(|d| d.get_temp::<bool>(gesture_id.with("body"))).unwrap_or(false) && body.drag_delta() != egui::Vec2::ZERO {
-        let d = drag_step(ui, egui::Id::new(("mask-body-drag", gesture)), body.drag_delta());
+        let d = drag_step(ui, egui::Id::unique(("mask-body-drag", gesture)), body.drag_delta());
         if d != egui::Vec2::ZERO {
             actions.push(("masks.translate".into(), with(json!({"delta": clip_delta(d), "merge": format!("body-{gesture}")}))));
         }
@@ -345,7 +371,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
                     Stroke::NONE,
                 ));
             }
-            let r = ui.interact(hr.expand(3.0), egui::Id::new(("mask-handle", which)), Sense::drag());
+            let r = ui.interact(hr.expand(3.0), egui::Id::unique(("mask-handle", which)), Sense::drag());
             app.auto.add(&format!("program.mask.{which}"), hr, if which == "feather" { "Mask Feather" } else { "Mask Expansion" });
             if r.dragged_by(LEFT) && r.drag_delta() != egui::Vec2::ZERO {
                 let d = clip_delta(r.drag_delta());
@@ -359,10 +385,14 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
     // ---- corner roundness (masks with sharp corners: rectangles, polygons)
     actions.extend(roundness_handle(app, ui, &painter, &path, &to_screen, &target));
     // ---- tangent handles and vertices
-    let sel_v_id = egui::Id::new(("mask-sel-vertex", sel.clip.0, sel.effect, sel.mask));
-    let sel_v: Option<usize> = ui.data(|d| d.get_temp(sel_v_id));
+    let sel_v_id = egui::Id::unique(("mask-sel-vertex", sel.clip.0, sel.effect, sel.mask));
+    let n_v = path.vertices.len();
+    // (stored with the vertex count: once a vertex is added or deleted, by any edit or by undo, the
+    // indices name other vertices and the selection goes)
+    let mut sel_vs: Vec<usize> = ui.data(|d| d.get_temp::<(usize, Vec<usize>)>(sel_v_id)).filter(|(n, _)| *n == n_v).map(|(_, v)| v).unwrap_or_default();
     let alt = ui.input(|i| i.modifiers.alt);
     let cmd = ui.input(|i| i.modifiers.command);
+    let shift = ui.input(|i| i.modifiers.shift);
     for (i, v) in path.vertices.iter().enumerate() {
         if v.is_corner() {
             continue;
@@ -374,7 +404,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
             painter.circle_filled(h, 3.5, Color32::WHITE);
             painter.circle_stroke(h, 3.5, Stroke::new(1.0, col));
             let hr = Rect::from_center_size(h, vec2(8.0, 8.0));
-            let r = ui.interact(hr.expand(2.0), egui::Id::new(("mask-tan", which, i)), Sense::drag());
+            let r = ui.interact(hr.expand(2.0), egui::Id::unique(("mask-tan", which, i)), Sense::drag());
             app.auto.add(&format!("program.mask.{which}.{i}"), hr, "Bezier handle");
             if r.dragged_by(LEFT) && r.drag_delta() != egui::Vec2::ZERO {
                 actions.push((
@@ -387,22 +417,32 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
     for (i, v) in path.vertices.iter().enumerate() {
         let p = sp(&to_screen, v.p);
         let vr = Rect::from_center_size(p, vec2(7.0, 7.0));
-        let selected = sel_v == Some(i);
+        let selected = sel_vs.contains(&i);
         painter.rect_filled(vr, 0.0, if selected { col } else { Color32::WHITE });
         painter.rect_stroke(vr, 0.0, Stroke::new(1.0, col), egui::StrokeKind::Middle);
-        let r = ui.interact(vr.expand(3.0), egui::Id::new(("mask-vertex", i)), Sense::click_and_drag()).on_hover_text(if cfg!(target_os = "macos") {
+        let r = ui.interact(vr.expand(3.0), egui::Id::unique(("mask-vertex", i)), Sense::click_and_drag()).on_hover_text(if cfg!(target_os = "macos") {
             tl!("Drag: move · Alt-click: smooth/corner · Cmd-click: delete")
         } else {
             tl!("Drag: move · Alt-click: smooth/corner · Ctrl-click: delete")
         });
         app.auto.add(&format!("program.mask.vertex.{i}"), vr, "Mask vertex");
-        if r.drag_started_by(LEFT) {
-            ui.data_mut(|d| d.insert_temp(sel_v_id, i));
+        // dragging a selected vertex moves the whole selection; another one is selected first
+        // (added to it with Shift)
+        if r.drag_started_by(LEFT) && !selected {
+            if !shift {
+                sel_vs.clear();
+            }
+            sel_vs.push(i);
+            ui.data_mut(|d| d.insert_temp(sel_v_id, (n_v, sel_vs.clone())));
         }
         if r.dragged_by(LEFT) && r.drag_delta() != egui::Vec2::ZERO {
-            let d = drag_step(ui, egui::Id::new(("mask-vertex-drag", gesture, i)), r.drag_delta());
+            let d = drag_step(ui, egui::Id::unique(("mask-vertex-drag", gesture, i)), r.drag_delta());
             if d != egui::Vec2::ZERO {
-                actions.push(("masks.moveVertex".into(), with(json!({"vertex": i, "delta": clip_delta(d), "merge": format!("vertex-{gesture}")}))));
+                let which = if sel_vs.len() > 1 && sel_vs.contains(&i) { json!({"vertices": sel_vs}) } else { json!({"vertex": i}) };
+                let mut p = with(which);
+                p["delta"] = json!(clip_delta(d));
+                p["merge"] = json!(format!("vertex-{gesture}"));
+                actions.push(("masks.moveVertex".into(), p));
             }
         }
         if r.clicked() {
@@ -411,10 +451,44 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
             } else if cmd {
                 actions.push(("masks.removeVertex".into(), with(json!({"vertex": i}))));
             } else {
-                ui.data_mut(|d| d.insert_temp(sel_v_id, i));
+                if !shift {
+                    sel_vs.clear();
+                }
+                if let Some(k) = sel_vs.iter().position(|v| *v == i) {
+                    sel_vs.remove(k);
+                } else {
+                    sel_vs.push(i);
+                }
+                ui.data_mut(|d| d.insert_temp(sel_v_id, (n_v, sel_vs.clone())));
             }
         }
     }
+    // the marquee selects the vertices inside it on release (Shift adds them to the selection)
+    let mq = marquee.iter().chain(body_marquee.then_some(&body));
+    let (started, dragging, stopped) =
+        mq.fold((false, false, false), |(a, b, c), r| (a || r.drag_started_by(LEFT), b || r.dragged_by(LEFT), c || r.drag_stopped_by(LEFT)));
+    if started && let Some(o) = ui.input(|i| i.pointer.press_origin()) {
+        ui.data_mut(|d| d.insert_temp(marquee_from, o));
+    }
+    let from: Option<Pos2> = ui.data(|d| d.get_temp(marquee_from));
+    if let (Some(o), Some(p)) = (from.filter(|_| dragging || stopped), ui.input(|i| i.pointer.latest_pos())) {
+        let r = Rect::from_two_pos(o, p);
+        if stopped {
+            ui.data_mut(|d| d.remove::<Pos2>(marquee_from));
+            if !shift {
+                sel_vs.clear();
+            }
+            for (i, v) in path.vertices.iter().enumerate() {
+                if r.contains(sp(&to_screen, v.p)) && !sel_vs.contains(&i) {
+                    sel_vs.push(i);
+                }
+            }
+            ui.data_mut(|d| d.insert_temp(sel_v_id, (n_v, sel_vs.clone())));
+        } else {
+            painter.rect_filled(r, 0.0, col.gamma_multiply(0.15));
+            painter.rect_stroke(r, 0.0, Stroke::new(1.0, col), egui::StrokeKind::Middle);
+        }
+    }
     // Cmd-click on an edge adds a vertex there
     if cmd
         && body.clicked()
@@ -522,7 +596,7 @@ fn roundness_handle(
         (pa.x + pa.y).total_cmp(&(pb.x + pb.y))
     })?;
     let max_radius = corners.iter().map(|c| c.max_radius).fold(0.0, f64::max);
-    let id = egui::Id::new("mask-roundness");
+    let id = egui::Id::unique("mask-roundness");
     let dist_id = id.with("dist");
     let dragging = ui.ctx().is_being_dragged(id);
     let dist: f64 = if dragging { ui.data(|d| d.get_temp(dist_id)).unwrap_or(0.0) } else { 0.0 };
@@ -615,7 +689,7 @@ fn pen_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, frame: (u32
     let Some(to_screen) = clip_to_screen(app, &it, mt, pic, frame) else { return };
     let Some(to_clip) = to_screen.inverse() else { return };
     let col = Color32::from_rgb(0x5a, 0xb4, 0xff);
-    let resp = ui.interact(pic, egui::Id::new("mask-pen"), Sense::click_and_drag());
+    let resp = ui.interact(pic, egui::Id::unique("mask-pen"), Sense::click_and_drag());
     app.auto.add("program.maskPen", pic, "Pen mask");
     if resp.hovered() {
         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
@@ -630,7 +704,7 @@ fn pen_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, frame: (u32
         _ => p,
     };
     let mut commit = false;
-    let pressed = resp.drag_started_by(LEFT) || (resp.clicked() && !ui.data(|m| m.get_temp::<bool>(egui::Id::new("mask-pen-placed")).unwrap_or(false)));
+    let pressed = resp.drag_started_by(LEFT) || (resp.clicked() && !ui.data(|m| m.get_temp::<bool>(egui::Id::unique("mask-pen-placed")).unwrap_or(false)));
     if pressed && let Some(p) = resp.interact_pointer_pos() {
         let near_first = d.points.first().is_some_and(|f| (sp(&to_screen, Vec2::new(f[0], f[1])) - p).length() < 8.0);
         if d.points.len() >= 3 && near_first {
@@ -640,11 +714,11 @@ fn pen_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, frame: (u32
             d.points.push([c.x, c.y, 0.0, 0.0]);
             // read the response before data_mut: it locks the context that drag_started_by reads
             let dragging = resp.drag_started_by(LEFT);
-            ui.data_mut(|m| m.insert_temp(egui::Id::new("mask-pen-placed"), dragging));
+            ui.data_mut(|m| m.insert_temp(egui::Id::unique("mask-pen-placed"), dragging));
         }
     }
     if resp.clicked() || resp.drag_stopped() {
-        ui.data_mut(|m| m.insert_temp(egui::Id::new("mask-pen-placed"), false));
+        ui.data_mut(|m| m.insert_temp(egui::Id::unique("mask-pen-placed"), false));
     }
     if resp.dragged_by(LEFT)
         && !commit
diff --git a/crates/ui-egui/src/panels/media_browser.rs b/crates/ui-egui/src/panels/media_browser.rs
index 180f44a33..65b0e4c9b 100644
--- a/crates/ui-egui/src/panels/media_browser.rs
+++ b/crates/ui-egui/src/panels/media_browser.rs
@@ -53,8 +53,9 @@ const PREVIEW_BASE: u64 = 1 << 44;
 const CACHE_SECS: f64 = 3.0;
 const ROW_H: f32 = 22.0;
 
+/// Temp-store key for the Media Browser cache: listings stay fresh for 3 s and preview texture ids start at `PREVIEW_BASE`.
 fn cache_id() -> egui::Id {
-    egui::Id::new("media-browser-cache")
+    egui::Id::unique("media-browser-cache")
 }
 
 fn with_cache<R>(ctx: &egui::Context, f: impl FnOnce(&mut Cache) -> R) -> R {
@@ -106,7 +107,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     ];
     for (icon, id, tip, enabled) in nav {
         let r = Rect::from_min_size(pos2(x, bar.min.y), vec2(24.0, 24.0));
-        let resp = ui.interact(r, egui::Id::new(("mb-nav", id)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("mb-nav", id)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("mediaBrowser.{id}"), r, tip);
         if resp.hovered() && enabled {
             ui.painter().rect_filled(r, 3.0, t.hover);
@@ -122,7 +123,10 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let pw = (bar.max.x - x - 290.0).max(80.0);
     let pr = Rect::from_min_size(pos2(x + 4.0, bar.min.y + 1.0), vec2(pw, 22.0));
     let mut path = app.ui.media_browser.path_edit.clone().unwrap_or_else(|| dir.clone());
-    let resp = ui.put(pr, egui::TextEdit::singleline(&mut path).id(egui::Id::new("mb-path")).font(egui::FontId::proportional(11.5)));
+    let resp = crate::widgets::accessible_name(
+        ui.put(pr, egui::TextEdit::singleline(&mut path).id(egui::Id::unique("mb-path")).font(egui::FontId::proportional(11.5))),
+        "Path",
+    );
     app.auto.add("mediaBrowser.path", pr, "Path");
     if resp.changed() {
         app.ui.media_browser.path_edit = Some(path.clone());
@@ -138,7 +142,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // file types
     let fr = Rect::from_min_size(pos2(x, bar.min.y + 1.0), vec2(150.0, 22.0));
     let label = mb::FILE_TYPES.iter().find(|f| f.0 == prefs.file_types).map(|f| f.1.to_string()).unwrap_or_else(|| format!(".{}", prefs.file_types));
-    let fresp = crate::widgets::dropdown_text(ui, fr, &label, &t, egui::Id::new("mb-types")).on_hover_text(tl!("File Types Displayed"));
+    let fresp = crate::widgets::dropdown_text(ui, fr, &label, &t, egui::Id::unique("mb-types")).on_hover_text(tl!("File Types Displayed"));
     app.auto.add("mediaBrowser.fileTypes", fr, "File Types Displayed");
     egui::Popup::menu(&fresp).show(|ui| {
         for (k, l) in mb::FILE_TYPES {
@@ -162,7 +166,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     x = fr.max.x + 6.0;
     for (icon, v, tip) in [(Icon::ListView, "list", tl!("List View")), (Icon::IconView, "thumbnails", tl!("Thumbnail View"))] {
         let r = Rect::from_min_size(pos2(x, bar.min.y), vec2(24.0, 24.0));
-        let resp = ui.interact(r, egui::Id::new(("mb-view", v)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("mb-view", v)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("mediaBrowser.view.{v}"), r, tip);
         if prefs.view == v {
             ui.painter().rect_filled(r, 3.0, t.pressed);
@@ -203,7 +207,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let list_r = Rect::from_min_max(pos2(tree_r.max.x + 4.0, body.min.y), body.max);
     // splitter
     let split = Rect::from_min_max(pos2(tree_r.max.x, body.min.y), pos2(tree_r.max.x + 4.0, body.max.y));
-    let sresp = ui.interact(split, egui::Id::new("mb-split"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
+    let sresp = ui.interact(split, egui::Id::unique("mb-split"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
     if sresp.dragged() {
         app.ui.media_browser.tree_width = (tw + sresp.drag_delta().x).clamp(100.0, (rect.width() * 0.7).max(100.0));
     }
@@ -233,7 +237,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let resp = ui.put(sr, egui::Slider::new(&mut sz, 60.0..=320.0).show_value(false));
         app.auto.add("mediaBrowser.thumbnailSize", sr, "Thumbnail size");
         // a drag ended by Escape goes back to the size it started from (#580)
-        let orig_id = egui::Id::new("media-browser-thumbnail-size-before-drag");
+        let orig_id = egui::Id::unique("media-browser-thumbnail-size-before-drag");
         if resp.drag_started() {
             ui.data_mut(|d| d.insert_temp(orig_id, prefs.thumbnail_size));
         }
@@ -573,12 +577,12 @@ fn list(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, entries: &[Entry], c
     let hp = ui.painter().with_clip_rect(header.intersect(ui.clip_rect()));
     hp.rect_filled(header, 0.0, t.panel_bg);
     hp.line_segment([header.left_bottom(), header.right_bottom()], Stroke::new(1.0, t.separator));
-    let mut x = header.min.x + 4.0 - out.state.offset.x;
+    let mut x = header.min.x + 4.0 - out.state.clamped_offset().x;
     for (c, w) in columns.iter().zip(&widths) {
         let cr = Rect::from_min_size(pos2(x, header.min.y), vec2(*w, 20.0));
         hp.text(pos2(cr.min.x + 4.0, cr.center().y), Align2::LEFT_CENTER, crate::i18n::t(c), Tokens::ui(11.0), t.text_dim);
         if cr.intersects(header) {
-            let resp = ui.interact(cr.intersect(header), egui::Id::new(("mb-col", c)), Sense::click());
+            let resp = ui.interact(cr.intersect(header), egui::Id::unique(("mb-col", c)), Sense::click());
             app.auto.add(&format!("mediaBrowser.header.{c}"), cr.intersect(header), c);
             resp.context_menu(|ui| {
                 if ui.button(tl!("Edit Columns…")).clicked() {
@@ -656,7 +660,7 @@ fn thumbnails(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, entries: &[Ent
             let (row, _) = ui.allocate_exact_size(vec2(ui.available_width(), cell.y), Sense::hover());
             for (k, e) in chunk.iter().enumerate() {
                 let tr = Rect::from_min_size(pos2(row.min.x + 8.0 + k as f32 * cell.x, row.min.y + 6.0), vec2(size, th_h));
-                let resp = ui.interact(tr.expand(2.0), egui::Id::new(("mb-thumb", &e.path)), Sense::click_and_drag());
+                let resp = ui.interact(tr.expand(2.0), egui::Id::unique(("mb-thumb", &e.path)), Sense::click_and_drag());
                 let sel = app.session.browser.selection.contains(&e.path);
                 ui.painter().rect_filled(tr, 3.0, Color32::from_gray(14));
                 if sel {
@@ -815,7 +819,7 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut close = false;
     let mut ok = false;
     egui::Window::new(tl!("Edit Columns"))
-        .id(egui::Id::new("mb-edit-columns"))
+        .id(egui::Id::unique("mb-edit-columns"))
         .collapsible(false)
         .resizable(false)
         .pivot(Align2::CENTER_CENTER)
diff --git a/crates/ui-egui/src/panels/media_dialogs.rs b/crates/ui-egui/src/panels/media_dialogs.rs
index 3a2dcb0ec..629ffee48 100644
--- a/crates/ui-egui/src/panels/media_dialogs.rs
+++ b/crates/ui-egui/src/panels/media_dialogs.rs
@@ -84,7 +84,7 @@ pub fn route(app: &mut FilmcraftApp, id: &str, params: &Value) -> Option<Result<
             let exts: Vec<&str> = filmcraft_media::VIDEO_EXTENSIONS.to_vec();
             let hint = RelinkHint { command: id.to_string(), params: json!({"item": item.0}) };
             let id = id.to_string();
-            Some(app.pick(FileDialog::Relink { exts: exts.iter().map(|e| e.to_string()).collect(), hint }, move |app, paths| {
+            Some(app.pick(FileDialog::Relink { exts: exts.iter().map(ToString::to_string).collect(), hint }, move |app, paths| {
                 let Some(picked) = paths.into_iter().next() else { return Ok(Value::Null) };
                 app.session.execute(&id, json!({"item": item.0, "path": picked})).map_err(|e| e.to_string())
             }))
@@ -129,7 +129,7 @@ fn match_params(d: &LinkMediaDraft) -> Value {
 }
 
 fn preview_texture(app: &FilmcraftApp, ctx: &egui::Context, path: &str) -> Option<egui::TextureHandle> {
-    let key = egui::Id::new(("link-preview", path));
+    let key = egui::Id::unique(("link-preview", path));
     if let Some(t) = ctx.data(|d| d.get_temp::<Option<egui::TextureHandle>>(key)) {
         return t;
     }
@@ -161,7 +161,7 @@ fn link_media(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let rows_max_h = (ctx.content_rect().height() * 0.3).clamp(90.0, 320.0);
     let width = (ctx.content_rect().width() - 40.0).clamp(1.0, 760.0);
     egui::Window::new(tl!("Link Media"))
-        .id(egui::Id::new("Link Media"))
+        .id(egui::Id::unique("Link Media"))
         .collapsible(false)
         .resizable(false)
         .default_width(width)
@@ -217,7 +217,10 @@ fn link_media(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 ui.separator();
                 ui.horizontal_wrapped(|ui| {
                     ui.label(tl!("Search in:"));
-                    let r = ui.add(egui::TextEdit::singleline(&mut d.folder).desired_width((ui.available_width() * 0.5).min(360.0)).hint_text(tl!("Folder")));
+                    let r = crate::widgets::accessible_name(
+                        ui.add(egui::TextEdit::singleline(&mut d.folder).desired_width((ui.available_width() * 0.5).min(360.0)).hint_text(tl!("Folder"))),
+                        "Folder",
+                    );
                     push(&mut elems, "linkMedia.folder", &r, "folder");
                     let r = ui.button(tl!("Browse…"));
                     push(&mut elems, "linkMedia.browse", &r, "Browse…");
@@ -339,7 +342,7 @@ fn link_media(app: &mut FilmcraftApp, ctx: &egui::Context) {
             params["item"] = json!(item);
             let hint = RelinkHint { command: "media.relink".into(), params };
             let item = json!(item);
-            app.pick_ui(FileDialog::Relink { exts: exts.iter().map(|e| e.to_string()).collect(), hint }, move |app, paths| {
+            app.pick_ui(FileDialog::Relink { exts: exts.iter().map(ToString::to_string).collect(), hint }, move |app, paths| {
                 let (Some(path), Some(mut d)) = (paths.into_iter().next(), app.ui.link_media.clone()) else { return };
                 relink_to(app, &mut d, &item, path);
                 app.ui.link_media = Some(d);
@@ -371,7 +374,7 @@ fn make_offline(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut ok = false;
     let n = app.session.state.project_selection.len();
     egui::Window::new(tl!("Make Offline"))
-        .id(egui::Id::new("Make Offline"))
+        .id(egui::Id::unique("Make Offline"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -416,7 +419,7 @@ fn create_proxies(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut ok = false;
     let mut browse = false;
     egui::Window::new(tl!("Create Proxies"))
-        .id(egui::Id::new("Create Proxies"))
+        .id(egui::Id::unique("Create Proxies"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -435,8 +438,12 @@ fn create_proxies(app: &mut FilmcraftApp, ctx: &egui::Context) {
             ui.add_space(4.0);
             ui.label(RichText::new(tl!("Destination")).strong());
             ui.horizontal(|ui| {
-                let r = ui
-                    .add(egui::TextEdit::singleline(&mut d.destination).desired_width(320.0).hint_text(tl!("Next to the original media, in a Proxies folder")));
+                let r = crate::widgets::accessible_name(
+                    ui.add(
+                        egui::TextEdit::singleline(&mut d.destination).desired_width(320.0).hint_text(tl!("Next to the original media, in a Proxies folder")),
+                    ),
+                    "Destination",
+                );
                 push(&mut elems, "proxies.destination", &r, "destination");
                 let r = ui.button(tl!("Browse…"));
                 push(&mut elems, "proxies.browse", &r, "Browse…");
@@ -489,14 +496,14 @@ fn pm_params(d: &ProjectManagerDraft, dry: bool) -> Value {
 
 fn project_manager(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.project_manager.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("project-manager-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("project-manager-before-drag"), &mut d);
     let before = d.clone();
     let mut elems: Elems = Vec::new();
     let mut keep = true;
     let (mut ok, mut calc, mut browse) = (false, false, false);
     let seqs: Vec<(u64, String)> = app.session.project.sequences().map(|i| (i.id.0, i.name.clone())).collect();
     egui::Window::new(tl!("Project Manager"))
-        .id(egui::Id::new("Project Manager"))
+        .id(egui::Id::unique("Project Manager"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
@@ -555,7 +562,7 @@ fn project_manager(app: &mut FilmcraftApp, ctx: &egui::Context) {
             ui.separator();
             ui.label(RichText::new(tl!("Destination Path")).strong());
             ui.horizontal(|ui| {
-                let r = ui.add(egui::TextEdit::singleline(&mut d.destination).desired_width(360.0));
+                let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.destination).desired_width(360.0)), "Destination");
                 push(&mut elems, "pm.destination", &r, "destination");
                 let r = ui.button(tl!("Browse…"));
                 push(&mut elems, "pm.browse", &r, "Browse…");
diff --git a/crates/ui-egui/src/panels/menu_dialogs.rs b/crates/ui-egui/src/panels/menu_dialogs.rs
index 99151da72..10122f438 100644
--- a/crates/ui-egui/src/panels/menu_dialogs.rs
+++ b/crates/ui-egui/src/panels/menu_dialogs.rs
@@ -48,7 +48,9 @@ impl Default for Extras {
 type Elems = Vec<(String, egui::Rect, String)>;
 
 fn push(elems: &mut Elems, id: impl Into<String>, r: &egui::Response, label: impl Into<String>) {
-    elems.push((id.into(), r.rect, label.into()));
+    let label = label.into();
+    crate::widgets::accessible_name(r.clone(), label.clone());
+    elems.push((id.into(), r.rect, label));
 }
 
 /// Dialog title, automation prefix and OK button text of a command's dialog.
@@ -453,7 +455,7 @@ fn pairs(v: &[&str]) -> Vec<(String, String)> {
 /// Draw the open dialog, if any.
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.extras.dialog.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("menu-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("menu-dialog-before-drag"), &mut d);
     let Some((title, pre, ok_text)) = meta(&d.command) else {
         app.ui.extras.dialog = None;
         return;
@@ -463,7 +465,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut browse: Option<String> = None;
     let info_only = matches!(d.command.as_str(), "file.mediaProperties" | "clip.sourceSettings" | "help.systemCompatibilityReport");
     // the title is translated; the window keeps one id whatever the interface language
-    let id = egui::Id::new(("menu-dialog", pre));
+    let id = egui::Id::unique(("menu-dialog", pre));
     egui::Window::new(title).id(id).collapsible(false).resizable(false).default_width(420.0).centered(ctx).show(ctx, |ui| {
         let p = &mut d.params;
         match d.command.as_str() {
diff --git a/crates/ui-egui/src/panels/metadata.rs b/crates/ui-egui/src/panels/metadata.rs
index 88312f1a1..94a46cf26 100644
--- a/crates/ui-egui/src/panels/metadata.rs
+++ b/crates/ui-egui/src/panels/metadata.rs
@@ -120,9 +120,12 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
 /// An editable value: a text field whose edit is committed when it loses focus (Enter, Tab or a
 /// click elsewhere). Returns (field, new value) on commit.
 fn text_field(ui: &mut egui::Ui, item: ItemId, f: &Field, elems: &mut Vec<(String, Rect, String)>) -> Option<(String, String)> {
-    let id = egui::Id::new(("md-draft", item.0, f.name.clone()));
+    let id = egui::Id::unique(("md-draft", item.0, f.name.clone()));
     let mut draft: String = ui.data(|d| d.get_temp(id)).unwrap_or_else(|| f.value.clone());
-    let r = ui.add(egui::TextEdit::singleline(&mut draft).desired_width(ui.available_width()).id_salt(("md-edit", item.0, f.name.clone())));
+    let r = crate::widgets::accessible_name(
+        ui.add(egui::TextEdit::singleline(&mut draft).desired_width(ui.available_width()).id_salt(("md-edit", item.0, f.name.clone()))),
+        f.name.clone(),
+    );
     elems.push((field_id(&f.name), r.rect, f.value.clone()));
     let mut out = None;
     if r.has_focus() {
diff --git a/crates/ui-egui/src/panels/misc.rs b/crates/ui-egui/src/panels/misc.rs
index f5bc5f1e9..a1fdc5418 100644
--- a/crates/ui-egui/src/panels/misc.rs
+++ b/crates/ui-egui/src/panels/misc.rs
@@ -50,6 +50,76 @@ pub fn history(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
+/// Egui memory key of the open Delete Redoable Actions confirmation.
+const CONFIRM_DELETE_REDOABLE: &str = "history-delete-redoable";
+
+/// The History panel's ≡ menu: Delete Redoable Actions and Clear History (automation ids
+/// `panel.menu.History.deleteRedoable` and `panel.menu.History.clear`). Returns true to close it.
+pub fn history_panel_menu(app: &mut FilmcraftApp, ui: &mut egui::Ui) -> bool {
+    let ctx = ui.ctx().clone();
+    let mut close = false;
+    for (id, label, command) in [("deleteRedoable", tl!("Delete Redoable Actions"), "history.deleteRedoable"), ("clear", tl!("Clear History"), "history.clear")]
+    {
+        let r = ui.add_enabled(app.session.is_enabled(command), egui::Button::new(label));
+        app.auto.add_response(&format!("panel.menu.History.{id}"), &r, label);
+        if r.clicked() {
+            if let Err(e) = crate::menus::invoke(app, &ctx, command, serde_json::json!({})) {
+                app.ui.status = e;
+            }
+            close = true;
+        }
+    }
+    close
+}
+
+/// Delete Redoable Actions from the panel menu or a key (no parameters) asks for OK first, as in
+/// Premiere. Returns None for other ids, and for calls with parameters, which run the command.
+pub fn route_history(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str, params: &serde_json::Value) -> Option<Result<serde_json::Value, String>> {
+    if id != "history.deleteRedoable" || !params.as_object().is_none_or(|m| m.is_empty()) {
+        return None;
+    }
+    if !app.session.history.can_redo() {
+        return Some(Err("nothing to redo".into()));
+    }
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique(CONFIRM_DELETE_REDOABLE), true));
+    Some(Ok(serde_json::json!({"dialog": "deleteRedoable"})))
+}
+
+/// The Delete Redoable Actions confirmation (automation ids `history.deleteRedoable.cancel` and
+/// `history.deleteRedoable.ok`). It closes by itself when nothing is left to redo.
+pub fn history_dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    let key = egui::Id::unique(CONFIRM_DELETE_REDOABLE);
+    if !ctx.data(|d| d.get_temp::<bool>(key)).unwrap_or(false) {
+        return;
+    }
+    let mut close = !app.session.history.can_redo();
+    egui::Window::new(tl!("Delete Redoable Actions"))
+        .id(key.with("window"))
+        .collapsible(false)
+        .resizable(false)
+        .pivot(Align2::CENTER_CENTER)
+        .default_pos(crate::widgets::dialog_center(ctx))
+        .show(ctx, |ui| {
+            ui.label(tl!("Delete the dimmed actions after the current state? They cannot be redone."));
+            ui.horizontal(|ui| {
+                let r = ui.button(tl!("Cancel"));
+                app.auto.add("history.deleteRedoable.cancel", r.rect, "Cancel");
+                close |= r.clicked();
+                let r = ui.button(tl!("OK"));
+                app.auto.add("history.deleteRedoable.ok", r.rect, "OK");
+                if r.clicked() {
+                    if let Err(e) = app.session.execute("history.deleteRedoable", serde_json::json!({})) {
+                        app.ui.status = e.to_string();
+                    }
+                    close = true;
+                }
+            });
+        });
+    if close || crate::widgets::escape_closes(ctx) {
+        ctx.data_mut(|d| d.remove::<bool>(key));
+    }
+}
+
 /// The marker colours of the Markers panel filter (each chip stands for the labels that share its
 /// marker colour).
 pub const MARKER_FILTER: [filmcraft_project::Label; 7] = {
diff --git a/crates/ui-egui/src/panels/mixer.rs b/crates/ui-egui/src/panels/mixer.rs
index 1d5046b38..178070ce6 100644
--- a/crates/ui-egui/src/panels/mixer.rs
+++ b/crates/ui-egui/src/panels/mixer.rs
@@ -17,7 +17,8 @@
 //! listening square (`mixer.A1.pan51`, drag; double-click: front centre) with Center % and LFE
 //! controls (`mixer.A1.pan51.center`, `mixer.A1.pan51.lfe`). Meters show one bar per channel
 //! (six for 5.1 strips). The panel menu (`mixer.menu`) holds Show/Hide Tracks (`mixer.menu.showHide`,
-//! then `mixer.showHide.<A1|S1>` per strip) and Meter Input(s) Only (`mixer.menu.meterInputOnly`).
+//! then `mixer.showHide.<A1|S1>` per strip) and Meter Input(s) Only (`mixer.menu.meterInputOnly`),
+//! which are also the commands `mixer.showHideTracks` and `mixer.meterInputOnly`.
 
 use std::collections::HashMap;
 
@@ -33,6 +34,7 @@ use serde_json::{Value, json};
 use crate::FilmcraftApp;
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
+use crate::widgets::HotNumberOptions;
 
 // ------------------------------------------------------------------------------------- fader law
 
@@ -87,9 +89,9 @@ pub const INPUT_METER: u64 = u64::MAX - 1;
 
 /// Per-strip meter state, `strip id → [level, peak]` per channel (dBFS; 2 channels, or 6 for 5.1
 /// strips), fed by the playing mix ([`filmcraft_render::mixer::LiveMix`]) with fast attack and a
-/// 20 dB/s fall. [`INPUT_METER`] holds the voice-over input.
+/// 20 dB/s fall (peak holds 6 dB/s) while live, dropping within a quarter second after Stop. [`INPUT_METER`] holds the voice-over input.
 pub fn poll_meters(app: &mut FilmcraftApp, ui: &egui::Ui) -> HashMap<u64, Vec<[f32; 2]>> {
-    let id = egui::Id::new("mixer-meters");
+    let id = egui::Id::unique("mixer-meters");
     let frame = ui.ctx().cumulative_frame_nr();
     let (last, mut st): (u64, HashMap<u64, Vec<[f32; 2]>>) = ui.data(|d| d.get_temp(id)).unwrap_or_default();
     if last == frame && frame != 0 {
@@ -102,15 +104,18 @@ pub fn poll_meters(app: &mut FilmcraftApp, ui: &egui::Ui) -> HashMap<u64, Vec<[f
     if !input.is_empty() {
         fresh.push((INPUT_METER, input));
     }
+    // scrubbing plays through the same mixer, so its grains move the meters too
+    let live = app.playback.playing || app.session.voiceover.recording() || app.scrub.is_open();
+    // Once stopped, bars and peak holds drop within a quarter second instead of easing down for
+    // seconds, which read as audio still playing.
+    let (level_fall, peak_fall) = if live { (20.0, 6.0) } else { (360.0, 360.0) };
     let dt = ui.input(|i| i.stable_dt).min(0.1);
     for v in st.values_mut() {
         for m in v.iter_mut() {
-            m[0] = (m[0] - 20.0 * dt).max(-90.0);
-            m[1] = (m[1] - 6.0 * dt).max(-90.0);
+            m[0] = (m[0] - level_fall * dt).max(-90.0);
+            m[1] = (m[1] - peak_fall * dt).max(-90.0);
         }
     }
-    // scrubbing plays through the same mixer, so its grains move the meters too
-    let live = app.playback.playing || app.session.voiceover.recording() || app.scrub.is_open();
     if live {
         for (k, p) in fresh {
             let e = st.entry(k).or_default();
@@ -208,6 +213,35 @@ fn targets(seq: &Sequence, id: TrackId) -> Vec<&Track> {
 
 // ------------------------------------------------------------------------------------- track mixer
 
+/// Egui memory key of the open Show/Hide Tracks dialog.
+const SHOW_HIDE_TRACKS_OPEN: &str = "mixer-show-hide-open";
+
+/// The key the Audio Track Mixer menu shows for `id`: its Audio Track Mixer binding, else its
+/// application-wide one; empty when it has neither.
+fn panel_key(app: &FilmcraftApp, id: &str) -> String {
+    let bindings = app.session.shortcuts.for_command(id);
+    let b = bindings.iter().find(|b| b.panel.as_deref() == Some("Audio Track Mixer")).or_else(|| bindings.iter().find(|b| b.panel.is_none()));
+    b.map(|b| crate::menus::shortcut_text(&b.keys)).unwrap_or_default()
+}
+
+/// Show/Hide Tracks… (`mixer.showHideTracks`): shows the Audio Track Mixer and opens its dialog.
+pub(crate) fn open_show_hide_tracks(app: &mut FilmcraftApp, ctx: &egui::Context) -> Value {
+    app.show_panel(crate::dock::PanelKind::AudioTrackMixer);
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique(SHOW_HIDE_TRACKS_OPEN), true));
+    json!({"dialog": "showHideTracks"})
+}
+
+/// Meter Input(s) Only (`mixer.meterInputOnly`, `{"on":bool?}`): sets the option, or toggles it
+/// without `on`.
+pub(crate) fn set_meter_input_only(app: &mut FilmcraftApp, params: &Value) -> Result<Value, String> {
+    let on = match params.get("on") {
+        None | Some(Value::Null) => !app.ui.mixer_meter_input_only,
+        Some(v) => v.as_bool().ok_or("`on` must be true or false")?,
+    };
+    app.ui.mixer_meter_input_only = on;
+    Ok(json!({"meterInputOnly": on}))
+}
+
 pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     // Keep the immutable project snapshot alive while UI commands mutate the session.
@@ -223,7 +257,7 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let body = Rect::from_min_max(pos2(rect.min.x, rect.min.y + 2.0), pos2(rect.max.x, footer.min.y));
     // effects / sends disclosure at the left edge
     let arrow = Rect::from_min_size(pos2(body.min.x + 2.0, body.min.y + 4.0), vec2(14.0, 18.0));
-    let aresp = ui.interact(arrow, egui::Id::new("mixer-fx-toggle"), Sense::click()).on_hover_text(tl!("Show/Hide Effects and Sends"));
+    let aresp = ui.interact(arrow, egui::Id::unique("mixer-fx-toggle"), Sense::click()).on_hover_text(tl!("Show/Hide Effects and Sends"));
     icons::paint(ui.painter(), arrow.shrink(2.0), if app.ui.mixer_fx_open { Icon::ChevronDown } else { Icon::ChevronRight }, t.icon);
     app.auto.add("mixer.showEffects", arrow, "Show/Hide Effects and Sends");
     if aresp.clicked() {
@@ -231,19 +265,20 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     // panel menu: Show/Hide Tracks, Meter Input(s) Only
     let menu_r = Rect::from_min_size(pos2(body.min.x + 2.0, body.min.y + 26.0), vec2(14.0, 18.0));
-    let mresp = ui.interact(menu_r, egui::Id::new("mixer-menu"), Sense::click()).on_hover_text(tl!("Audio Track Mixer menu"));
+    let mresp = ui.interact(menu_r, egui::Id::unique("mixer-menu"), Sense::click()).on_hover_text(tl!("Audio Track Mixer menu"));
     icons::paint(ui.painter(), menu_r.shrink(2.0), Icon::Hamburger, if mresp.hovered() { t.tab_text_active } else { t.icon });
     app.auto.add("mixer.menu", menu_r, "Audio Track Mixer menu");
-    let show_hide_id = egui::Id::new("mixer-show-hide-open");
+    let show_hide_id = egui::Id::unique(SHOW_HIDE_TRACKS_OPEN);
     let mut show_hide: bool = ui.data(|d| d.get_temp(show_hide_id)).unwrap_or(false);
+    let (show_hide_key, meter_input_key) = (panel_key(app, "mixer.showHideTracks"), panel_key(app, "mixer.meterInputOnly"));
     egui::Popup::menu(&mresp).show(|ui| {
-        let r = ui.button(tl!("Show/Hide Tracks…"));
+        let r = ui.add(egui::Button::new(tl!("Show/Hide Tracks…")).shortcut_text(show_hide_key));
         app.auto.add("mixer.menu.showHide", r.rect, "Show/Hide Tracks…");
         if r.clicked() {
             show_hide = true;
         }
         let on = app.ui.mixer_meter_input_only;
-        let r = ui.selectable_label(on, tl!("Meter Input(s) Only"));
+        let r = ui.add(egui::Button::selectable(on, tl!("Meter Input(s) Only")).shortcut_text(meter_input_key));
         app.auto.add("mixer.menu.meterInputOnly", r.rect, "Meter Input(s) Only");
         if r.clicked() {
             app.ui.mixer_meter_input_only = !on;
@@ -252,7 +287,7 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if show_hide {
         let mut open = true;
         let mut close = false;
-        egui::Window::new(tl!("Show/Hide Tracks")).id(egui::Id::new("mixer-show-hide")).collapsible(false).resizable(false).open(&mut open).show(
+        egui::Window::new(tl!("Show/Hide Tracks")).id(egui::Id::unique("mixer-show-hide")).collapsible(false).resizable(false).open(&mut open).show(
             ui.ctx(),
             |ui| {
                 for id in seq.audio_tracks.iter().chain(&seq.submix_tracks).map(|t| t.id) {
@@ -294,7 +329,7 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // strips never get shorter than their controls plus a usable fader: scroll vertically instead
     let need = 4.0 + if app.ui.mixer_fx_open { 10.0 * SLOT_H + 10.0 } else { 0.0 } + 112.0 + 26.0 + 24.0 + 6.0 + 170.0 + 42.0;
     let clip = Rect::from_min_max(pos2(x0, body.min.y), pos2(body.max.x - 8.0, body.max.y - sb_h));
-    let voff_id = egui::Id::new("mixer-vscroll");
+    let voff_id = egui::Id::unique("mixer-vscroll");
     let max_voff = (need - (clip.height() - 4.0)).max(0.0);
     let mut voff: f32 = ui.data(|d| d.get_temp(voff_id)).unwrap_or(0.0);
     if ui.rect_contains_pointer(body) && !ui.input(|i| i.modifiers.shift) {
@@ -307,7 +342,7 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let kh = (bar.height() * clip.height() / (need + 4.0)).max(20.0);
         let ky = bar.min.y + (bar.height() - kh) * voff / max_voff;
         let knob = Rect::from_min_size(pos2(bar.min.x, ky), vec2(bar.width(), kh));
-        let kr = ui.interact(knob, egui::Id::new("mixer-vscroll-knob"), Sense::drag());
+        let kr = ui.interact(knob, egui::Id::unique("mixer-vscroll-knob"), Sense::drag());
         ui.painter().rect_filled(knob, 3.0, if kr.dragged() { t.accent } else { t.fader_knob });
         if kr.dragged() {
             voff = (voff + kr.drag_delta().y * (need + 4.0) / bar.height()).clamp(0.0, max_voff);
@@ -343,7 +378,7 @@ pub fn track_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
 fn strip_scroll(app: &mut FilmcraftApp, ui: &egui::Ui, body: Rect, x0: f32, total: f32, avail: f32, key: &str) -> (f32, f32) {
     let t = app.tokens;
     let max_off = (total - avail).max(0.0);
-    let off_id = egui::Id::new(format!("{key}-hscroll"));
+    let off_id = egui::Id::unique(format!("{key}-hscroll"));
     let mut off: f32 = ui.data(|d| d.get_temp(off_id)).unwrap_or(0.0);
     if ui.rect_contains_pointer(body) {
         let sd = ui.input(|i| i.smooth_scroll_delta);
@@ -356,7 +391,7 @@ fn strip_scroll(app: &mut FilmcraftApp, ui: &egui::Ui, body: Rect, x0: f32, tota
         let kw = (bar.width() * avail / total).max(20.0);
         let kx = bar.min.x + (bar.width() - kw) * off / max_off;
         let knob = Rect::from_min_size(pos2(kx, bar.min.y), vec2(kw, bar.height()));
-        let kr = ui.interact(knob, egui::Id::new(format!("{key}-hscroll-knob")), Sense::drag());
+        let kr = ui.interact(knob, egui::Id::unique(format!("{key}-hscroll-knob")), Sense::drag());
         ui.painter().rect_filled(knob, 4.0, if kr.dragged() { t.accent } else { t.fader_knob });
         if kr.dragged() {
             off = (off + kr.drag_delta().x * total / bar.width()).clamp(0.0, max_off);
@@ -380,6 +415,7 @@ fn run_actions(app: &mut FilmcraftApp, ctx: &egui::Context, acts: Vec<(String, V
     }
 }
 
+/// Draw one mixer strip. A missing track is a no-op; automation ids use `mixer.<label>`; the master strip has `MASTER_STRIP` handling.
 fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, sr: Rect, meter: &[[f32; 2]]) {
     let t = cx.t;
     let seq = cx.seq;
@@ -401,10 +437,10 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
             let r = Rect::from_min_size(pos2(x + 4.0, y), vec2(w - 8.0, SLOT_H - 2.0));
             let fx = tr.effects.get(k);
             let text = match fx {
-                Some(e) => format!("{}{}", if e.post_fader { "▸ " } else { "" }, e.def().map(|d| d.name).unwrap_or(&e.effect)),
+                Some(e) => format!("{}{}", if e.post_fader { "> " } else { "" }, e.def().map(|d| d.name).unwrap_or(&e.effect)),
                 None => String::new(),
             };
-            let resp = slot_box(ui, r, &text, fx.is_some(), fx.is_some_and(|e| !e.enabled), &t, egui::Id::new((&ap, "fx", k)));
+            let resp = slot_box(ui, r, &text, fx.is_some(), fx.is_some_and(|e| !e.enabled), &t, egui::Id::unique((&ap, "fx", k)));
             app.auto.add(&format!("{ap}.fx.{k}"), r, &if text.is_empty() { format!("Effect slot {}", k + 1) } else { text.clone() });
             let can_add = fx.is_none() && k == tr.effects.len();
             egui::Popup::menu(&resp).show(|ui| {
@@ -495,7 +531,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
                 y += SLOT_H;
                 continue;
             }
-            let resp = slot_box(ui, r, &text, snd.is_some(), snd.is_some_and(|s| s.muted), &t, egui::Id::new((&ap, "send", k)));
+            let resp = slot_box(ui, r, &text, snd.is_some(), snd.is_some_and(|s| s.muted), &t, egui::Id::unique((&ap, "send", k)));
             app.auto.add(&format!("{ap}.send.{k}"), r, &if text.is_empty() { format!("Send slot {}", k + 1) } else { text.clone() });
             let can_add = snd.is_none() && k == tr.mixer.sends.len();
             let tg = targets(seq, id);
@@ -558,7 +594,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
     // ---- input / output
     if !is_master {
         let ir = Rect::from_min_size(pos2(x + 4.0, y), vec2(w - 8.0, 20.0));
-        let iresp = crate::widgets::dropdown_text(ui, ir, crate::i18n::t(tr.mixer.input_map.label()), &t, egui::Id::new((&ap, "input")));
+        let iresp = crate::widgets::dropdown_text(ui, ir, crate::i18n::t(tr.mixer.input_map.label()), &t, egui::Id::unique((&ap, "input")));
         app.auto.add(&format!("{ap}.input"), ir, "Input channel mapping");
         egui::Popup::menu(&iresp).show(|ui| {
             for m in InputMap::ALL {
@@ -573,7 +609,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
         let or = Rect::from_min_size(pos2(x + 4.0, y), vec2(w - 8.0, 20.0));
         let out_label =
             tr.mixer.output.map(|o| seq.mix_track(o).map(|s| s.name.clone()).unwrap_or_else(|| tl!("Mix").into())).unwrap_or_else(|| tl!("Mix").into());
-        let oresp = crate::widgets::dropdown_text(ui, or, &out_label, &t, egui::Id::new((&ap, "output")));
+        let oresp = crate::widgets::dropdown_text(ui, or, &out_label, &t, egui::Id::unique((&ap, "output")));
         app.auto.add(&format!("{ap}.output"), or, "Track output assignment");
         let tg = targets(seq, id);
         egui::Popup::menu(&oresp).show(|ui| {
@@ -599,7 +635,8 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
             let pan = shown(app, &tr, LANE_PAN, cx.now);
             let kc = pos2(sr.center().x, y + 20.0);
             let kr = Rect::from_center_size(kc, vec2(38.0, 38.0));
-            let kresp = ui.interact(kr, egui::Id::new((&ap, "pan")), Sense::click_and_drag()).on_hover_text(tl!("Pan / balance (drag; double-click: centre)"));
+            let kresp =
+                ui.interact(kr, egui::Id::unique((&ap, "pan")), Sense::click_and_drag()).on_hover_text(tl!("Pan / balance (drag; double-click: centre)"));
             let ring = if kresp.hovered() || kresp.dragged() { t.tab_text_active } else { t.control_handle_dim };
             ui.painter().circle_stroke(kc, 16.0, Stroke::new(2.0, ring));
             let ang = (pan / 100.0) as f32 * 135f32.to_radians();
@@ -622,7 +659,13 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
             }
             let vr = Rect::from_center_size(pos2(kc.x, y + 48.0), vec2(56.0, 16.0));
             let mut vui = ui.new_child(egui::UiBuilder::new().max_rect(vr).layout(egui::Layout::top_down(egui::Align::Center)));
-            let (vresp, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new((&ap, "panValue")), pan, 1.0, (-100.0, 100.0), 1, "", &t);
+            let (vresp, nv) = crate::widgets::hot_number(
+                &mut vui,
+                tl!("Pan"),
+                egui::Id::unique((&ap, "panValue")),
+                pan,
+                HotNumberOptions::new(1.0, (-100.0, 100.0), 1, "", &t),
+            );
             app.auto.add(&format!("{ap}.panValue"), vresp.rect, &format!("{pan:.1}"));
             if let Some(v) = nv {
                 cx.cmd("mixer.setValue", json!({"strip": sid, "lane": LANE_PAN, "value": v}));
@@ -636,7 +679,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
     // ---- automation mode
     let mr = Rect::from_min_size(pos2(x + 4.0, y), vec2(w - 8.0, 20.0));
     let mode = tr.mixer.mode;
-    let mresp = crate::widgets::dropdown_text(ui, mr, crate::i18n::t(mode.label()), &t, egui::Id::new((&ap, "mode")));
+    let mresp = crate::widgets::dropdown_text(ui, mr, crate::i18n::t(mode.label()), &t, egui::Id::unique((&ap, "mode")));
     if cx.recording && mode.writes() {
         ui.painter().rect_stroke(mr, 4.0, Stroke::new(1.0, RED), StrokeKind::Inside);
     }
@@ -658,7 +701,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
         let bw = 18.0;
         let bx = sr.center().x - bw * 1.5 - 6.0;
         let b = |i: f32| Rect::from_min_size(pos2(bx + i * (bw + 6.0), y), vec2(bw, 16.0));
-        let m_r = crate::widgets::letter_toggle(ui, b(0.0), "M", muted, MUTE_ON, &t, egui::Id::new((&ap, "M")));
+        let m_r = crate::widgets::letter_toggle(ui, b(0.0), "M", muted, MUTE_ON, &t, egui::Id::unique((&ap, "M")));
         app.auto.add(&format!("{ap}.mute"), b(0.0), "Mute Track");
         if m_r.clicked() {
             if cx.recording && mode.writes() {
@@ -669,21 +712,21 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
                 cx.cmd("mixer.setStrip", json!({"strip": sid, "muted": !tr.muted}));
             }
         }
-        let s_r = crate::widgets::letter_toggle(ui, b(1.0), "S", tr.solo, SOLO_ON, &t, egui::Id::new((&ap, "S")));
+        let s_r = crate::widgets::letter_toggle(ui, b(1.0), "S", tr.solo, SOLO_ON, &t, egui::Id::unique((&ap, "S")));
         app.auto.add(&format!("{ap}.solo"), b(1.0), "Solo Track");
         if s_r.clicked() {
             cx.cmd("mixer.setStrip", json!({"strip": sid, "solo": !tr.solo}));
         }
         let is_sub = seq.submix_tracks.iter().any(|s| s.id == id);
         if is_sub {
-            let r_r = crate::widgets::letter_toggle(ui, b(2.0), "◆", tr.mixer.solo_safe, Color32::from_gray(0xc8), &t, egui::Id::new((&ap, "safe")))
+            let r_r = crate::widgets::letter_toggle(ui, b(2.0), "◆", tr.mixer.solo_safe, Color32::from_gray(0xc8), &t, egui::Id::unique((&ap, "safe")))
                 .on_hover_text(tl!("Solo safe"));
             app.auto.add(&format!("{ap}.soloSafe"), b(2.0), "Solo Safe");
             if r_r.clicked() {
                 cx.cmd("mixer.setStrip", json!({"strip": sid, "soloSafe": !tr.mixer.solo_safe}));
             }
         } else {
-            let r_r = crate::widgets::letter_toggle(ui, b(2.0), "R", tr.mixer.record_arm, RED, &t, egui::Id::new((&ap, "R")))
+            let r_r = crate::widgets::letter_toggle(ui, b(2.0), "R", tr.mixer.record_arm, RED, &t, egui::Id::unique((&ap, "R")))
                 .on_hover_text(tl!("Enable track for recording"));
             app.auto.add(&format!("{ap}.record"), b(2.0), "Enable Track for Recording");
             if r_r.clicked() {
@@ -715,7 +758,7 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
         let cy = ypos(vol);
         let cap = Rect::from_center_size(pos2(track.center().x, cy), vec2(18.0, 26.0));
         let fresp =
-            ui.interact(cap.expand(3.0), egui::Id::new((&ap, "fader")), Sense::click_and_drag()).on_hover_text(tl!("Volume (drag; double-click: 0 dB)"));
+            ui.interact(cap.expand(3.0), egui::Id::unique((&ap, "fader")), Sense::click_and_drag()).on_hover_text(tl!("Volume (drag; double-click: 0 dB)"));
         let held = app.session.previews.live.get(id, LANE_VOLUME).is_some();
         let col = if fresp.dragged() || held { t.accent } else { t.control_handle };
         ui.painter().rect_filled(cap, 3.0, t.control_handle_bg);
@@ -758,7 +801,13 @@ fn strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, id: TrackId, s
         // fader value (hot text)
         let vr = Rect::from_min_size(pos2(x + 4.0, sr.max.y - name_h - value_h), vec2(56.0, value_h));
         let mut vui = ui.new_child(egui::UiBuilder::new().max_rect(vr));
-        let (vresp, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new((&ap, "value")), vol.max(-96.0), 0.1, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t);
+        let (vresp, nv) = crate::widgets::hot_number(
+            &mut vui,
+            tl!("Volume"),
+            egui::Id::unique((&ap, "value")),
+            vol.max(-96.0),
+            HotNumberOptions::new(0.1, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t),
+        );
         app.auto.add(&format!("{ap}.value"), vresp.rect, &db_text(vol));
         if let Some(v) = nv {
             cx.cmd("mixer.setValue", json!({"strip": sid, "lane": LANE_VOLUME, "value": v}));
@@ -786,7 +835,7 @@ fn pan51_panner(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, tr: &Tr
     let py = shown(app, tr, LANE_PAN51_Y, cx.now);
     let sq = Rect::from_min_size(pos2(r.min.x, r.min.y), vec2(46.0, 46.0));
     let resp =
-        ui.interact(sq, egui::Id::new((ap, "pan51")), Sense::click_and_drag()).on_hover_text(tl!("5.1 panner (drag the puck; double-click: front centre)"));
+        ui.interact(sq, egui::Id::unique((ap, "pan51")), Sense::click_and_drag()).on_hover_text(tl!("5.1 panner (drag the puck; double-click: front centre)"));
     let p = ui.painter();
     p.rect_filled(sq, 3.0, t.panner_bg);
     p.rect_stroke(sq, 3.0, Stroke::new(1.0, if resp.hovered() || resp.dragged() { t.tab_text_active } else { t.panner_border }), StrokeKind::Inside);
@@ -826,7 +875,13 @@ fn pan51_panner(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, tr: &Tr
     small_text(ui, pos2(col_x, r.min.y + 6.0), Align2::LEFT_CENTER, tl!("Center"), 9.0, t.text_dim);
     let cr = Rect::from_min_size(pos2(col_x, r.min.y + 12.0), vec2(r.max.x - col_x, 14.0));
     let mut cui = ui.new_child(egui::UiBuilder::new().max_rect(cr));
-    let (cresp, nc) = crate::widgets::hot_number(&mut cui, egui::Id::new((ap, "pan51.center")), center, 1.0, (0.0, 100.0), 0, "%", &t);
+    let (cresp, nc) = crate::widgets::hot_number(
+        &mut cui,
+        tl!("Center"),
+        egui::Id::unique((ap, "pan51.center")),
+        center,
+        HotNumberOptions::new(1.0, (0.0, 100.0), 0, "%", &t),
+    );
     app.auto.add(&format!("{ap}.pan51.center"), cresp.rect, &format!("Center {center:.0} %"));
     if let Some(v) = nc {
         cx.cmd("mixer.setValue", json!({"strip": sid, "lane": LANE_PAN51_CENTER, "value": v}));
@@ -834,8 +889,13 @@ fn pan51_panner(app: &mut FilmcraftApp, ui: &mut egui::Ui, cx: &mut Ctx, tr: &Tr
     small_text(ui, pos2(col_x, r.min.y + 32.0), Align2::LEFT_CENTER, "LFE", 9.0, t.text_dim);
     let lr = Rect::from_min_size(pos2(col_x, r.min.y + 38.0), vec2(r.max.x - col_x, 14.0));
     let mut lui = ui.new_child(egui::UiBuilder::new().max_rect(lr));
-    let (lresp, nl) =
-        crate::widgets::hot_number(&mut lui, egui::Id::new((ap, "pan51.lfe")), lfe.max(FADER_MIN_DB), 0.5, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t);
+    let (lresp, nl) = crate::widgets::hot_number(
+        &mut lui,
+        "LFE",
+        egui::Id::unique((ap, "pan51.lfe")),
+        lfe.max(FADER_MIN_DB),
+        HotNumberOptions::new(0.5, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t),
+    );
     app.auto.add(&format!("{ap}.pan51.lfe"), lresp.rect, &format!("LFE {}", db_text(lfe)));
     if let Some(v) = nl {
         cx.cmd("mixer.setValue", json!({"strip": sid, "lane": LANE_PAN51_LFE, "value": v}));
@@ -863,7 +923,7 @@ fn transport(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect, cx: &mut Ctx)
     let mut x = row.center().x - bw * buttons.len() as f32 / 2.0;
     for (icon, cmd, tip) in buttons {
         let r = Rect::from_min_size(pos2(x, row.min.y + 4.0), vec2(bw - 2.0, 26.0));
-        let resp = ui.interact(r, egui::Id::new(("mixer-transport", cmd)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("mixer-transport", cmd)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("mixer.transport.{cmd}"), r, tip);
         if resp.hovered() {
             ui.painter().rect_filled(r, 4.0, t.hover);
@@ -912,7 +972,7 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let meters = poll_meters(app, ui);
     let now = app.session.playhead();
     let mut acts: Vec<(String, Value)> = Vec::new();
-    let kf_id = egui::Id::new("clip-mixer-keyframes");
+    let kf_id = egui::Id::unique("clip-mixer-keyframes");
     let mut write_kf: HashMap<u64, bool> = ui.data(|d| d.get_temp(kf_id)).unwrap_or_default();
     // Like Premiere, the strips narrow so that every track fits the panel; below the narrowest
     // usable strip the row scrolls instead, so no track is out of reach (#1922).
@@ -962,7 +1022,7 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         // pan knob
         let kc = pos2(sr.center().x, sr.min.y + 36.0);
         let kr = Rect::from_center_size(kc, vec2(30.0, 30.0));
-        let kresp = ui.interact(kr, egui::Id::new((&ap, "pan")), Sense::click_and_drag());
+        let kresp = ui.interact(kr, egui::Id::unique((&ap, "pan")), Sense::click_and_drag());
         ui.painter().circle_stroke(kc, 14.0, Stroke::new(2.0, dimc(t.control_handle_dim)));
         let ang = (pan / 100.0) as f32 * 135f32.to_radians();
         ui.painter().line_segment([kc, kc + vec2(ang.sin(), -ang.cos()) * 12.0], Stroke::new(2.0, dimc(t.control_handle_dim)));
@@ -983,7 +1043,7 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         // automation mode (Clip Mixer)
         let mode = filmcraft_engine::mixer::clip_mode(&app.session, tr.id);
         let mdr = Rect::from_min_size(pos2(sr.min.x + 4.0, sr.min.y + 2.0), vec2(sr.width() - 8.0, 16.0));
-        let mdresp = crate::widgets::dropdown_text(ui, mdr, crate::i18n::t(mode.label()), &t, egui::Id::new((&ap, "mode")));
+        let mdresp = crate::widgets::dropdown_text(ui, mdr, crate::i18n::t(mode.label()), &t, egui::Id::unique((&ap, "mode")));
         app.auto.add(&format!("{ap}.mode"), mdr, &format!("Clip automation mode: {}", mode.label()));
         egui::Popup::menu(&mdresp).show(|ui| {
             for m in AutomationMode::ALL {
@@ -998,18 +1058,18 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let y = sr.min.y + 72.0;
         let step = ((sr.width() - 6.0 - 18.0) / 2.0).min(24.0);
         let b = |k: f32| Rect::from_min_size(pos2(sr.center().x - step - 9.0 + k * step, y), vec2(18.0, 16.0));
-        let mr = crate::widgets::letter_toggle(ui, b(0.0), "M", tr.muted, MUTE_ON, &t, egui::Id::new((&ap, "M")));
+        let mr = crate::widgets::letter_toggle(ui, b(0.0), "M", tr.muted, MUTE_ON, &t, egui::Id::unique((&ap, "M")));
         app.auto.add(&format!("{ap}.mute"), b(0.0), "Mute Track");
         if mr.clicked() {
             acts.push(("mixer.setStrip".into(), json!({"strip": tr.id.0, "muted": !tr.muted})));
         }
-        let so = crate::widgets::letter_toggle(ui, b(1.0), "S", tr.solo, SOLO_ON, &t, egui::Id::new((&ap, "S")));
+        let so = crate::widgets::letter_toggle(ui, b(1.0), "S", tr.solo, SOLO_ON, &t, egui::Id::unique((&ap, "S")));
         app.auto.add(&format!("{ap}.solo"), b(1.0), "Solo Track");
         if so.clicked() {
             acts.push(("mixer.setStrip".into(), json!({"strip": tr.id.0, "solo": !tr.solo})));
         }
-        let kresp =
-            crate::widgets::icon_toggle(ui, b(2.0), Icon::Keyframe, kf, &t, egui::Id::new((&ap, "kf")), Some(t.accent)).on_hover_text(tl!("Write keyframes"));
+        let kresp = crate::widgets::icon_toggle(ui, b(2.0), Icon::Keyframe, kf, &t, egui::Id::unique((&ap, "kf")), Some(t.accent))
+            .on_hover_text(tl!("Write keyframes"));
         app.auto.add(&format!("{ap}.keyframe"), b(2.0), "Write Keyframes");
         if kresp.clicked() {
             write_kf.insert(tr.id.0, !kf);
@@ -1026,7 +1086,7 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             ui.painter().rect_filled(track, 2.0, t.control_well);
             let cy = ypos(vol);
             let cap = Rect::from_center_size(pos2(track.center().x, cy), vec2(18.0, 26.0));
-            let fresp = ui.interact(cap.expand(3.0), egui::Id::new((&ap, "fader")), Sense::click_and_drag());
+            let fresp = ui.interact(cap.expand(3.0), egui::Id::unique((&ap, "fader")), Sense::click_and_drag());
             ui.painter().rect_filled(cap, 3.0, t.control_handle_bg);
             ui.painter().rect_stroke(cap, 3.0, Stroke::new(2.0, dimc(t.control_handle)), StrokeKind::Inside);
             ui.painter().line_segment([pos2(cap.min.x + 5.0, cy), pos2(cap.max.x - 5.0, cy)], Stroke::new(2.0, dimc(t.control_handle)));
@@ -1050,7 +1110,13 @@ pub fn clip_mixer(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if !active {
             vui.set_opacity(0.4);
         }
-        let (vresp, nv) = crate::widgets::hot_number(&mut vui, egui::Id::new((&ap, "value")), vol.max(-96.0), 0.1, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t);
+        let (vresp, nv) = crate::widgets::hot_number(
+            &mut vui,
+            tl!("Volume"),
+            egui::Id::unique((&ap, "value")),
+            vol.max(-96.0),
+            HotNumberOptions::new(0.1, (FADER_MIN_DB, FADER_MAX_DB), 1, "", &t),
+        );
         app.auto.add(&format!("{ap}.value"), vresp.rect, &db_text(vol));
         if let (Some(v), true) = (nv, active) {
             set(&mut acts, "volume", "level", v, !vresp.dragged() || vresp.drag_started());
diff --git a/crates/ui-egui/src/panels/mod.rs b/crates/ui-egui/src/panels/mod.rs
index ff18ab0f2..8a3e93ddc 100644
--- a/crates/ui-egui/src/panels/mod.rs
+++ b/crates/ui-egui/src/panels/mod.rs
@@ -123,8 +123,9 @@ enum DragPayload {
     Template(String, String),
 }
 
+/// Single egui temp slot holding the active drag payload: a project item or bin, a source, an effect or a graphics template.
 fn payload_id() -> egui::Id {
-    egui::Id::new("filmcraft-drag-payload")
+    egui::Id::unique("filmcraft-drag-payload")
 }
 
 pub fn start_drag_source(ui: &egui::Ui, source: source_drag::SourceDrag) {
@@ -170,6 +171,11 @@ pub fn start_drag_lumetri_preset(ui: &egui::Ui, name: &str) {
 #[derive(Clone, Debug)]
 struct DragPayloadBox(DragPayload);
 
+/// Whether one of FilmCraft's own drags (an item, bin, source range, effect or template) is under way.
+pub(crate) fn dragging(ctx: &egui::Context) -> bool {
+    ctx.data(|d| d.get_temp::<Option<DragPayloadBox>>(payload_id())).flatten().is_some()
+}
+
 fn payload(ui: &egui::Ui) -> Option<DragPayload> {
     ui.ctx().data(|d| d.get_temp::<Option<DragPayloadBox>>(payload_id())).flatten().map(|b| b.0)
 }
@@ -180,6 +186,14 @@ pub fn dragged_project_item(ui: &egui::Ui) -> Option<ItemId> {
         _ => None,
     }
 }
+/// An item dragged from the Project panel (or the Media Browser), but not a Source Monitor drag,
+/// whose In/Out range and video/audio choice only a timeline drop keeps.
+pub fn dragged_panel_item(ui: &egui::Ui) -> Option<ItemId> {
+    match payload(ui) {
+        Some(DragPayload::Item(i)) => Some(i),
+        _ => None,
+    }
+}
 /// The items a drag from the Project panel carries: the whole selection when the dragged item is
 /// one of several selected, otherwise just the dragged item.
 pub fn dragged_selection(app: &FilmcraftApp, item: ItemId) -> Vec<ItemId> {
@@ -197,8 +211,9 @@ pub fn clear_drag(ui: &egui::Ui) {
     ui.ctx().data_mut(|d| d.insert_temp::<Option<DragPayloadBox>>(payload_id(), None));
 }
 
+/// Temp-store key marking a cancelled drag until the button is released, so it cannot restart immediately.
 fn cancelled_id() -> egui::Id {
-    egui::Id::new("filmcraft-drag-cancelled")
+    egui::Id::unique("filmcraft-drag-cancelled")
 }
 
 /// Abandon the drag in progress (Escape, #580): nothing is dropped, and nothing restarts it until
@@ -247,7 +262,7 @@ pub fn drag_ghost(app: &FilmcraftApp, ui: &egui::Ui) {
                 _ => filmcraft_project::find_effect(e).map(|d| d.name.to_string()).unwrap_or_default(),
             },
         };
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("drag-ghost")));
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("drag-ghost")));
         let r = Rect::from_min_size(p + egui::vec2(12.0, 8.0), egui::vec2(label.len() as f32 * 7.0 + 16.0, 20.0));
         painter.rect_filled(r, 4.0, Color32::from_black_alpha(200));
         painter.text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(11.5), Color32::WHITE);
@@ -255,7 +270,7 @@ pub fn drag_ghost(app: &FilmcraftApp, ui: &egui::Ui) {
     if ctx.input(|i| i.pointer.any_released()) {
         // cleared next frame so drop targets see the release this frame
         let f = ctx.cumulative_frame_nr();
-        let k = egui::Id::new("drag-release-frame");
+        let k = egui::Id::unique("drag-release-frame");
         match ctx.data(|d| d.get_temp::<u64>(k)) {
             Some(prev) if prev < f => {
                 clear_drag(ui);
@@ -276,7 +291,7 @@ pub fn panel_menu_popup(app: &mut FilmcraftApp, ui: &mut egui::Ui) {
     drag_ghost(app, ui);
     // bins opened in new windows (Project panel)
     project::floating(app, ui.ctx());
-    let id = egui::Id::new("panel-menu");
+    let id = egui::Id::unique("panel-menu");
     let Some((p, pos)) = ui.ctx().data(|d| d.get_temp::<(PanelKind, egui::Pos2)>(id)) else { return };
     let mut close = false;
     let area = egui::Area::new(id.with("area")).order(egui::Order::Foreground).fixed_pos(pos).show(ui.ctx(), |ui| {
@@ -309,7 +324,7 @@ pub fn panel_menu_popup(app: &mut FilmcraftApp, ui: &mut egui::Ui) {
                         let _ = crate::menus::invoke(app, ui.ctx(), "window.floatPanel", serde_json::json!({"panel": p.id()}));
                         close = true;
                     }
-                    let maximized = app.ui.keys.maximized.is_some_and(|q| app.ui.dock.contains(q) || app.ui.floating.iter().any(|g| g.panels.contains(&q)));
+                    let maximized = app.ui.keys.maximized.is_some_and(|q| crate::dock::LayoutExt::is_docked(&app.ui.dock, q));
                     let r = ui.button(if maximized { tl!("Restore Frame") } else { tl!("Maximize Frame") });
                     app.auto.add(&format!("panel.menu.{}.maximize", p.id()), r.rect, if maximized { "Restore Frame" } else { "Maximize Frame" });
                     if r.clicked() {
@@ -321,39 +336,60 @@ pub fn panel_menu_popup(app: &mut FilmcraftApp, ui: &mut egui::Ui) {
                         app.set_workspace(&w);
                         close = true;
                     }
-                    if p == PanelKind::Timeline {
-                        ui.separator();
-                        let r = ui.add_enabled(app.session.state.active_sequence.is_some(), egui::Button::new(tl!("Reveal Sequence in Project")));
-                        app.auto.add("panel.menu.Timeline.revealSequence", r.rect, "Reveal Sequence in Project");
-                        if r.clicked() {
-                            let _ = app.session.execute("sequence.revealInProject", serde_json::json!({}));
-                            close = true;
-                        }
-                        ui.checkbox(&mut app.ui.timeline.show_thumbnails, tl!("Video Thumbnails"));
-                        ui.checkbox(&mut app.ui.timeline.show_waveforms, tl!("Audio Waveforms"));
-                    }
-                    if p == PanelKind::Project {
-                        ui.separator();
-                        close |= project::panel_menu(app, ui);
-                    }
-                    if p == PanelKind::MediaBrowser {
-                        ui.separator();
-                        close |= media_browser::panel_menu(app, ui);
-                    }
-                    if p == PanelKind::Source {
-                        ui.separator();
-                        close |= monitor::source_panel_menu(app, ui);
-                    }
+                    close |= panel_items(app, ui, p);
                 });
             app.auto.add("panel.menu.scroll", scroll.inner_rect, "Panel menu");
         });
     });
     // A click elsewhere or Escape closes the menu. The click that opened it is over the tab, not
     // the menu, and must not close it again in the same frame.
-    let fresh = ui.ctx().data(|d| d.get_temp::<u64>(egui::Id::new("panel-menu-opened"))) == Some(ui.ctx().cumulative_frame_nr());
+    let fresh = ui.ctx().data(|d| d.get_temp::<u64>(egui::Id::unique("panel-menu-opened"))) == Some(ui.ctx().cumulative_frame_nr());
     if close || (!fresh && area.response.clicked_elsewhere()) || crate::widgets::escape_closes(ui.ctx()) {
         ui.ctx().data_mut(|d| d.remove::<(PanelKind, egui::Pos2)>(id));
     }
 }
 
+/// The panel's own items, each section after a separator: the Timeline's sequence and track
+/// display items, and the Project, Media Browser and Source menus. Shared by the ≡ menu and the
+/// tab's context menu. True when an item asks the menu to close.
+pub(crate) fn panel_items(app: &mut FilmcraftApp, ui: &mut egui::Ui, p: PanelKind) -> bool {
+    let mut close = false;
+    if p == PanelKind::Timeline {
+        ui.separator();
+        let r = ui.add_enabled(app.session.state.active_sequence.is_some(), egui::Button::new(tl!("Reveal Sequence in Project")));
+        app.auto.add("panel.menu.Timeline.revealSequence", r.rect, "Reveal Sequence in Project");
+        if r.clicked() {
+            let _ = app.session.execute("sequence.revealInProject", serde_json::json!({}));
+            close = true;
+        }
+        ui.checkbox(&mut app.ui.timeline.show_thumbnails, tl!("Video Thumbnails"));
+        ui.checkbox(&mut app.ui.timeline.show_waveforms, tl!("Audio Waveforms"));
+        let mut work_area = app.session.active_sequence().is_some_and(|q| q.work_area.is_some());
+        let r = ui.add_enabled(app.session.state.active_sequence.is_some(), egui::Checkbox::new(&mut work_area, tl!("Work Area Bar")));
+        app.auto.add("panel.menu.Timeline.workAreaBar", r.rect, "Work Area Bar");
+        if r.changed()
+            && let Err(e) = app.session.execute("sequence.workAreaBar", serde_json::json!({"show": work_area}))
+        {
+            app.ui.status = e.to_string();
+        }
+    }
+    if p == PanelKind::Project {
+        ui.separator();
+        close |= project::panel_menu(app, ui);
+    }
+    if p == PanelKind::MediaBrowser {
+        ui.separator();
+        close |= media_browser::panel_menu(app, ui);
+    }
+    if p == PanelKind::Source {
+        ui.separator();
+        close |= monitor::source_panel_menu(app, ui);
+    }
+    if p == PanelKind::History {
+        ui.separator();
+        close |= misc::history_panel_menu(app, ui);
+    }
+    close
+}
+
 pub(crate) mod transcript_cache;
diff --git a/crates/ui-egui/src/panels/monitor.rs b/crates/ui-egui/src/panels/monitor.rs
index e1f4d4766..018a2cd44 100644
--- a/crates/ui-egui/src/panels/monitor.rs
+++ b/crates/ui-egui/src/panels/monitor.rs
@@ -174,7 +174,11 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
     let saved_clip = ui.clip_rect();
     ui.set_clip_rect(saved_clip.intersect(if mv.zoom.is_some() && !compare { video_area } else { picture_area.expand(12.0) }));
     if show_picture {
-        ui.painter().rect_filled(pic, 0.0, t.monitor_bg);
+        if mv.transparency_grid {
+            monitor_view::transparency_grid(ui.painter(), pic, ui.clip_rect());
+        } else {
+            ui.painter().rect_filled(pic, 0.0, t.monitor_bg);
+        }
         let playing = if which == Which::Program { app.playback.playing } else { app.source_playback.clock.playing };
         let res = mv.effective_res(playing);
         // frame pixels per screen pixel along the axis that needs the most of them
@@ -187,10 +191,15 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
         };
         let size_key = (scale * 1000.0) as u32;
         let channel = display.is_channel();
-        let use_gpu = which == Which::Program && app.gpu.is_some() && !channel && !crate::panels::menu_dialogs::software_renderer(app);
+        // the GPU compositor's output is opaque, so the Transparency Grid takes the CPU frames
+        let grid = mv.transparency_grid && !channel;
+        let use_gpu = which == Which::Program && app.gpu.is_some() && !channel && !grid && !crate::panels::menu_dialogs::software_renderer(app);
+        // render previews are opaque, so the grid and Display Mode ▸ Alpha take live renders
+        let live = grid || display == DisplayMode::Alpha;
         let cpu_target = target;
         let target = match (use_gpu, target) {
             (true, Target::Sequence(s)) => Target::SequencePlan(s),
+            (false, Target::Sequence(s)) if live => Target::SequenceLive(s),
             (_, t) => t,
         };
         // Draft decoding (opt-in): only while playing at 1/2 resolution or lower.
@@ -208,7 +217,13 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
             app.frames.request(key, rate.tick_of(frame), scale, &project, 0);
         }
         let asked = asked_before(app, prefix, key, playing);
-        let tex_name = if channel { format!("monitor-{prefix}-{display:?}") } else { format!("monitor-{prefix}") };
+        let tex_name = if channel {
+            format!("monitor-{prefix}-{display:?}")
+        } else if grid {
+            format!("monitor-{prefix}-grid")
+        } else {
+            format!("monitor-{prefix}")
+        };
         let (shown, on_screen) = if use_gpu {
             let found = app
                 .frames
@@ -220,6 +235,8 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
                 Some((k, plan)) => (app.gpu_present(k, &plan).map(|(id, _)| id), Some(k)),
                 None => (app.gpu.as_ref().and_then(|g| g.texture), app.gpu.as_ref().and_then(|g| g.last_key)),
             }
+        } else if grid {
+            cpu_texture_as(app, &ctx, &tex_name, key, &asked, display, true)
         } else {
             cpu_texture(app, &ctx, &tex_name, key, &asked, display)
         };
@@ -244,11 +261,24 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
         if let Some(ra) = ref_area {
             // the reference frame (CPU path)
             let rf = rate.frame_at(Tick(mv.compare_ref.unwrap_or(time.0)));
-            let rkey = FrameKey { target: cpu_target, frame: rf, size: size_key, revision: rev, draft: false };
+            let rtarget = match cpu_target {
+                Target::Sequence(s) if mv.transparency_grid => Target::SequenceLive(s),
+                t => t,
+            };
+            let rkey = FrameKey { target: rtarget, frame: rf, size: size_key, revision: rev, draft: false };
             app.frames.request(rkey, rate.tick_of(rf), scale, &project, 1);
             let rpic = fit(ra, display_w, frame_size.1 as f32);
-            ui.painter().rect_filled(rpic, 0.0, t.monitor_bg);
-            if let (Some(tex), _) = cpu_texture(app, &ctx, &format!("monitor-{prefix}-ref"), rkey, &[], DisplayMode::Composite) {
+            if mv.transparency_grid {
+                monitor_view::transparency_grid(ui.painter(), rpic, ui.clip_rect());
+            } else {
+                ui.painter().rect_filled(rpic, 0.0, t.monitor_bg);
+            }
+            let (reference, _) = if mv.transparency_grid {
+                cpu_texture_as(app, &ctx, &format!("monitor-{prefix}-ref-grid"), rkey, &[], DisplayMode::Composite, true)
+            } else {
+                cpu_texture(app, &ctx, &format!("monitor-{prefix}-ref"), rkey, &[], DisplayMode::Composite)
+            };
+            if let Some(tex) = reference {
                 ui.painter().image(tex, rpic, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
             }
             app.auto.add("program.compare.reference", rpic, "reference frame");
@@ -285,11 +315,11 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
     }
     // A click on the Program monitor around the picture lets go of what is selected on it (#683;
     // in the picture the overlays do that). Under the picture and the overlays, so they come first.
-    if which == Which::Program && show_picture && ui.interact(video_area, egui::Id::new((prefix, "background")), Sense::click()).clicked() {
+    if which == Which::Program && show_picture && ui.interact(video_area, egui::Id::unique((prefix, "background")), Sense::click()).clicked() {
         crate::panels::graphics::deselect_on_monitor(app, ui);
     }
     // Click/drag in the picture: the Hand tool pans a magnified picture, otherwise focus.
-    let pic_resp = ui.interact(pic, egui::Id::new((prefix, "pic")), if show_picture { Sense::click_and_drag() } else { Sense::hover() });
+    let pic_resp = ui.interact(pic, egui::Id::unique((prefix, "pic")), if show_picture { Sense::click_and_drag() } else { Sense::hover() });
     app.auto.add(&format!("{prefix}.picture"), pic.intersect(video_area), "picture");
     // (Comparison View always fits both frames)
     if show_picture && !compare {
@@ -326,7 +356,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
     let tc = format_time(time, rate, drop_frame, TimeDisplay::Timecode, 48000);
     let tc_rect = Rect::from_min_size(row1.min, vec2(110.0, row1.height()));
     let min = if which == Which::Program { Tick::ZERO } else { origin };
-    match crate::widgets::timecode_field(ui, egui::Id::new((prefix, "timecode")), tc_rect, &tc, time, min, rate, drop_frame, t.timecode) {
+    match crate::widgets::timecode_field(ui, egui::Id::unique((prefix, "timecode")), tc_rect, &tc, time, min, rate, drop_frame, t.timecode) {
         Some(Ok(to)) => {
             let cmd = if which == Which::Program { "playhead.set" } else { "source.setPlayhead" };
             if let Err(e) = app.session.execute(cmd, json!({"time": to.0})) {
@@ -353,7 +383,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
         None => tl!("Fit").to_string(),
         Some(z) => format!("{}%", (z * 100.0).round() as i32),
     };
-    let zresp = crate::widgets::dropdown_text(ui, zr, &zoom_label, &t, egui::Id::new((prefix, "zoom")));
+    let zresp = crate::widgets::dropdown_text(ui, zr, &zoom_label, &t, egui::Id::unique((prefix, "zoom")));
     app.auto.add(&format!("{prefix}.zoom"), zr, "Select Zoom Level");
     monitor_view::zoom_menu(app, &zresp, which);
     let res = mv.res;
@@ -371,7 +401,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
     if separate_source_drag {
         crate::panels::source_drag::controls(app, ui, Rect::from_min_size(pos2(row1.center().x - 52.0, settings_y + 26.0), vec2(104.0, 24.0)));
     }
-    let rresp = crate::widgets::dropdown_text(ui, rr, crate::i18n::t(res.label()), &t, egui::Id::new((prefix, "res")));
+    let rresp = crate::widgets::dropdown_text(ui, rr, crate::i18n::t(res.label()), &t, egui::Id::unique((prefix, "res")));
     app.auto.add(&format!("{prefix}.resolution"), rr, "Select Playback Resolution");
     egui::Popup::menu(&rresp).show(|ui| {
         for r in PlaybackRes::ALL {
@@ -381,7 +411,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, which: Which)
         }
     });
     let wr = Rect::from_min_size(pos2(rr.max.x + 6.0, settings_y + 1.0), vec2(22.0, 22.0));
-    let wresp = ui.interact(wr, egui::Id::new((prefix, "wrench")), Sense::click());
+    let wresp = ui.interact(wr, egui::Id::unique((prefix, "wrench")), Sense::click());
     icons::paint(ui.painter(), wr.shrink(4.0), Icon::Wrench, if wresp.hovered() { t.tab_text_active } else { t.icon });
     app.auto.add(&format!("{prefix}.settings"), wr, "Settings");
     egui::Popup::menu(&wresp).show(|ui| {
@@ -486,6 +516,19 @@ fn cpu_texture(
     key: FrameKey,
     asked: &[FrameKey],
     mode: DisplayMode,
+) -> (Option<egui::TextureId>, Option<FrameKey>) {
+    cpu_texture_as(app, ctx, name, key, asked, mode, false)
+}
+
+/// [`cpu_texture`], keeping the frame's alpha when `alpha` is set (the Transparency Grid).
+fn cpu_texture_as(
+    app: &mut FilmcraftApp,
+    ctx: &egui::Context,
+    name: &str,
+    key: FrameKey,
+    asked: &[FrameKey],
+    mode: DisplayMode,
+    alpha: bool,
 ) -> (Option<egui::TextureId>, Option<FrameKey>) {
     let found = app
         .frames
@@ -497,6 +540,8 @@ fn cpu_texture(
         Some((k, img)) => {
             let tex = if mode.is_channel() {
                 app.texture_for_mapped(ctx, name, k, &img, |i| monitor_view::channel_view(i, mode))
+            } else if alpha {
+                app.texture_with_alpha(ctx, name, k, &img)
             } else {
                 app.texture_for(ctx, name, k, &img)
             };
@@ -527,7 +572,7 @@ const EYEDROPPER_SCALE: f32 = 0.5;
 fn eyedropper(app: &mut FilmcraftApp, ui: &mut egui::Ui, resp: &egui::Response, pic: Rect, target: Target, rate: filmcraft_time::FrameRate, time: Tick) {
     let Some(armed) = app.ui.eyedropper.clone() else { return };
     let ctx = ui.ctx().clone();
-    let pending_id = egui::Id::new("eyedropper-pending");
+    let pending_id = egui::Id::unique("eyedropper-pending");
     if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
         app.ui.eyedropper = None;
         ctx.data_mut(|d| d.remove::<EyedropperPick>(pending_id));
@@ -684,7 +729,7 @@ fn time_zoom_bar(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, which: Wh
     }
     app.auto.add(&format!("{prefix}.zoomBar"), thumb, "zoom scroll bar");
     app.auto.add(&format!("{prefix}.zoomBar.track"), bar, "zoom scroll bar track");
-    let resp = ui.interact(bar, egui::Id::new((prefix, "zoomBar")), Sense::click_and_drag());
+    let resp = ui.interact(bar, egui::Id::unique((prefix, "zoomBar")), Sense::click_and_drag());
     // the start that brings the thumb's middle under `x`
     let jump = |x: f32| ((x - bar.min.x - w / 2.0) as f64 * per_point).clamp(0.0, range);
     let mut set = None;
@@ -696,7 +741,7 @@ fn time_zoom_bar(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, which: Wh
     }
     // (a drag is known to be one only after the pointer has moved: what was grabbed is what was
     // under the pointer when the button went down)
-    let drag_id = egui::Id::new((prefix, "zoomBar-drag"));
+    let drag_id = egui::Id::unique((prefix, "zoomBar-drag"));
     if resp.drag_started()
         && let Some(pos) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
     {
@@ -763,7 +808,7 @@ fn mini_timeline(
     let xof = |tk: Tick| bar.min.x + (((tk - shown.0).0 as f64 / dur) as f32).clamp(0.0, 1.0) * bar.width();
     // a time off a zoomed ruler is not drawn (past either end of it all, it sits at that end)
     let shows = |tk: Tick| (tk >= shown.0 || shown.0 <= origin) && (tk <= shown.1 || shown.1 >= end);
-    let resp = ui.interact(bar, egui::Id::new((which as u8, "scrub")), Sense::click_and_drag());
+    let resp = ui.interact(bar, egui::Id::unique((which as u8, "scrub")), Sense::click_and_drag());
     app.auto.add(if which == Which::Program { "program.scrubBar" } else { "source.scrubBar" }, bar, "scrub bar");
     let interaction = crate::panels::source_range::interact(app, ui, bar, which, shown);
     let p = ui.painter();
@@ -899,6 +944,7 @@ fn set_transport_visible(hidden: &mut Vec<String>, command: &str, visible: bool)
 /// Width and height of a transport button.
 const TRANSPORT_BUTTON: f32 = 28.0;
 
+/// Draw a monitor's Source or Program transport. Row buttons use `transport_button`; overflow-menu entries call `invoke_transport` directly.
 fn transport(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect, which: Which) {
     let t = app.tokens;
     let src = which == Which::Source;
@@ -945,7 +991,7 @@ fn transport(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect, which: Which)
         // Keep the existing button-editor affordance only when it has its own space.
         // Customize this monitor's transport separately from the other monitor.
         let r = Rect::from_min_size(pos2(row.max.x - 30.0, row.min.y + 5.0), vec2(22.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new((prefix, "btn-editor")), Sense::click()).on_hover_text(tl!("Button Editor"));
+        let resp = ui.interact(r, egui::Id::unique((prefix, "btn-editor")), Sense::click()).on_hover_text(tl!("Button Editor"));
         app.auto.add(&format!("{prefix}.transport.editor"), r, "Button Editor");
         icons::paint(ui.painter(), r.shrink(5.0), Icon::Plus, if resp.hovered() { t.tab_text_active } else { t.text_dim });
         let mut edited_hidden = hidden.clone();
@@ -1009,8 +1055,8 @@ fn transport(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect, which: Which)
     }
     if !fit.overflow.is_empty() {
         let rect = Rect::from_min_size(pos2(x, row.min.y + 2.0), vec2(TRANSPORT_BUTTON, TRANSPORT_BUTTON));
-        let response = ui.interact(rect, egui::Id::new((prefix, "transport-more")), Sense::click()).on_hover_text(tl!("More transport controls"));
-        response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("More transport controls")));
+        let response = ui.interact(rect, egui::Id::unique((prefix, "transport-more")), Sense::click()).on_hover_text(tl!("More transport controls"));
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("More transport controls")));
         if response.hovered() {
             ui.painter().rect_filled(rect, 4.0, t.hover);
         }
@@ -1041,9 +1087,10 @@ fn transport(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect, which: Which)
     }
 }
 
+/// Draw one transport button with a unique id, automation registration, hover fill, proxy accent and a larger play icon; returns whether it was clicked.
 fn transport_button(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, prefix: &str, icon: Icon, command: &str, label: &str) -> bool {
     let t = app.tokens;
-    let response = ui.interact(rect, egui::Id::new((prefix, command)), Sense::click()).on_hover_text(label);
+    let response = ui.interact(rect, egui::Id::unique((prefix, command)), Sense::click()).on_hover_text(label);
     app.auto.add_response(&format!("{prefix}.transport.{command}"), &response, label);
     if response.hovered() {
         ui.painter().rect_filled(rect, 4.0, t.hover);
diff --git a/crates/ui-egui/src/panels/monitor_view.rs b/crates/ui-egui/src/panels/monitor_view.rs
index 5afc7e635..409191260 100644
--- a/crates/ui-egui/src/panels/monitor_view.rs
+++ b/crates/ui-egui/src/panels/monitor_view.rs
@@ -3,8 +3,9 @@
 //! Multi-Camera, Audio Waveform, Comparison View, Video and Audio Waveform Split), Magnification
 //! (Fit, 10%…1600%, the wheel zooming about the pointer, middle-button or Hand-tool panning),
 //! rulers, guides (dragged out of the rulers, Add
-//! Guide…, Clear Guides, Lock Guides, templates saved in the user preferences) and Snap in Program
-//! Monitor (graphic drags snap to guides, the frame edges and centre).
+//! Guide…, Clear Guides, Lock Guides, templates saved in the user preferences), Snap in Program
+//! Monitor (graphic drags snap to guides, the frame edges and center) and Transparency Grid (a
+//! checkerboard behind the picture shows its transparent areas).
 //!
 //! Everything is [`MonitorView`] state (serde: `ui.inspect`, `ui.set {"program": {…}}`) changed
 //! through the `view.*` UI commands, which [`route`] handles for `menus::invoke`. Commands act on
@@ -145,6 +146,11 @@ pub fn route(app: &mut FilmcraftApp, id: &str, params: &Value) -> Option<Result<
             v.safe_margins = toggled(v.safe_margins, params);
             Ok(json!({"monitor": pfx, "safeMargins": v.safe_margins}))
         }
+        "transparencyGrid" => {
+            let v = view_mut(app, w);
+            v.transparency_grid = toggled(v.transparency_grid, params);
+            Ok(json!({"monitor": pfx, "transparencyGrid": v.transparency_grid}))
+        }
         "showRulers" => {
             let v = view_mut(app, w);
             v.show_rulers = toggled(v.show_rulers, params);
@@ -304,6 +310,7 @@ pub fn checked(app: &FilmcraftApp, id: &str) -> Option<bool> {
     match rest {
         "highQualityPlayback" => Some(v.high_quality),
         "safeMargins" => Some(v.safe_margins),
+        "transparencyGrid" => Some(v.transparency_grid),
         "showRulers" => Some(v.show_rulers),
         "showGuides" => Some(v.show_guides),
         "lockGuides" => Some(v.lock_guides),
@@ -321,17 +328,17 @@ pub fn enabled(app: &FilmcraftApp, id: &str) -> bool {
     }
 }
 
-/// A channel of a frame as greyscale (Alpha, Red, Green, Blue display modes); colour channels are
-/// shown premultiplied, so transparent areas are black.
+/// A channel of a frame as grayscale (Alpha, Red, Green, Blue display modes). The frame's color
+/// is already premultiplied (the picture over black), so transparent areas are black in the
+/// color channels.
 pub fn channel_view(img: &Rgba, mode: DisplayMode) -> Rgba {
     let mut px = Vec::with_capacity(img.px.len());
     for p in img.px.as_chunks::<4>().0 {
-        let a = p[3] as u32;
         let v = match mode {
             DisplayMode::Alpha => p[3],
-            DisplayMode::Red => (p[0] as u32 * a / 255) as u8,
-            DisplayMode::Green => (p[1] as u32 * a / 255) as u8,
-            DisplayMode::Blue => (p[2] as u32 * a / 255) as u8,
+            DisplayMode::Red => p[0],
+            DisplayMode::Green => p[1],
+            DisplayMode::Blue => p[2],
             _ => {
                 px.extend_from_slice(p);
                 continue;
@@ -342,6 +349,58 @@ pub fn channel_view(img: &Rgba, mode: DisplayMode) -> Rgba {
     Rgba { w: img.w, h: img.h, px }
 }
 
+/// The Transparency Grid's square size (points) and its two grays.
+pub const GRID_CELL: f32 = 8.0;
+pub const GRID_LIGHT: Color32 = Color32::from_gray(0xff);
+pub const GRID_DARK: Color32 = Color32::from_gray(0xcc);
+
+/// The dark squares of the Transparency Grid behind `pic` that overlap `area`, cut to `area`. The
+/// squares start at the picture's top-left corner, which is light.
+pub fn grid_cells(pic: Rect, area: Rect) -> Vec<Rect> {
+    let area = pic.intersect(area);
+    let mut out = Vec::new();
+    if !area.is_positive() || !pic.min.is_finite() || !pic.max.is_finite() {
+        return out;
+    }
+    let first = |lo: f32, origin: f32| ((lo - origin) / GRID_CELL).floor() as i64;
+    let (c0, c1) = (first(area.min.x, pic.min.x), first(area.max.x, pic.min.x));
+    let (r0, r1) = (first(area.min.y, pic.min.y), first(area.max.y, pic.min.y));
+    // no screen holds more squares than this across or down
+    const MAX_SQUARES: i64 = 4096;
+    if c1.saturating_sub(c0) > MAX_SQUARES || r1.saturating_sub(r0) > MAX_SQUARES {
+        return out;
+    }
+    for row in r0..=r1 {
+        for col in c0..=c1 {
+            // light where row + col is even (`^` gives the parity without an overflowing sum)
+            if (row ^ col) & 1 == 0 {
+                continue;
+            }
+            let min = pos2(pic.min.x + col as f32 * GRID_CELL, pic.min.y + row as f32 * GRID_CELL);
+            let cell = Rect::from_min_size(min, vec2(GRID_CELL, GRID_CELL)).intersect(area);
+            if cell.is_positive() {
+                out.push(cell);
+            }
+        }
+    }
+    out
+}
+
+/// Paint the Transparency Grid behind the picture `pic`, where it overlaps `visible`: light
+/// squares as one rectangle, the dark ones as one mesh.
+pub fn transparency_grid(p: &egui::Painter, pic: Rect, visible: Rect) {
+    let area = pic.intersect(visible);
+    if !area.is_positive() {
+        return;
+    }
+    p.rect_filled(area, 0.0, GRID_LIGHT);
+    let mut mesh = egui::Mesh::default();
+    for cell in grid_cells(pic, area) {
+        mesh.add_colored_rect(cell, GRID_DARK);
+    }
+    p.add(egui::Shape::mesh(mesh));
+}
+
 /// The on-screen picture rect: fitted, or magnified about the area centre plus the (clamped) pan.
 pub fn picture_rect(area: Rect, fw: f32, fh: f32, v: &MonitorView, ppp: f32) -> Rect {
     match v.zoom {
@@ -385,7 +444,7 @@ pub fn zoom_pan_input(app: &mut FilmcraftApp, ui: &mut egui::Ui, w: Which, area:
     }
     let mut d = Vec2::ZERO;
     // a middle-button drag that began over the picture pans it, whatever the tool
-    let held = egui::Id::new((prefix(w), "middle-pan"));
+    let held = egui::Id::unique((prefix(w), "middle-pan"));
     let (pressed, down, moved) = ui.input(|i| (i.pointer.button_pressed(egui::PointerButton::Middle), i.pointer.middle_down(), i.pointer.delta()));
     let panning = down && (ui.data(|m| m.get_temp::<bool>(held)).unwrap_or(false) || (pressed && ui.rect_contains_pointer(area)));
     ui.data_mut(|m| m.insert_temp(held, panning));
@@ -394,7 +453,7 @@ pub fn zoom_pan_input(app: &mut FilmcraftApp, ui: &mut egui::Ui, w: Which, area:
         d += moved;
     }
     if app.ui.tool == Tool::Hand {
-        let resp = ui.interact(area, egui::Id::new((prefix(w), "pan")), Sense::drag());
+        let resp = ui.interact(area, egui::Id::unique((prefix(w), "pan")), Sense::drag());
         if resp.hovered() || resp.dragged() {
             ui.ctx().set_cursor_icon(if resp.dragged() { egui::CursorIcon::Grabbing } else { egui::CursorIcon::Grab });
         }
@@ -506,9 +565,9 @@ pub fn rulers(app: &mut FilmcraftApp, ui: &mut egui::Ui, w: Which, top: Rect, le
             }
         }
     }
-    let drag_id = egui::Id::new((pfx, "new-guide"));
+    let drag_id = egui::Id::unique((pfx, "new-guide"));
     for (r, name, vertical) in [(top, "top", false), (left, "left", true)] {
-        let resp = ui.interact(r, egui::Id::new((pfx, "ruler", name)), Sense::drag());
+        let resp = ui.interact(r, egui::Id::unique((pfx, "ruler", name)), Sense::drag());
         app.auto.add(&format!("{pfx}.ruler.{name}"), r, if vertical { "left ruler" } else { "top ruler" });
         if resp.hovered() {
             ui.ctx().set_cursor_icon(if vertical { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::ResizeVertical });
@@ -560,13 +619,13 @@ pub fn guides(app: &mut FilmcraftApp, ui: &mut egui::Ui, w: Which, area: Rect, p
         if v.lock_guides {
             continue;
         }
-        let resp = ui.interact(hit, egui::Id::new((pfx, "guide", i)), Sense::drag());
+        let resp = ui.interact(hit, egui::Id::unique((pfx, "guide", i)), Sense::drag());
         if resp.hovered() || resp.dragged() {
             ui.ctx().set_cursor_icon(if g.vertical { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::ResizeVertical });
         }
         let left = egui::PointerButton::Primary;
         // egui ends a drag on Escape: that stop puts the guide back where it was (#580)
-        let before_id = egui::Id::new((pfx, "guide-before-drag", i));
+        let before_id = egui::Id::unique((pfx, "guide-before-drag", i));
         if resp.drag_started_by(left) {
             ui.data_mut(|d| d.insert_temp(before_id, g.position));
         }
@@ -651,7 +710,7 @@ pub fn waveform(
     }
     let x = xof(time);
     p.line_segment([pos2(x, area.min.y), pos2(x, area.max.y)], Stroke::new(1.0, t.playhead));
-    let resp = ui.interact(area, egui::Id::new("source-waveform"), Sense::click_and_drag());
+    let resp = ui.interact(area, egui::Id::unique("source-waveform"), Sense::click_and_drag());
     app.auto.add("source.waveform", area, "audio waveform");
     // Horizontal waveform drags scrub; dragging vertically lifts the marked audio to the timeline.
     let delta = resp.drag_delta();
@@ -694,7 +753,7 @@ pub fn compare_bar(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, rate: f
     ] {
         let r = Rect::from_min_max(pos2(x - 34.0, bar.min.y + 1.0), pos2(x - 2.0, bar.max.y - 1.0));
         x -= 34.0;
-        let resp = ui.interact(r, egui::Id::new(("compare", key)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("compare", key)), Sense::click()).on_hover_text(tip);
         ui.painter().rect_filled(r, 3.0, if resp.hovered() { t.hover } else { t.field_bg });
         ui.painter().text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(10.0), t.text);
         app.auto.add(&format!("program.compare.{key}"), r, tip);
@@ -761,6 +820,7 @@ pub fn wrench_items(app: &mut FilmcraftApp, ui: &mut egui::Ui, w: Which) {
     if w == Which::Program {
         pick(ui, &mut out, "snapInProgramMonitor", tl!("Snap in Program Monitor"), v.snap);
     }
+    pick(ui, &mut out, "transparencyGrid", tl!("Transparency Grid"), v.transparency_grid);
     ui.separator();
     let pfx = prefix(w);
     for (key, r, label, clicked) in out {
@@ -801,7 +861,7 @@ fn push(e: &mut Elems, id: &str, r: &egui::Response, label: &str) {
 /// Add Guide… / Save Guides as Template… / Manage Guides… dialogs.
 pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.guide_dialog.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("guide-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("guide-dialog-before-drag"), &mut d);
     let mut elems: Elems = Vec::new();
     let mut close = crate::widgets::escape_closes(ctx);
     let mut act: Option<(String, Value)> = None;
@@ -812,7 +872,7 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
         GuideDialog::Manage { .. } => ("Manage Guides", tl!("Manage Guides")),
     };
     egui::Window::new(shown)
-        .id(egui::Id::new(title))
+        .id(egui::Id::unique(title))
         .collapsible(false)
         .resizable(false)
         .pivot(Align2::CENTER_CENTER)
@@ -933,12 +993,31 @@ mod tests {
         assert_eq!(snap_axis([10.0, 20.0, 30.0], &[8.0, 21.0], 6.0), Some((1.0, 21.0)));
     }
 
+    #[test]
+    fn grid_cells_alternate_from_a_light_corner_and_stay_in_view() {
+        let pic = Rect::from_min_size(pos2(100.0, 50.0), vec2(4.0 * GRID_CELL, 2.0 * GRID_CELL));
+        let mins: Vec<_> = grid_cells(pic, Rect::EVERYTHING).iter().map(|r| ((r.min.x - 100.0) / GRID_CELL, (r.min.y - 50.0) / GRID_CELL)).collect();
+        assert_eq!(mins, [(1.0, 0.0), (3.0, 0.0), (0.0, 1.0), (2.0, 1.0)]);
+        // a magnified picture: only the squares in view, cut to it, keeping the picture's pattern
+        let big = Rect::from_min_size(pos2(-1000.0, -1000.0), vec2(4000.0, 4000.0));
+        let view = Rect::from_min_size(pos2(3.0, 0.0), vec2(20.0, 8.0));
+        let cells = grid_cells(big, view);
+        assert!(cells.iter().all(|c| view.contains_rect(*c)), "{cells:?}");
+        assert_eq!(cells, [Rect::from_min_max(pos2(8.0, 0.0), pos2(16.0, 8.0))]);
+        assert!(grid_cells(pic, Rect::from_min_size(pos2(0.0, 0.0), vec2(10.0, 10.0))).is_empty(), "nothing outside the picture");
+        // a picture magnified far past the zoom menu (`ui.set` takes any zoom) does not overflow
+        let huge = Rect::from_min_max(pos2(-1e20, -1e20), pos2(1e20, 1e20));
+        assert!(grid_cells(huge, view).len() <= 6);
+        assert!(grid_cells(Rect::from_min_max(pos2(f32::NEG_INFINITY, 0.0), pos2(f32::INFINITY, 1.0)), view).is_empty());
+    }
+
     #[test]
     fn channel_view_greyscales() {
-        let img = Rgba { w: 2, h: 1, px: vec![200, 100, 50, 255, 255, 255, 255, 0] };
-        assert_eq!(channel_view(&img, DisplayMode::Red).px, vec![200, 200, 200, 255, 0, 0, 0, 255]);
+        // an opaque pixel, a transparent one and a half-transparent one (color premultiplied)
+        let img = Rgba { w: 3, h: 1, px: vec![200, 100, 50, 255, 0, 0, 0, 0, 90, 40, 20, 128] };
+        assert_eq!(channel_view(&img, DisplayMode::Red).px, vec![200, 200, 200, 255, 0, 0, 0, 255, 90, 90, 90, 255]);
         assert_eq!(channel_view(&img, DisplayMode::Green).px[..4], [100, 100, 100, 255]);
-        assert_eq!(channel_view(&img, DisplayMode::Alpha).px, vec![255, 255, 255, 255, 0, 0, 0, 255]);
+        assert_eq!(channel_view(&img, DisplayMode::Alpha).px, vec![255, 255, 255, 255, 0, 0, 0, 255, 128, 128, 128, 255]);
     }
 
     #[test]
diff --git a/crates/ui-egui/src/panels/multicam.rs b/crates/ui-egui/src/panels/multicam.rs
index f8ebe9ecc..70f0ffe0d 100644
--- a/crates/ui-egui/src/panels/multicam.rs
+++ b/crates/ui-egui/src/panels/multicam.rs
@@ -70,8 +70,10 @@ pub fn route(app: &mut FilmcraftApp, id: &str, params: &Value) -> Option<Result<
     if let Err(e) = filmcraft_engine::find_command(id).map_or(Ok(()), |c| (c.enabled)(&app.session)) {
         return Some(Err(e));
     }
-    let items: Vec<u64> = app.session.state.project_selection.iter().map(|i| i.0).collect();
-    let first = app.session.state.project_selection.first().and_then(|i| app.session.project.item(*i)).map(|i| i.name.clone()).unwrap_or_default();
+    // the Project panel's selection, or the media of the clips selected in the Timeline (#1362)
+    let selected = filmcraft_engine::multicam::selected_items(&app.session);
+    let items: Vec<u64> = selected.iter().map(|i| i.0).collect();
+    let first = selected.first().and_then(|i| app.session.project.item(*i)).map(|i| i.name.clone()).unwrap_or_default();
     let name = match kind {
         "merge" => tlf!("{first} - Merged", first),
         "multicam" => tlf!("{first} Multicam", first),
@@ -93,7 +95,7 @@ fn methods() -> [(&'static str, &'static str); 5] {
 /// Draw the open Synchronize / Merge Clips / Create Multi-Camera dialog.
 pub fn show_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.sync_dialog.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("sync-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("sync-dialog-before-drag"), &mut d);
     let (title, pre) = match d.kind.as_str() {
         "merge" => (tl!("Merge Clips"), "merge"),
         "multicam" => (tl!("Create Multi-Camera Source Sequence"), "mcam"),
@@ -104,7 +106,7 @@ pub fn show_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let accent = app.tokens.accent;
     let names: Vec<String> = d.items.iter().filter_map(|i| app.session.project.item(ItemId(*i)).map(|it| it.name.clone())).collect();
     egui::Window::new(title)
-        .id(egui::Id::new(("sync-dialog", pre)))
+        .id(egui::Id::unique(("sync-dialog", pre)))
         .collapsible(false)
         .resizable(false)
         .default_width(440.0)
@@ -114,7 +116,7 @@ pub fn show_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
             if pre != "sync" {
                 ui.horizontal(|ui| {
                     ui.label(if pre == "merge" { tl!("Clip Name:") } else { tl!("Sequence Name:") });
-                    let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0));
+                    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0)), "Sequence Name");
                     push(&mut elems, format!("{pre}.name"), &r, "name");
                 });
                 ui.label(RichText::new(tlf!("{n} clip(s): {names}", n = names.len(), names = names.join(", "))).weak().small());
@@ -139,9 +141,12 @@ pub fn show_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
                                 push(&mut elems, format!("{pre}.ignoreHours"), &r, "Ignore Hours");
                             }
                             "marker" => {
-                                let r = ui.add_enabled(
-                                    d.method == "marker",
-                                    egui::TextEdit::singleline(&mut d.marker).hint_text(tl!("first marker")).desired_width(140.0),
+                                let r = crate::widgets::accessible_name(
+                                    ui.add_enabled(
+                                        d.method == "marker",
+                                        egui::TextEdit::singleline(&mut d.marker).hint_text(tl!("first marker")).desired_width(140.0),
+                                    ),
+                                    "first marker",
                                 );
                                 push(&mut elems, format!("{pre}.marker"), &r, "marker name");
                             }
@@ -159,7 +164,10 @@ pub fn show_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 "sync" => {
                     ui.horizontal(|ui| {
                         ui.label(tl!("Reference track:"));
-                        let r = ui.add(egui::TextEdit::singleline(&mut d.track).hint_text(tl!("lowest (V1…)")).desired_width(90.0));
+                        let r = crate::widgets::accessible_name(
+                            ui.add(egui::TextEdit::singleline(&mut d.track).hint_text(tl!("lowest (V1…)")).desired_width(90.0)),
+                            "Reference track",
+                        );
                         push(&mut elems, "sync.track", &r, "reference track");
                     });
                 }
@@ -352,7 +360,7 @@ pub fn grid(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect) {
         let cell_i = k - lay.first;
         let cell = Rect::from_min_size(pic.min + vec2((cell_i % cols) as f32 * cw, (cell_i / cols) as f32 * ch), vec2(cw, ch));
         let name = cams.cameras.get(angle).map(|c| c.name.clone()).unwrap_or_default();
-        let resp = ui.interact(cell, egui::Id::new(("multicam-angle", k)), Sense::click()).on_hover_text(tlf!("Camera {n} — {name}", n = k + 1, name));
+        let resp = ui.interact(cell, egui::Id::unique(("multicam-angle", k)), Sense::click()).on_hover_text(tlf!("Camera {n} — {name}", n = k + 1, name));
         app.auto.add(&format!("program.multicam.angle.{}", k + 1), cell, &name);
         if resp.clicked() {
             // modifiers held now, or carried by the click event (synthetic input)
@@ -383,7 +391,7 @@ pub fn grid(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect) {
         for (id, label, dx, cmd) in [("pagePrev", "◀", -70.0, "multicam.prevPage"), ("pageNext", "▶", 70.0, "multicam.nextPage")] {
             let r = Rect::from_center_size(mid + vec2(dx, 0.0), vec2(26.0, 18.0));
             let enabled = if cmd == "multicam.prevPage" { lay.page > 0 } else { lay.page + 1 < lay.pages };
-            let resp = ui.interact(r, egui::Id::new(("multicam-page", id)), Sense::click()).on_hover_text(if dx < 0.0 {
+            let resp = ui.interact(r, egui::Id::unique(("multicam-page", id)), Sense::click()).on_hover_text(if dx < 0.0 {
                 tl!("Previous page")
             } else {
                 tl!("Next page")
@@ -399,7 +407,7 @@ pub fn grid(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect) {
     // record indicator
     let rr = Rect::from_min_size(area.min + vec2(8.0, 8.0), vec2(64.0, 18.0));
     let rec_on = app.ui.multicam_record;
-    let resp = ui.interact(rr, egui::Id::new("multicam-record"), Sense::click()).on_hover_text(tl!("Multi-Camera Record On/Off (0)"));
+    let resp = ui.interact(rr, egui::Id::unique("multicam-record"), Sense::click()).on_hover_text(tl!("Multi-Camera Record On/Off (0)"));
     app.auto.add("program.multicam.record", rr, "Multi-Camera Record");
     let dot = if recording {
         Color32::from_rgb(0xe0, 0x3a, 0x3a)
@@ -453,7 +461,7 @@ pub fn show_edit_cameras(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let th = thumb_w * q.settings.height.max(1) as f32 / q.settings.width.max(1) as f32;
     let tokens = app.tokens;
     egui::Window::new(tl!("Edit Cameras"))
-        .id(egui::Id::new("Edit Cameras"))
+        .id(egui::Id::unique("Edit Cameras"))
         .collapsible(false)
         .resizable(false)
         .default_width(420.0)
@@ -479,7 +487,10 @@ pub fn show_edit_cameras(app: &mut FilmcraftApp, ctx: &egui::Context) {
                         }
                         elems.push((format!("editCameras.thumb.{a}"), tr, format!("Camera {}", a + 1)));
                         ui.label(format!("{}", a + 1));
-                        let r = ui.add(egui::TextEdit::singleline(&mut d.names[a]).desired_width(180.0));
+                        let r = crate::widgets::accessible_name(
+                            ui.add(egui::TextEdit::singleline(&mut d.names[a]).desired_width(180.0)),
+                            format!("Camera {}", a + 1),
+                        );
                         push(&mut elems, format!("editCameras.name.{a}"), &r, "Camera name");
                     });
                 }
diff --git a/crates/ui-egui/src/panels/notes.rs b/crates/ui-egui/src/panels/notes.rs
index 740db1f46..c5dc51723 100644
--- a/crates/ui-egui/src/panels/notes.rs
+++ b/crates/ui-egui/src/panels/notes.rs
@@ -35,7 +35,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         })
         .inner;
     // each focus of the editor starts a new undo step; the edits while it keeps focus join it
-    let typing = egui::Id::new("project-notes-typing");
+    let typing = egui::Id::unique("project-notes-typing");
     if r.gained_focus() {
         ui.data_mut(|d| {
             let n = d.get_temp::<u64>(typing).unwrap_or(0).wrapping_add(1);
diff --git a/crates/ui-egui/src/panels/presets.rs b/crates/ui-egui/src/panels/presets.rs
index b6639bda3..a61f6c041 100644
--- a/crates/ui-egui/src/panels/presets.rs
+++ b/crates/ui-egui/src/panels/presets.rs
@@ -26,7 +26,8 @@ pub fn folder_rows(app: &mut FilmcraftApp, ui: &mut egui::Ui, filter: &str) -> O
         if resp.hovered() {
             ui.painter().rect_filled(r, 0.0, t.hover);
         }
-        let x = r.min.x + 30.0;
+        // inside the Presets folder: icon and label one level deeper than it (#2329)
+        let x = r.min.x + crate::panels::effects::tree_x(1) + 18.0;
         icons::paint(
             ui.painter(),
             Rect::from_center_size(pos2(x, r.center().y), vec2(13.0, 13.0)),
@@ -102,12 +103,12 @@ pub fn save_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let mut open = true;
     let mut close = false;
     let mut apply = false;
-    egui::Window::new(tl!("Save Preset")).id(egui::Id::new("Save Preset")).open(&mut open).collapsible(false).resizable(false).default_width(340.0).show(
+    egui::Window::new(tl!("Save Preset")).id(egui::Id::unique("Save Preset")).open(&mut open).collapsible(false).resizable(false).default_width(340.0).show(
         ctx,
         |ui| {
             ui.horizontal(|ui| {
                 ui.label(tl!("Name:"));
-                let r = ui.text_edit_singleline(&mut d.name);
+                let r = crate::widgets::accessible_name(ui.text_edit_singleline(&mut d.name), tl!("Name"));
                 app.auto.add("savePreset.name", r.rect, "Name");
             });
             ui.add_space(4.0);
@@ -126,7 +127,7 @@ pub fn save_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
             }
             ui.add_space(4.0);
             ui.label(tl!("Description:"));
-            let r = ui.text_edit_multiline(&mut d.description);
+            let r = crate::widgets::accessible_name(ui.text_edit_multiline(&mut d.description), tl!("Description"));
             app.auto.add("savePreset.description", r.rect, "Description");
             ui.add_space(6.0);
             ui.horizontal(|ui| {
diff --git a/crates/ui-egui/src/panels/project.rs b/crates/ui-egui/src/panels/project.rs
index e6d95c0e8..103c040f9 100644
--- a/crates/ui-egui/src/panels/project.rs
+++ b/crates/ui-egui/src/panels/project.rs
@@ -310,7 +310,7 @@ fn tab_strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, strip: Rect, docked: &[u
             _ => false,
         };
         let id = k.map_or("project.tab.project".to_string(), |k| format!("project.tab.{k}"));
-        let resp = ui.interact(r, egui::Id::new(&id), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(&id), Sense::click());
         app.auto.add(&id, r, &label);
         if is_active || resp.hovered() {
             ui.painter().rect_filled(r, 3.0, if is_active { t.pressed } else { t.hover });
@@ -321,7 +321,7 @@ fn tab_strip(app: &mut FilmcraftApp, ui: &mut egui::Ui, strip: Rect, docked: &[u
         }
         if let Some(k) = k {
             let cr = Rect::from_center_size(pos2(r.max.x - 11.0, r.center().y), vec2(12.0, 12.0));
-            let cresp = ui.interact(cr, egui::Id::new(("ptab-close", k)), Sense::click()).on_hover_text(tl!("Close"));
+            let cresp = ui.interact(cr, egui::Id::unique(("ptab-close", k)), Sense::click()).on_hover_text(tl!("Close"));
             app.auto.add(&format!("project.tab.{k}.close"), cr, "Close");
             icons::paint(ui.painter(), cr.shrink(2.0), Icon::Close, if cresp.hovered() { t.text } else { t.text_dim });
             if cresp.clicked() || resp.middle_clicked() {
@@ -352,7 +352,7 @@ pub fn floating(app: &mut FilmcraftApp, ctx: &egui::Context) {
         let mut open = true;
         let root = app.ui.project_panel.tabs[k].bin == app.session.project.root.id.0;
         egui::Window::new(if root { tlf!("Project: {name}", name = app.session.project.name) } else { tlf!("Bin: {name}", name) })
-            .id(egui::Id::new(("bin-window", k)))
+            .id(egui::Id::unique(("bin-window", k)))
             .open(&mut open)
             .default_size(vec2(520.0, 360.0))
             .min_size(vec2(320.0, 220.0))
@@ -397,7 +397,7 @@ fn body(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &View, actions
         Inst::Tab(k) => BinId(app.ui.project_panel.tabs[k].bin),
     };
     let up = Rect::from_min_size(pos2(head.min.x, head.center().y - 9.0), vec2(22.0, 18.0));
-    let up_resp = ui.interact(up, egui::Id::new((&pre, "up")), Sense::click()).on_hover_text(tl!("Up one level"));
+    let up_resp = ui.interact(up, egui::Id::unique((&pre, "up")), Sense::click()).on_hover_text(tl!("Up one level"));
     app.auto.add(&format!("{pre}.up"), up, "Up one level");
     let can_up = v.bin != top;
     if up_resp.hovered() && can_up {
@@ -429,7 +429,7 @@ fn body(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &View, actions
     app.ui.project_search = q;
     app.auto.add(&format!("{pre}.search"), search_rect, "Search");
     let find = Rect::from_min_size(pos2(search_rect.max.x + 8.0, row.min.y), vec2(24.0, 22.0));
-    let fr = ui.interact(find, egui::Id::new((&pre, "find")), Sense::click()).on_hover_text(tl!("Find…"));
+    let fr = ui.interact(find, egui::Id::unique((&pre, "find")), Sense::click()).on_hover_text(tl!("Find…"));
     app.auto.add(&format!("{pre}.find"), find, "Find…");
     if fr.hovered() {
         ui.painter().rect_filled(find, 3.0, t.hover);
@@ -562,7 +562,7 @@ fn footer(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, v: &View, action
         (Icon::Freeform, ViewMode::Freeform, tl!("Freeform View")),
     ] {
         let r = Rect::from_min_size(pos2(x, bar.min.y + 5.0), vec2(26.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new((pre, "pv", tip)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique((pre, "pv", tip)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("{pre}.view.{mode:?}"), r, tip);
         if v.mode == mode {
             ui.painter().rect_filled(r, 4.0, t.pressed);
@@ -579,10 +579,10 @@ fn footer(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, v: &View, action
     let sw = (bar.width() - 300.0).clamp(40.0, 120.0);
     let sr = Rect::from_min_size(pos2(x + 8.0, bar.min.y + 8.0), vec2(sw, 16.0));
     let mut sz = v.icon_size;
-    let resp = ui.put(sr, egui::Slider::new(&mut sz, 48.0..=400.0).show_value(false));
+    let resp = crate::widgets::accessible_name(ui.put(sr, egui::Slider::new(&mut sz, 48.0..=400.0).show_value(false)), tl!("Zoom"));
     app.auto.add(&format!("{pre}.iconSize"), sr, "Zoom");
     // a drag ended by Escape goes back to the size it started from (#580)
-    let orig_id = egui::Id::new((pre, "icon-size-before-drag"));
+    let orig_id = egui::Id::unique((pre, "icon-size-before-drag"));
     if resp.drag_started() {
         ui.data_mut(|d| d.insert_temp(orig_id, v.icon_size));
     }
@@ -606,7 +606,7 @@ fn footer(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, v: &View, action
     // Sort Icons (Icon view)
     if v.mode == ViewMode::Icon {
         let r = Rect::from_min_size(pos2(x, bar.min.y + 5.0), vec2(24.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new((pre, "sortIcons")), Sense::click()).on_hover_text(tl!("Sort Icons"));
+        let resp = ui.interact(r, egui::Id::unique((pre, "sortIcons")), Sense::click()).on_hover_text(tl!("Sort Icons"));
         app.auto.add(&format!("{pre}.sortIcons"), r, "Sort Icons");
         if resp.hovered() {
             ui.painter().rect_filled(r, 3.0, t.hover);
@@ -623,13 +623,24 @@ fn footer(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, v: &View, action
         (Icon::Automate, "clip.automateToSequence", tl!("Automate to Sequence")),
     ] {
         let r = Rect::from_min_size(pos2(rx - 24.0, bar.min.y + 5.0), vec2(24.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new((pre, "pb", id)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique((pre, "pb", id)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("{pre}.button.{id}"), r, tip);
         if resp.hovered() {
             ui.painter().rect_filled(r, 3.0, t.hover);
         }
         icons::paint(ui.painter(), r.shrink(5.0), icon, t.icon);
         if id == "new-item" {
+            // a clip dropped here makes a sequence that matches it, as in Premiere (#2855)
+            if let Some(item) = crate::panels::dragged_panel_item(ui)
+                && ui.rect_contains_pointer(r)
+            {
+                ui.painter().rect_stroke(r, 3.0, Stroke::new(1.5, app.tokens.accent), egui::StrokeKind::Inside);
+                if ui.input(|i| i.pointer.any_released()) {
+                    let items: Vec<u64> = crate::panels::dragged_selection(app, item).iter().map(|i| i.0).collect();
+                    actions.push(("file.newSequenceFromClip".into(), json!({"items": items})));
+                    crate::panels::clear_drag(ui);
+                }
+            }
             egui::Popup::menu(&resp).show(|ui| new_item_menu(app, ui, pre, actions));
         } else if resp.clicked() {
             match id {
diff --git a/crates/ui-egui/src/panels/project_dialogs.rs b/crates/ui-egui/src/panels/project_dialogs.rs
index 933770387..13d5a134c 100644
--- a/crates/ui-egui/src/panels/project_dialogs.rs
+++ b/crates/ui-egui/src/panels/project_dialogs.rs
@@ -10,12 +10,13 @@ use crate::FilmcraftApp;
 use crate::panels::project::ProjectDialog;
 
 fn push(app: &mut FilmcraftApp, id: &str, r: &egui::Response, label: &str) {
+    crate::widgets::accessible_name(r.clone(), label);
     app.auto.add(id, r.rect, label);
 }
 
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(mut d) = app.ui.project_panel.dialog.clone() else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("project-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("project-dialog-before-drag"), &mut d);
     let mut close = false;
     let mut run: Option<(String, Value)> = None;
     let title = match &d {
@@ -25,7 +26,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         ProjectDialog::FreeformOptions { .. } => tl!("Freeform View Options"),
         ProjectDialog::SaveArrangement { .. } => tl!("Save Arrangement"),
     };
-    let mut win = egui::Window::new(title).id(egui::Id::new("project-dialog")).collapsible(false).resizable(false).centered(ctx);
+    let mut win = egui::Window::new(title).id(egui::Id::unique("project-dialog")).collapsible(false).resizable(false).centered(ctx);
     // a fixed size keeps the two-list dialog from shifting while its lists settle
     if matches!(d, ProjectDialog::MetadataDisplay { .. }) {
         win = win.fixed_size(egui::vec2(480.0, 470.0));
@@ -36,7 +37,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
             ProjectDialog::SavePresetAs { name } => {
                 ui.horizontal(|ui| {
                     ui.label(tl!("Name:"));
-                    let r = ui.add(egui::TextEdit::singleline(name).desired_width(240.0));
+                    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(name).desired_width(240.0)), "Name");
                     push(app, "projectDialog.name", &r, "Name");
                 });
                 if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
@@ -74,7 +75,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
             ProjectDialog::SaveArrangement { name, bin } => {
                 ui.horizontal(|ui| {
                     ui.label(tl!("Name:"));
-                    let r = ui.add(egui::TextEdit::singleline(name).desired_width(240.0));
+                    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(name).desired_width(240.0)), "Name");
                     push(app, "projectDialog.name", &r, "Name");
                 });
                 if ok_cancel(app, ui, &mut close) && !name.trim().is_empty() {
@@ -124,7 +125,8 @@ fn metadata_display(app: &mut FilmcraftApp, ui: &mut egui::Ui, columns: &mut Vec
     let all = filmcraft_engine::project_panel::all_columns(&app.session.project);
     ui.horizontal(|ui| {
         ui.label(tl!("Show:"));
-        let r = ui.add(egui::TextEdit::singleline(filter).hint_text(tl!("Search fields")).desired_width(220.0));
+        let r =
+            crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(filter).hint_text(tl!("Search fields")).desired_width(220.0)), "Search fields");
         push(app, "projectDialog.filter", &r, "Search fields");
     });
     ui.add_space(4.0);
@@ -217,7 +219,7 @@ fn manage_presets(app: &mut FilmcraftApp, ui: &mut egui::Ui, selected: &mut usiz
     let filled = presets.get(*selected).is_some_and(Option::is_some);
     ui.horizontal(|ui| {
         ui.label(tl!("Name:"));
-        let r = ui.add_enabled(filled, egui::TextEdit::singleline(name).desired_width(200.0));
+        let r = crate::widgets::accessible_name(ui.add_enabled(filled, egui::TextEdit::singleline(name).desired_width(200.0)), "Name");
         push(app, "projectDialog.name", &r, "Name");
         let b = ui.add_enabled(filled, egui::Button::new(tl!("Rename")));
         push(app, "projectDialog.rename", &b, "Rename");
diff --git a/crates/ui-egui/src/panels/project_views.rs b/crates/ui-egui/src/panels/project_views.rs
index d908725a1..5183f8269 100644
--- a/crates/ui-egui/src/panels/project_views.rs
+++ b/crates/ui-egui/src/panels/project_views.rs
@@ -414,11 +414,14 @@ fn rename_field(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, item: Option
         return false;
     }
     let mut text = rn.text;
-    let id = egui::Id::new(("rename-field", pre, item, bin));
-    let resp = ui.put(r, egui::TextEdit::singleline(&mut text).id(id).font(egui::FontId::proportional(font(app))).margin(vec2(3.0, 1.0)));
+    let id = egui::Id::unique(("rename-field", pre, item, bin));
+    let resp = crate::widgets::accessible_name(
+        ui.put(r, egui::TextEdit::singleline(&mut text).id(id).font(egui::FontId::proportional(font(app))).margin(vec2(3.0, 1.0))),
+        "Rename",
+    );
     app.auto.add(&format!("{pre}.rename"), r, "Rename");
     // take keyboard focus the first frame the field is shown
-    let shown = egui::Id::new("project-rename-shown");
+    let shown = egui::Id::unique("project-rename-shown");
     if ui.ctx().data(|d| d.get_temp::<egui::Id>(shown)) != Some(id) {
         ui.ctx().data_mut(|d| d.insert_temp(shown, id));
         resp.request_focus();
@@ -444,7 +447,7 @@ fn rename_field(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, item: Option
 /// A second click on the name of the only selected item starts renaming it (after the
 /// double-click interval, so a double-click still opens it).
 fn slow_click_rename(app: &mut FilmcraftApp, ui: &egui::Ui, resp: &egui::Response, name_rect: Rect, id: ItemId, was_selected: bool) {
-    let key = egui::Id::new("project-rename-pending");
+    let key = egui::Id::unique("project-rename-pending");
     let now = ui.input(|i| i.time);
     if resp.double_clicked() {
         ui.ctx().data_mut(|d| d.remove::<(u64, f64)>(key));
@@ -513,13 +516,13 @@ pub fn list_view(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &View
     let hp = ui.painter().with_clip_rect(hr.intersect(ui.clip_rect()));
     hp.rect_filled(hr, 0.0, t.panel_bg);
     hp.line_segment([hr.left_bottom(), hr.right_bottom()], Stroke::new(1.0, t.separator));
-    let mut x = rect.min.x + LEAD - out.state.offset.x;
+    let mut x = rect.min.x + LEAD - out.state.clamped_offset().x;
     let sort = app.session.prefs.project_panel.view.sort.clone();
     for (i, c) in lc.cols.iter().enumerate() {
         let cr = Rect::from_min_size(pos2(x, hr.min.y), vec2(c.width, header_h));
         let vis = cr.intersect(hr);
         if vis.width() > 1.0 {
-            let id = egui::Id::new((&v.prefix, "col", &c.name));
+            let id = egui::Id::unique((&v.prefix, "col", &c.name));
             let resp = ui.interact(vis, id, Sense::click()).on_hover_text(crate::i18n::t(&c.name));
             app.auto.add(&format!("{}.list.header.{}", v.prefix, c.name), vis, &c.name);
             if resp.hovered() {
@@ -551,7 +554,7 @@ pub fn list_view(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &View
         // resize handle on the column's right edge
         let hr2 = Rect::from_center_size(pos2(cr.max.x, hr.center().y), vec2(8.0, header_h));
         if hr2.intersects(hr) {
-            let id = egui::Id::new((&v.prefix, "colsize", &c.name));
+            let id = egui::Id::unique((&v.prefix, "colsize", &c.name));
             let resp = ui.interact(hr2.intersect(hr), id, Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeColumn);
             app.auto.add(&format!("{}.list.resize.{}", v.prefix, c.name), hr2.intersect(hr), "Resize column");
             hp.line_segment([pos2(cr.max.x, hr.min.y + 4.0), pos2(cr.max.x, hr.max.y - 4.0)], Stroke::new(1.0, t.separator));
@@ -574,7 +577,7 @@ pub fn list_view(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &View
 /// sit on top). Starts the frame's [`note_hit`] list.
 fn background(ui: &egui::Ui, v: &View) -> egui::Response {
     ui.data_mut(|d| d.remove::<Vec<(u64, Rect)>>(hits_id(v)));
-    ui.interact(ui.clip_rect(), egui::Id::new((&v.prefix, "background")), Sense::click_and_drag())
+    ui.interact(ui.clip_rect(), egui::Id::unique((&v.prefix, "background")), Sense::click_and_drag())
 }
 
 /// Empty space under the rows / cards, and the gaps between them (`bg`): click deselects,
@@ -598,7 +601,7 @@ fn empty_space(app: &mut FilmcraftApp, ui: &mut egui::Ui, v: &View, bg: &egui::R
 }
 
 fn hits_id(v: &View) -> egui::Id {
-    egui::Id::new((&v.prefix, "marquee-hits"))
+    egui::Id::unique((&v.prefix, "marquee-hits"))
 }
 
 /// Remember where an item's row or card was drawn this frame, for [`marquee`].
@@ -612,7 +615,7 @@ fn note_hit(ui: &egui::Ui, v: &View, id: ItemId, r: Rect) {
 fn marquee(app: &mut FilmcraftApp, ui: &egui::Ui, v: &View, bg: &egui::Response, origin: egui::Pos2, actions: &mut Actions) {
     // (press point relative to `origin`, selection when the drag began, adds to it)
     type Drag = (egui::Vec2, Vec<u64>, bool);
-    let key = egui::Id::new((&v.prefix, "marquee"));
+    let key = egui::Id::unique((&v.prefix, "marquee"));
     let hits: Vec<(u64, Rect)> = ui.data_mut(|d| d.remove_temp(hits_id(v))).unwrap_or_default();
     let current: Vec<u64> = app.session.state.project_selection.iter().map(|i| i.0).collect();
     // the left button only: right-click opens the menu, the middle button is not a selection
@@ -824,7 +827,7 @@ fn hover_time(app: &mut FilmcraftApp, ui: &egui::Ui, resp: &egui::Response, r: R
 fn card(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, id: ItemId, pre: &str, show_name: bool, show_dur: bool, sense: Sense) -> Option<egui::Response> {
     let t = app.tokens;
     let it = app.session.project.item(id).cloned()?;
-    let resp = ui.interact(r.expand(2.0), egui::Id::new((pre, "card", id.0)), sense);
+    let resp = ui.interact(r.expand(2.0), egui::Id::unique((pre, "card", id.0)), sense);
     let th = Rect::from_min_size(r.min, vec2(r.width(), r.width() * 9.0 / 16.0));
     let selected = app.session.state.project_selection.contains(&id);
     let card_bg = Rect::from_min_max(th.min - vec2(6.0, 6.0), pos2(th.max.x + 6.0, r.max.y + 2.0));
@@ -912,7 +915,7 @@ fn card(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, id: ItemId, pre: &st
 fn bin_card(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, b: &Bin, v: &View, actions: &mut Actions) {
     let t = app.tokens;
     let th = Rect::from_min_size(r.min, vec2(r.width(), r.width() * 9.0 / 16.0));
-    let resp = ui.interact(r.expand(2.0), egui::Id::new((&v.prefix, "bincard", b.id.0)), Sense::click_and_drag());
+    let resp = ui.interact(r.expand(2.0), egui::Id::unique((&v.prefix, "bincard", b.id.0)), Sense::click_and_drag());
     let selected = app.ui.project_panel.selected_bin == Some(b.id.0);
     let bg = Rect::from_min_max(th.min - vec2(6.0, 6.0), pos2(th.max.x + 6.0, r.max.y + 2.0));
     ui.painter().rect_filled(bg, 4.0, if selected { t.tl_header_bg } else { t.panel_bg });
@@ -1000,7 +1003,7 @@ pub fn freeform_view(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, v: &
     let opts = app.session.prefs.project_panel.freeform.clone();
     let mut cards: Vec<Card> = pp::freeform_layout(&app.session.project, Some(v.bin), &opts, rect.width());
     cards.retain(|c| matches_filter(app, ItemId(c.item), filter));
-    let drag_key = egui::Id::new((&v.prefix, "ff-drag"));
+    let drag_key = egui::Id::unique((&v.prefix, "ff-drag"));
     // (dragged item, offset so far)
     let dragging: Option<(u64, egui::Vec2)> = ui.ctx().data(|d| d.get_temp(drag_key));
     let sel: Vec<u64> = app.session.state.project_selection.iter().map(|i| i.0).collect();
diff --git a/crates/ui-egui/src/panels/reference.rs b/crates/ui-egui/src/panels/reference.rs
index 4c5c70f68..07f2ded34 100644
--- a/crates/ui-egui/src/panels/reference.rs
+++ b/crates/ui-egui/src/panels/reference.rs
@@ -68,7 +68,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 None => crate::dock::placeholder(ui, area, &t, "…"),
             }
             elems.push(("reference.picture".into(), area, "reference scopes".into()));
-            let resp = ui.interact(area, egui::Id::new("reference-area"), Sense::click());
+            let resp = ui.interact(area, egui::Id::unique("reference-area"), Sense::click());
             egui::Popup::context_menu(&resp).show(|ui| {
                 for k in ScopeKind::ALL {
                     let on = st.scopes.contains(&k);
@@ -101,7 +101,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let w = if icon.is_some() { 24.0 } else { galley_w + 16.0 };
         let r = Rect::from_min_size(pos2(x, bar.center().y - 11.0), vec2(w, 22.0));
         x = r.max.x + 4.0;
-        let resp = ui.interact(r, egui::Id::new(("reference-btn", id.to_string())), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("reference-btn", id.to_string())), Sense::click());
         if on {
             ui.painter().rect_filled(r, 4.0, t.pressed);
         } else if resp.hovered() {
diff --git a/crates/ui-egui/src/panels/remix.rs b/crates/ui-egui/src/panels/remix.rs
index 185bf74cb..c1fe31932 100644
--- a/crates/ui-egui/src/panels/remix.rs
+++ b/crates/ui-egui/src/panels/remix.rs
@@ -20,7 +20,7 @@ struct Draft {
 }
 
 fn draft_id() -> egui::Id {
-    egui::Id::new("remix-properties-draft")
+    egui::Id::unique("remix-properties-draft")
 }
 
 /// Open the dialog for the selected remixed clip (the menu entry without parameters).
@@ -44,12 +44,12 @@ pub fn is_open(ctx: &egui::Context) -> bool {
 
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(Some(mut d)) = ctx.data(|m| m.get_temp::<Option<Draft>>(draft_id())) else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("remix-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("remix-dialog-before-drag"), &mut d);
     let mut close = false;
     let mut apply = false;
     let mut elems: Vec<(String, egui::Rect, String)> = Vec::new();
     egui::Window::new(tl!("Remix Properties"))
-        .id(egui::Id::new("Remix Properties"))
+        .id(egui::Id::unique("Remix Properties"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::CENTER_CENTER)
diff --git a/crates/ui-egui/src/panels/scopes.rs b/crates/ui-egui/src/panels/scopes.rs
index f68b0575a..bf8747961 100644
--- a/crates/ui-egui/src/panels/scopes.rs
+++ b/crates/ui-egui/src/panels/scopes.rs
@@ -57,7 +57,7 @@ pub fn frame_signal(app: &mut FilmcraftApp, ctx: &egui::Context, slot: &str, fra
     let pq = hdr_seq && space == ColorSpace::Rec2100;
     let rate = q.settings.frame_rate;
     let rev = app.session.revision;
-    let id = egui::Id::new(("scope-signal", slot));
+    let id = egui::Id::unique(("scope-signal", slot));
     let cached: Option<(u64, Arc<Signal>, bool)> = ctx.data(|d| d.get_temp(id));
     let key = hash_of((seq_id.0, frame, rev, pq));
     if let Some((k, s, p)) = &cached
@@ -99,7 +99,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         None => crate::dock::placeholder(ui, area, &t, if app.session.state.active_sequence.is_some() { "…" } else { tl!("(no sequence)") }),
     }
     // right-click anywhere on the scopes: the settings menu
-    let resp = ui.interact(area, egui::Id::new("scopes-area"), Sense::click());
+    let resp = ui.interact(area, egui::Id::unique("scopes-area"), Sense::click());
     egui::Popup::context_menu(&resp).show(|ui| settings_menu(app, ui));
     footer(app, ui, Rect::from_min_max(pos2(rect.min.x, area.max.y), rect.max), sf.as_ref().map(|s| s.space));
 }
@@ -134,7 +134,7 @@ fn footer(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, space: Option<Colo
     let cresp = child.checkbox(&mut clamp, tl!("Clamp Signal"));
     app.auto.add("scopes.clamp", cresp.rect, "Clamp Signal");
     let wr = Rect::from_center_size(pos2(cr.min.x - 16.0, r.center().y), vec2(22.0, 22.0));
-    let wresp = ui.interact(wr, egui::Id::new("scopes-wrench"), Sense::click());
+    let wresp = ui.interact(wr, egui::Id::unique("scopes-wrench"), Sense::click());
     icons::paint(ui.painter(), wr.shrink(4.0), Icon::Wrench, if wresp.hovered() { t.tab_text_active } else { t.icon });
     app.auto.add("scopes.wrench", wr, "Scope settings");
     egui::Popup::menu(&wresp).show(|ui| settings_menu(app, ui));
@@ -314,7 +314,7 @@ fn plotted(st: &ScopesState, sf: &ScopeFrame) -> Arc<Signal> {
 
 /// A texture computed from (frame, settings, scope), kept until either changes.
 fn cached_texture(ctx: &egui::Context, slot: String, key: u64, make: impl FnOnce() -> (usize, usize, Vec<u8>)) -> Option<TextureHandle> {
-    let id = egui::Id::new(("scope-tex", slot.clone()));
+    let id = egui::Id::unique(("scope-tex", slot.clone()));
     if let Some((k, tex)) = ctx.data(|d| d.get_temp::<(u64, TextureHandle)>(id))
         && k == key
     {
diff --git a/crates/ui-egui/src/panels/sequence_settings.rs b/crates/ui-egui/src/panels/sequence_settings.rs
index 0bd2f5dec..d043286aa 100644
--- a/crates/ui-egui/src/panels/sequence_settings.rs
+++ b/crates/ui-egui/src/panels/sequence_settings.rs
@@ -299,7 +299,7 @@ fn general(ui: &mut egui::Ui, d: &mut SequenceSettingsDraft, cur: &SequenceSetti
         .fold(0.0, f32::max);
     let list_w = 260.0;
     row(ui, label_w, "Sequence Name:", true, |ui| {
-        let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(list_w));
+        let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(list_w)), "Sequence Name");
         elems.push(("sequenceSettings.name".into(), r.rect, d.name.clone()));
     });
     row(ui, label_w, "Editing Mode:", false, |ui| fixed_combo(ui, elems, "editingMode", "Custom", list_w, NOT_YET));
@@ -475,7 +475,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let audio_samples = app.session.project.settings.audio_display_samples;
     let accent = app.tokens.accent;
     let mut d = app.ui.sequence_settings.clone();
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("sequence-settings-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("sequence-settings-before-drag"), &mut d);
     let mut keep = true;
     let mut apply = false;
     let mut elems: Elems = Vec::new();
@@ -487,7 +487,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
         &[("general", "General"), ("color", "Color Management"), ("vr", "VR Properties")]
     };
     egui::Window::new(title)
-        .id(egui::Id::new("Sequence Settings"))
+        .id(egui::Id::unique("Sequence Settings"))
         .collapsible(false)
         .resizable(false)
         .default_width(620.0)
diff --git a/crates/ui-egui/src/panels/settings.rs b/crates/ui-egui/src/panels/settings.rs
index b48f7d613..f7e1b36ab 100644
--- a/crates/ui-egui/src/panels/settings.rs
+++ b/crates/ui-egui/src/panels/settings.rs
@@ -1,4 +1,4 @@
-//! The Settings dialog (app menu ▸ Settings ▸ <category>; Edit ▸ Preferences in the in-window
+//! The Settings dialog (app menu ▸ Settings ▸ `<category>`; Edit ▸ Preferences in the in-window
 //! menu bar; General is Cmd+,). One window titled "Preferences": the category list on the left,
 //! the category's fields on the right, Help / Reset… / Cancel / OK at the bottom. The page layout
 //! comes from the engine's field schema ([`filmcraft_engine::settings::categories`]); edits go to a
@@ -303,7 +303,7 @@ fn appearance_modes(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft)
     let mode = choice_text(get(&d.values, key));
     ui.horizontal(|ui| {
         field_label(ui, "Appearance Mode");
-        if let Some(v) = combo(app, ui, key, &mode, &static_opts(settings::APPEARANCE_MODES), 200.0) {
+        if let Some(v) = combo(app, ui, key, "Appearance Mode", &mode, &static_opts(settings::APPEARANCE_MODES), 200.0) {
             put(&mut d.values, key, json!(v));
         }
     });
@@ -428,7 +428,7 @@ fn choice_text(v: &Value) -> String {
 }
 
 /// A dropdown of (value, label) options; returns the chosen value.
-fn combo(app: &mut FilmcraftApp, ui: &mut Ui, key: &str, current: &str, opts: &[(String, String)], width: f32) -> Option<String> {
+fn combo(app: &mut FilmcraftApp, ui: &mut Ui, key: &str, label: &str, current: &str, opts: &[(String, String)], width: f32) -> Option<String> {
     let shown = opts.iter().find(|o| o.0 == current).map(|o| o.1.clone()).unwrap_or_else(|| current.to_string());
     let mut chosen = None;
     let mut items: Vec<(String, Rect, String)> = Vec::new();
@@ -447,7 +447,10 @@ fn combo(app: &mut FilmcraftApp, ui: &mut Ui, key: &str, current: &str, opts: &[
                 }
             }
         });
-    app.auto.add(&format!("settings.{key}"), r.response.rect, &shown);
+    // The accessible name is the field's label, while the automation label stays the selected
+    // value so `ui.elements` reports what the dropdown shows.
+    let response = crate::widgets::accessible_name(r.response, crate::i18n::t(label));
+    app.auto.add(&format!("settings.{key}"), response.rect, &shown);
     for (id, rect, l) in items {
         app.auto.add(&id, rect, &l);
     }
@@ -522,13 +525,13 @@ fn draw_field(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, f: &Fi
                     if let Some(x) = number(app, ui, f.key, cur.as_f64().unwrap_or(1.0), range, decimals, f.label) {
                         put(&mut d.values, f.key, json!(if u == "frames" { x.round() } else { x }));
                     }
-                    if let Some(v) = combo(app, ui, unit_key, &u, &static_opts(settings::DURATION_UNITS), 90.0) {
+                    if let Some(v) = combo(app, ui, unit_key, f.label, &u, &static_opts(settings::DURATION_UNITS), 90.0) {
                         put(&mut d.values, unit_key, json!(v));
                     }
                 }
                 Kind::Choice(opts) => {
                     field_label(ui, f.label);
-                    if let Some(v) = combo(app, ui, f.key, &choice_text(&cur), &static_opts(opts), 300.0) {
+                    if let Some(v) = combo(app, ui, f.key, f.label, &choice_text(&cur), &static_opts(opts), 300.0) {
                         let x = if cur.is_number() { v.parse::<u64>().map(Value::from).unwrap_or(json!(v)) } else { json!(v) };
                         put(&mut d.values, f.key, x);
                     }
@@ -536,7 +539,7 @@ fn draw_field(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, f: &Fi
                 Kind::Device(list) => {
                     field_label(ui, f.label);
                     let opts = device_opts(app, d, list);
-                    if let Some(v) = combo(app, ui, f.key, &choice_text(&cur), &opts, 300.0) {
+                    if let Some(v) = combo(app, ui, f.key, f.label, &choice_text(&cur), &opts, 300.0) {
                         put(&mut d.values, f.key, json!(v));
                     }
                 }
@@ -549,7 +552,7 @@ fn draw_field(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, f: &Fi
                         let c = settings::parse_hex(&choice_text(get(&d.values, &format!("labels.colors.{}.color", settings::label_id(l))))).unwrap_or(l.rgb());
                         ui.painter().rect_filled(sw, 2.0, Color32::from_rgb(c[0], c[1], c[2]));
                     }
-                    if let Some(v) = combo(app, ui, f.key, &cur_s, &opts, 160.0) {
+                    if let Some(v) = combo(app, ui, f.key, f.label, &cur_s, &opts, 160.0) {
                         put(&mut d.values, f.key, json!(v));
                     }
                 }
@@ -570,7 +573,7 @@ fn draw_field(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, f: &Fi
                     } else {
                         ui.available_width().clamp(60.0, 220.0)
                     };
-                    let r = ui.add(egui::TextEdit::singleline(&mut s).desired_width(width).hint_text(hint));
+                    let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut s).desired_width(width).hint_text(hint)), f.label);
                     app.auto.add(&format!("settings.{}", f.key), r.rect, f.label);
                     if r.changed() {
                         put(&mut d.values, f.key, json!(s));
@@ -608,9 +611,12 @@ fn color_field(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, key:
     }
     // While the field has focus it shows what is typed, even when that is not a colour yet (one
     // character into `#2f6bdf`); each valid colour is kept as it comes. Leaving shows the kept one.
-    let draft_id = egui::Id::new(("settings-hex", key));
+    let draft_id = egui::Id::unique(("settings-hex", key));
     let mut text = ui.data(|m| m.get_temp::<String>(draft_id)).unwrap_or_else(|| choice_text(get(&d.values, key)));
-    let t = ui.add(egui::TextEdit::singleline(&mut text).desired_width(70.0).font(egui::TextStyle::Monospace));
+    let t = crate::widgets::accessible_name(
+        ui.add(egui::TextEdit::singleline(&mut text).desired_width(70.0).font(egui::TextStyle::Monospace)),
+        format!("{label} hex"),
+    );
     app.auto.add(&format!("settings.{key}.hex"), t.rect, label);
     if t.has_focus() {
         ui.data_mut(|m| m.insert_temp(draft_id, text.clone()));
@@ -639,7 +645,7 @@ fn label_presets(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft) {
         ui.horizontal(|ui| {
             let opts: Vec<(String, String)> = presets.iter().map(|p| (p.name.clone(), p.name.clone())).collect();
             let shown = if modified { tlf!("{name} (Modified)", name = labels.preset) } else { labels.preset.clone() };
-            if let Some(name) = combo(app, ui, "labels.preset", &shown, &opts, 150.0) {
+            if let Some(name) = combo(app, ui, "labels.preset", "Label Color Presets", &shown, &opts, 150.0) {
                 pick = presets.iter().find(|p| p.name == name).cloned();
             }
             if preset_button(app, ui, "revert", Icon::Reset, tl!("Revert to the preset's colors and names"), modified) {
@@ -730,7 +736,10 @@ fn custom(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, name: &str
                         let id = settings::label_id(*l);
                         let nk = format!("labels.colors.{id}.name");
                         let mut name = choice_text(get(&d.values, &nk));
-                        let r = ui.add_sized(vec2(136.0, 22.0), egui::TextEdit::singleline(&mut name));
+                        let r = crate::widgets::accessible_name(
+                            ui.add_sized(vec2(136.0, 22.0), egui::TextEdit::singleline(&mut name)),
+                            format!("{} name", l.name()),
+                        );
                         app.auto.add(&format!("settings.{nk}"), r.rect, l.name());
                         if r.changed() {
                             put(&mut d.values, &nk, json!(name));
@@ -845,11 +854,11 @@ fn rows(app: &mut FilmcraftApp, ui: &mut Ui, d: &mut SettingsDraft, list: &[Row]
 /// Draw the dialog; returns whether it stays open.
 pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let Some(mut d) = app.ui.settings.take() else { return false };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("settings-dialog-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("settings-dialog-before-drag"), &mut d);
     let t = app.tokens;
     let mut close = false;
     let mut apply = false;
-    let resp = egui::Modal::new(egui::Id::new("settings-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
+    let resp = egui::Modal::new(egui::Id::unique("settings-modal")).frame(modal_frame(&t)).show(ctx, |ui| {
         ui.set_width(W);
         // title bar (Premiere keeps "Preferences" as the window title)
         let (bar, _) = ui.allocate_exact_size(vec2(W, 30.0), Sense::hover());
@@ -864,7 +873,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
             ui.painter().rect(list, 2.0, t.field_bg, Stroke::new(1.0, t.separator), egui::StrokeKind::Inside);
             for (i, c) in settings::categories().iter().enumerate() {
                 let row = Rect::from_min_size(list.min + vec2(1.0, 1.0 + i as f32 * ROW_H), vec2(LIST_W - 2.0, ROW_H));
-                let r = ui.interact(row, egui::Id::new(("settings-cat", c.id)), Sense::click());
+                let r = ui.interact(row, egui::Id::unique(("settings-cat", c.id)), Sense::click());
                 let sel = d.page == c.id;
                 if sel {
                     ui.painter().rect_filled(row, 0.0, t.row_alt);
diff --git a/crates/ui-egui/src/panels/shortcuts_dialog.rs b/crates/ui-egui/src/panels/shortcuts_dialog.rs
index db5fab592..005326f04 100644
--- a/crates/ui-egui/src/panels/shortcuts_dialog.rs
+++ b/crates/ui-egui/src/panels/shortcuts_dialog.rs
@@ -150,8 +150,8 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) -> bool {
     let mut close: Option<bool> = None; // Some(true) = OK, Some(false) = Cancel
     let mut open = true;
     egui::Window::new(tl!("Keyboard Shortcuts"))
-        .id(egui::Id::new("Keyboard Shortcuts"))
-        .id(egui::Id::new("keyboard-shortcuts"))
+        .id(egui::Id::unique("Keyboard Shortcuts"))
+        .id(egui::Id::unique("keyboard-shortcuts"))
         .open(&mut open)
         .collapsible(false)
         .resizable(false)
@@ -262,7 +262,7 @@ fn header(app: &mut FilmcraftApp, ui: &mut egui::Ui, t: &Tokens) {
     if let Some(mut name) = app.shortcut_editor.save_name.clone() {
         ui.horizontal(|ui| {
             ui.label(RichText::new(tl!("Save preset as:")).size(13.0).color(t.text_dim));
-            let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0));
+            let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0)), "Preset name");
             app.auto.add("shortcuts.saveAs.name", r.rect, "Preset name");
             let enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
             if small_button(app, ui, "shortcuts.saveAs.ok", tl!("Save"), !name.trim().is_empty()) || enter {
@@ -483,7 +483,7 @@ fn keyboard(app: &mut FilmcraftApp, ui: &mut egui::Ui, area: Rect, t: &Tokens) {
             (true, true) => format!("shortcuts.mod.{}.right", &name[1..]),
             _ => format!("shortcuts.key.{name}"),
         };
-        let resp = ui.interact(r, egui::Id::new(&id), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(&id), Sense::click());
         let p = ui.painter();
         let base = if is_mod {
             if mod_on { MOD_KEY } else { FREE_KEY.gamma_multiply(0.8) }
@@ -594,7 +594,10 @@ fn command_list(app: &mut FilmcraftApp, ui: &mut egui::Ui, height: f32, t: &Toke
     let plat = Platform::current();
     ui.horizontal(|ui| {
         let mut q = app.shortcut_editor.search.clone();
-        let r = ui.add(egui::TextEdit::singleline(&mut q).hint_text(tl!("Search commands or keys")).desired_width(320.0));
+        let r = crate::widgets::accessible_name(
+            ui.add(egui::TextEdit::singleline(&mut q).hint_text(tl!("Search commands or keys")).desired_width(320.0)),
+            "Search commands or keys",
+        );
         app.auto.add("shortcuts.search", r.rect, "Search");
         app.shortcut_editor.search = q;
         if let Some(sel) = app.shortcut_editor.selected.clone() {
@@ -664,7 +667,7 @@ fn command_list(app: &mut FilmcraftApp, ui: &mut egui::Ui, height: f32, t: &Toke
                     .collect::<Vec<_>>()
                     .join(",  ")
             };
-            let cresp = ui.interact(cell, egui::Id::new(("shortcut-cell", &id)), Sense::click());
+            let cresp = ui.interact(cell, egui::Id::unique(("shortcut-cell", &id)), Sense::click());
             if recording {
                 ui.painter().rect(cell, 3.0, t.field_bg, Stroke::new(1.5, t.accent), StrokeKind::Inside);
             } else if cresp.hovered() {
@@ -677,7 +680,7 @@ fn command_list(app: &mut FilmcraftApp, ui: &mut egui::Ui, height: f32, t: &Toke
                 app.shortcut_editor.recording = Some((id.clone(), false));
             }
             let plus = Rect::from_min_size(pos2(r.max.x - 30.0, r.min.y + 3.0), vec2(20.0, 20.0));
-            let presp = ui.interact(plus, egui::Id::new(("shortcut-add", &id)), Sense::click()).on_hover_text(tl!("Add another shortcut"));
+            let presp = ui.interact(plus, egui::Id::unique(("shortcut-add", &id)), Sense::click()).on_hover_text(tl!("Add another shortcut"));
             ui.painter().text(
                 plus.center(),
                 Align2::CENTER_CENTER,
@@ -822,13 +825,17 @@ mod localization_tests {
     use super::*;
 
     #[test]
-    fn command_search_accepts_spanish_labels_ids_and_keys() {
-        crate::i18n::set_current(crate::i18n::Language::Es);
+    fn command_search_accepts_translated_labels_ids_and_keys() {
         let row = json!({"id": "edit.undo", "label": "Undo", "category": "Edit", "shortcuts": [{"keys": "Cmd+Z", "display": "Ctrl+Z"}]});
-        for query in ["deshacer", "undo", "edit.undo", "ctrl+z", "cmd+z"] {
-            assert!(matches_search(&row, query), "{query}");
+        for l in crate::i18n::Language::ALL {
+            crate::i18n::set_current(l);
+            let undo = l.tr("Undo").to_lowercase();
+            for query in [undo.as_str(), "undo", "edit.undo", "ctrl+z", "cmd+z"] {
+                assert!(matches_search(&row, query), "{}: {query}", l.code());
+            }
+            let redo = l.tr("Redo").to_lowercase();
+            assert!(!matches_search(&row, &redo), "{}: {redo}", l.code());
         }
-        assert!(!matches_search(&row, "rehacer"));
         crate::i18n::set_current(crate::i18n::Language::En);
     }
 }
diff --git a/crates/ui-egui/src/panels/source_drag.rs b/crates/ui-egui/src/panels/source_drag.rs
index d705e0f2b..35f718118 100644
--- a/crates/ui-egui/src/panels/source_drag.rs
+++ b/crates/ui-egui/src/panels/source_drag.rs
@@ -42,8 +42,8 @@ pub fn controls(app: &mut FilmcraftApp, ui: &mut egui::Ui, row: Rect) {
     let left = row.center().x - (width * 3.0 + gap * 2.0) * 0.5;
     for (i, (id, label, video, audio, enabled)) in buttons.into_iter().enumerate() {
         let rect = Rect::from_min_size(pos2(left + i as f32 * (width + gap), row.min.y), vec2(width, row.height()));
-        let response = ui.add_enabled_ui(enabled, |ui| ui.interact(rect, egui::Id::new(id), Sense::drag())).inner;
-        response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, enabled, label));
+        let response = ui.add_enabled_ui(enabled, |ui| ui.interact(rect, egui::Id::unique(id), Sense::drag())).inner;
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, enabled, label));
         let t = app.tokens;
         if response.hovered() || response.dragged() {
             ui.painter().rect_filled(rect, 2.0, t.hover);
diff --git a/crates/ui-egui/src/panels/source_range.rs b/crates/ui-egui/src/panels/source_range.rs
index d7bc66e9e..f5bd98237 100644
--- a/crates/ui-egui/src/panels/source_range.rs
+++ b/crates/ui-egui/src/panels/source_range.rs
@@ -21,8 +21,9 @@ struct Drag {
     pointer_x: f32,
     revision: u64,
 }
+/// Temp-store key for the in/out range drag, per monitor, so Source and Program drags never alias.
 fn key(which: Which) -> egui::Id {
-    egui::Id::new(("monitor-range-edit", which as u8))
+    egui::Id::unique(("monitor-range-edit", which as u8))
 }
 fn self_item(app: &FilmcraftApp, which: Which) -> Option<ItemId> {
     if which == Which::Source { app.session.state.source_item } else { app.session.state.active_sequence }
@@ -103,7 +104,7 @@ pub fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, which: Whi
         }
         app.auto.add(id, rect, label);
         let response =
-            ui.add_enabled_ui(enabled && rect.width() > 0.0, |ui| ui.interact(rect, egui::Id::new(id), Sense::click_and_drag())).inner.on_hover_text(label);
+            ui.add_enabled_ui(enabled && rect.width() > 0.0, |ui| ui.interact(rect, egui::Id::unique(id), Sense::click_and_drag())).inner.on_hover_text(label);
         let cursor = if edge == RangeEdge::Move {
             if cfg!(windows) { egui::CursorIcon::PointingHand } else { egui::CursorIcon::Grab }
         } else {
@@ -197,7 +198,7 @@ pub fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, which: Whi
         let rect = Rect::from_min_max(pos2(x - 7.0, bar.max.y - 12.0), pos2(x + 7.0, bar.max.y));
         let id = if which == Which::Source { "source.playhead" } else { "program.playhead" };
         app.auto.add(id, rect, "Scrub playhead");
-        let playhead = ui.interact(rect, egui::Id::new(id), Sense::click_and_drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
+        let playhead = ui.interact(rect, egui::Id::unique(id), Sense::click_and_drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
         if (playhead.dragged() || playhead.clicked())
             && let Some(pos) = playhead.interact_pointer_pos()
         {
diff --git a/crates/ui-egui/src/panels/text.rs b/crates/ui-egui/src/panels/text.rs
index 6de9c6139..8852aa68e 100644
--- a/crates/ui-egui/src/panels/text.rs
+++ b/crates/ui-egui/src/panels/text.rs
@@ -1,4 +1,6 @@
-//! The Text panel: Transcript / Captions / Graphics tabs. The Captions tab lists the caption
+//! The Text panel: Transcript / Captions / Graphics tabs. The Graphics tab lists the text of every
+//! text layer in the sequence's graphics (#1487), with a search; clicking an entry goes to its clip
+//! and selects the layer, and the text edits in place (`graphics.set`). The Captions tab lists the caption
 //! segments of a caption track with editable in/out timecodes and text, a toolbar (add, split,
 //! merge, delete), track choice and the track style. Every edit dispatches a `captions.*` engine
 //! command; every widget registers an automation id (`text.*`). The Transcript tab shows the
@@ -35,7 +37,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let text_w = tab_text_width(ui.painter(), shown);
         let w = text_w + 16.0;
         let r = Rect::from_min_size(pos2(x, rect.min.y + 4.0), vec2(w, 24.0));
-        let resp = ui.interact(r, egui::Id::new(("text-tab", tab)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("text-tab", tab)), Sense::click());
         let active = app.ui.text_tab == tab;
         ui.painter().text(
             pos2(r.min.x, r.center().y),
@@ -57,13 +59,13 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     match app.ui.text_tab.as_str() {
         "Captions" => captions(app, ui, body),
         "Transcript" => transcript(app, ui, body),
-        _ => crate::dock::placeholder(ui, body, &t, tl!("Graphics text search arrives with M10.1–M10.2")),
+        _ => graphics(app, ui, body),
     }
 }
 
 fn tool_button(app: &mut FilmcraftApp, ui: &mut egui::Ui, r: Rect, icon: Icon, id: &str, label: &str, enabled: bool) -> bool {
     let t = app.tokens;
-    let resp = ui.interact(r, egui::Id::new(("text-tool", id)), if enabled { Sense::click() } else { Sense::hover() });
+    let resp = ui.interact(r, egui::Id::unique(("text-tool", id)), if enabled { Sense::click() } else { Sense::hover() });
     if enabled && resp.hovered() {
         ui.painter().rect_filled(r, 3.0, t.hover);
     }
@@ -93,7 +95,7 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         .enumerate()
         {
             let r = Rect::from_center_size(c + vec2(0.0, 26.0 + i as f32 * 34.0), vec2(200.0, 26.0));
-            let resp = ui.interact(r, egui::Id::new(id), Sense::click());
+            let resp = ui.interact(r, egui::Id::unique(id), Sense::click());
             ui.painter().rect_filled(r, 13.0, if i == 0 { if resp.hovered() { t.accent_hover } else { t.accent } } else { t.field_bg });
             ui.painter().text(r.center(), Align2::CENTER_CENTER, label, Tokens::semibold(12.0), if i == 0 { Color32::WHITE } else { t.text });
             app.auto.add(id, r, label);
@@ -110,7 +112,7 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // the track shown: the one holding the first selected caption, else C1
     let sel = app.session.state.caption_selection.clone();
     let track_idx = sel.first().and_then(|c| seq.caption_tracks.iter().position(|tr| tr.caption(*c).is_some())).unwrap_or(0);
-    let track_idx = ui.ctx().data(|d| d.get_temp::<usize>(egui::Id::new("text-cap-track"))).filter(|i| *i < seq.caption_tracks.len()).unwrap_or(track_idx);
+    let track_idx = ui.ctx().data(|d| d.get_temp::<usize>(egui::Id::unique("text-cap-track"))).filter(|i| *i < seq.caption_tracks.len()).unwrap_or(track_idx);
     let track = &seq.caption_tracks[track_idx];
 
     // ---- toolbar: search, track picker, add / split / merge / delete
@@ -121,12 +123,12 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let mut x = bar.min.x + 180.0f32.min(bar.width() * 0.4 + 10.0);
     let picker = Rect::from_min_size(pos2(x, bar.min.y + 1.0), vec2(130.0, 22.0));
     let label = format!("C{} · {}", track_idx + 1, track.name);
-    let presp = crate::widgets::dropdown_text(ui, picker, &label, &t, egui::Id::new("text-cap-track-picker"));
+    let presp = crate::widgets::dropdown_text(ui, picker, &label, &t, egui::Id::unique("text-cap-track-picker"));
     app.auto.add("text.captions.track", picker, "Caption track");
     egui::Popup::menu(&presp).show(|ui| {
         for (i, tr) in seq.caption_tracks.iter().enumerate() {
             if ui.selectable_label(i == track_idx, format!("C{} · {} ({})", i + 1, tr.name, crate::i18n::t(tr.format.label()))).clicked() {
-                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new("text-cap-track"), i));
+                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique("text-cap-track"), i));
             }
         }
         ui.separator();
@@ -176,6 +178,9 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let q = app.ui.caption_search.to_lowercase();
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(list.shrink(4.0)).id_salt("caption-list"));
     let current = track.caption_at(ph).map(|c| c.id);
+    if current.is_none() {
+        ui.data_mut(|d| d.remove::<u64>(egui::Id::unique("caption-follow")));
+    }
     egui::ScrollArea::vertical().auto_shrink([false, false]).id_salt("caption-scroll").show(&mut child, |ui| {
         ui.set_width(list.width() - 12.0);
         let mut shown = 0;
@@ -207,14 +212,17 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                             }
                         }
                         for (edge, val) in [("in", c.start), ("out", c.end())] {
-                            let key = egui::Id::new(("cap-tc", c.id.0, edge));
+                            let key = egui::Id::unique(("cap-tc", c.id.0, edge));
                             let mut buf = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| tc(val));
-                            let resp = ui.add(
-                                egui::TextEdit::singleline(&mut buf)
-                                    .id(key.with("te"))
-                                    .desired_width(88.0)
-                                    .font(Tokens::mono(11.0))
-                                    .text_color(if edge == "in" { t.hot_text } else { t.text_dim }),
+                            let resp = crate::widgets::accessible_name(
+                                ui.add(
+                                    egui::TextEdit::singleline(&mut buf)
+                                        .id(key.with("te"))
+                                        .desired_width(88.0)
+                                        .font(Tokens::mono(11.0))
+                                        .text_color(if edge == "in" { t.hot_text } else { t.text_dim }),
+                                ),
+                                if edge == "in" { "Caption in" } else { "Caption out" },
                             );
                             app.auto.add(&format!("text.captions.{}.{edge}", c.id.0), resp.rect, if edge == "in" { "Caption in" } else { "Caption out" });
                             if resp.has_focus() {
@@ -232,18 +240,21 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
                         if let Some(sp) = &c.speaker {
                             ui.label(egui::RichText::new(sp).size(11.0).color(t.text_dim).strong());
                         }
-                        let key = egui::Id::new(("cap-text", c.id.0));
+                        let key = egui::Id::unique(("cap-text", c.id.0));
                         let mut buf = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| c.text.clone());
                         let resp = if crate::rtl::has_rtl(&buf) && !ui.memory(|m| m.has_focus(key.with("te"))) {
                             reading_order(ui, &buf, key.with("te"))
                         } else {
-                            ui.add(
-                                egui::TextEdit::multiline(&mut buf)
-                                    .id(key.with("te"))
-                                    .desired_rows(1)
-                                    .desired_width(ui.available_width())
-                                    .font(Tokens::ui(12.5))
-                                    .frame(egui::Frame::NONE),
+                            crate::widgets::accessible_name(
+                                ui.add(
+                                    egui::TextEdit::multiline(&mut buf)
+                                        .id(key.with("te"))
+                                        .desired_rows(1)
+                                        .desired_width(ui.available_width())
+                                        .font(Tokens::ui(12.5))
+                                        .frame(egui::Frame::NONE),
+                                ),
+                                "Caption text",
                             )
                         };
                         app.auto.add(&format!("text.captions.{}.text", c.id.0), resp.rect, "Caption text");
@@ -264,6 +275,13 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let row = fr.response.rect;
             if current == Some(c.id) {
                 ui.painter().rect_stroke(row, 3.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
+                // the list follows the playhead: each caption it reaches is brought to the middle
+                // once, but never while a field is being edited
+                let follow = egui::Id::unique("caption-follow");
+                if ui.data(|d| d.get_temp::<u64>(follow)) != Some(c.id.0) && ui.memory(|m| m.focused().is_none()) {
+                    ui.scroll_to_rect(row, Some(egui::Align::Center));
+                    ui.data_mut(|d| d.insert_temp(follow, c.id.0));
+                }
             }
             app.auto.add(&format!("text.captions.{}.row", c.id.0), row, &c.text);
             ui.add_space(2.0);
@@ -282,6 +300,166 @@ fn captions(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     run(app, ui, actions);
 }
 
+/// A text layer of a graphic clip in the active sequence, for the Graphics tab.
+#[derive(Clone, Debug, PartialEq)]
+pub struct GraphicText {
+    pub clip: filmcraft_project::ClipId,
+    /// The layer's number among the clip's layers (what `graphics.set` / `graphics.selectLayer` take).
+    pub layer: usize,
+    pub start: filmcraft_time::Tick,
+    /// The track's label (`V2`).
+    pub track: String,
+    /// The layer's own name, when it has one.
+    pub name: Option<String>,
+    pub text: String,
+    /// The timeline time the text was read at (the playhead, or the clip's start when the
+    /// playhead is outside the clip): an edit is written there, so keyframed text changes the
+    /// value that is shown.
+    pub at: filmcraft_time::Tick,
+}
+
+/// Every text layer of every graphic clip in `seq`, in timeline order (then lower tracks first,
+/// then paint order), with its text at `at` when that falls in the clip (Source Text keyframes
+/// hold), else at the clip's first frame.
+pub fn graphic_texts(seq: &filmcraft_project::Sequence, at: filmcraft_time::Tick) -> Vec<GraphicText> {
+    use filmcraft_project::graphic::{TEXT_LAYER, layer_indices};
+    let mut out = Vec::new();
+    for (ti, track) in seq.video_tracks.iter().enumerate() {
+        for it in &track.items {
+            let t = if it.start <= at && at < it.end() { at } else { it.start };
+            let mt = it.effect_time_at(t);
+            for (layer, ei) in layer_indices(&it.effects).into_iter().enumerate() {
+                let Some(e) = it.effects.get(ei).filter(|e| e.effect == TEXT_LAYER) else { continue };
+                let text = match e.param("text").map(|p| p.value_at(mt)) {
+                    Some(filmcraft_project::ParamValue::Text(s)) => s,
+                    _ => String::new(),
+                };
+                let name = match e.param("name").map(|p| p.value.clone()) {
+                    Some(filmcraft_project::ParamValue::Text(n)) if !n.trim().is_empty() => Some(n),
+                    _ => None,
+                };
+                out.push((ti, GraphicText { clip: it.id, layer, start: it.start, track: format!("V{}", ti + 1), name, text, at: t }));
+            }
+        }
+    }
+    out.sort_by(|(ta, a), (tb, b)| a.start.cmp(&b.start).then(ta.cmp(tb)).then(a.layer.cmp(&b.layer)));
+    out.into_iter().map(|(_, g)| g).collect()
+}
+
+/// The Graphics tab (#1487): the text of every text layer in the sequence, searchable. The
+/// timecode goes to the clip and selects the layer; the text edits in place.
+fn graphics(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let project = app.session.project.clone();
+    let Some(seq) = app.session.state.active_sequence.and_then(|id| project.sequence(id)) else {
+        crate::dock::placeholder(ui, rect, &t, tl!("Open a sequence to search its graphics"));
+        return;
+    };
+    let (rate, df) = (seq.settings.frame_rate, seq.settings.drop_frame);
+    let tc = |x: filmcraft_time::Tick| format_time(x, rate, df, TimeDisplay::Timecode, 48_000);
+    let ph = app.session.playhead();
+    let entries = graphic_texts(seq, ph);
+    let mut actions: Vec<(String, Value)> = Vec::new();
+    // search
+    let bar = Rect::from_min_size(rect.min + vec2(10.0, 2.0), vec2(rect.width() - 20.0, 26.0));
+    let skey = egui::Id::unique("text-gfx-search");
+    let mut search = ui.data(|d| d.get_temp::<String>(skey)).unwrap_or_default();
+    let w = 220.0f32.min(bar.width());
+    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(Rect::from_min_size(bar.min, vec2(w, 24.0))));
+    let sresp = crate::widgets::search_field(&mut child, &mut search, tl!("Search"), w, &t);
+    app.auto.add("text.graphics.search", sresp.rect, "Search graphics text");
+    ui.data_mut(|d| d.insert_temp(skey, search.clone()));
+    let q = search.to_lowercase();
+    // list
+    let list = Rect::from_min_max(pos2(rect.min.x + 6.0, bar.max.y + 8.0), pos2(rect.max.x - 6.0, rect.max.y - 4.0));
+    ui.painter().rect_filled(list, 3.0, t.app_bg);
+    let sel_clips = app.session.state.selection.clone();
+    let sel_layers = app.session.state.graphic_layers.clone();
+    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(list.shrink(4.0)).id_salt("graphics-text-list"));
+    egui::ScrollArea::vertical().auto_shrink([false, false]).id_salt("graphics-text-scroll").show(&mut child, |ui| {
+        ui.set_width(list.width() - 12.0);
+        let mut shown = 0;
+        for (n, g) in entries.iter().enumerate() {
+            if !q.is_empty() && !g.text.to_lowercase().contains(&q) && !g.name.as_deref().unwrap_or("").to_lowercase().contains(&q) {
+                continue;
+            }
+            shown += 1;
+            let key = format!("{}.{}", g.clip.0, g.layer);
+            let selected = sel_clips.contains(&g.clip) && sel_layers.contains(&g.layer);
+            let fill = if selected {
+                t.row_selected
+            } else if n % 2 == 1 {
+                t.row_alt
+            } else {
+                Color32::TRANSPARENT
+            };
+            let select = |actions: &mut Vec<(String, Value)>| {
+                actions.push(("timeline.select".into(), json!({"clips": [g.clip.0]})));
+                actions.push(("graphics.selectLayer".into(), json!({"clip": g.clip.0, "layers": [g.layer]})));
+            };
+            let frame = egui::Frame::NONE.fill(fill).inner_margin(egui::Margin::symmetric(6, 4)).corner_radius(3.0);
+            let fr = frame.show(ui, |ui| {
+                ui.horizontal_top(|ui| {
+                    ui.vertical(|ui| {
+                        ui.set_width(92.0);
+                        let goto = ui.add(egui::Button::new(egui::RichText::new(tc(g.start)).font(Tokens::mono(11.0)).color(t.hot_text)).frame(false));
+                        app.auto.add(&format!("text.graphics.{key}.goto"), goto.rect, "Go to graphic");
+                        if goto.clicked() {
+                            actions.push(("playhead.set".into(), json!({"time": g.start.0})));
+                            select(&mut actions);
+                        }
+                        let label = match &g.name {
+                            Some(name) => format!("{} · {name}", g.track),
+                            None => g.track.clone(),
+                        };
+                        ui.label(egui::RichText::new(label).size(11.0).color(t.text_dim));
+                    });
+                    ui.vertical(|ui| {
+                        let tkey = egui::Id::unique(("gfx-text", g.clip.0, g.layer));
+                        let mut buf = ui.data(|d| d.get_temp::<String>(tkey)).unwrap_or_else(|| g.text.clone());
+                        let resp = crate::widgets::accessible_name(
+                            ui.add(
+                                egui::TextEdit::multiline(&mut buf)
+                                    .id(tkey.with("te"))
+                                    .desired_rows(1)
+                                    .desired_width(ui.available_width())
+                                    .font(Tokens::ui(12.5))
+                                    .frame(egui::Frame::NONE),
+                            ),
+                            "Graphic text",
+                        );
+                        app.auto.add(&format!("text.graphics.{key}.text"), resp.rect, "Graphic text");
+                        if resp.has_focus() {
+                            ui.data_mut(|d| d.insert_temp(tkey, buf.clone()));
+                            if !selected {
+                                select(&mut actions);
+                            }
+                        } else {
+                            ui.data_mut(|d| d.remove::<String>(tkey));
+                        }
+                        if resp.lost_focus() && buf != g.text {
+                            actions.push(("graphics.set".into(), json!({"clip": g.clip.0, "layer": g.layer, "props": {"text": buf}, "time": g.at.0})));
+                        }
+                    });
+                });
+            });
+            app.auto.add(&format!("text.graphics.{key}.row"), fr.response.rect, &g.text);
+            ui.add_space(2.0);
+        }
+        if shown == 0 {
+            ui.label(
+                egui::RichText::new(if entries.is_empty() {
+                    tl!("No text graphics in this sequence. Add text with the Type tool.")
+                } else {
+                    tl!("No matching text.")
+                })
+                .color(t.text_faint),
+            );
+        }
+    });
+    run(app, ui, actions);
+}
+
 /// Whether a caption is selected, so the Properties panel shows [`caption_properties`].
 pub fn caption_selected(app: &FilmcraftApp) -> bool {
     app.session.active_sequence().is_some_and(|q| app.session.state.caption_selection.iter().any(|c| q.find_caption(*c).is_some()))
@@ -304,9 +482,12 @@ pub fn caption_properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect)
     let (hr, _) = bui.allocate_exact_size(vec2(bui.available_width(), 30.0), Sense::hover());
     bui.painter().text(pos2(hr.min.x, hr.center().y), Align2::LEFT_CENTER, format!("C{} · {}", track_idx + 1, track_name), Tokens::semibold(12.5), t.text);
     bui.label(egui::RichText::new(tl!("Text")).size(12.0).color(t.text_dim));
-    let key = egui::Id::new(("props-cap-text", c.id.0));
+    let key = egui::Id::unique(("props-cap-text", c.id.0));
     let mut buf = bui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| c.text.clone());
-    let resp = bui.add(egui::TextEdit::multiline(&mut buf).id(key.with("te")).desired_rows(3).desired_width(bui.available_width()).font(Tokens::ui(12.5)));
+    let resp = crate::widgets::accessible_name(
+        bui.add(egui::TextEdit::multiline(&mut buf).id(key.with("te")).desired_rows(3).desired_width(bui.available_width()).font(Tokens::ui(12.5))),
+        "Caption text",
+    );
     app.auto.add("properties.caption.text", resp.rect, &c.text);
     if resp.has_focus() {
         bui.data_mut(|d| d.insert_temp(key, buf.clone()));
@@ -320,9 +501,12 @@ pub fn caption_properties(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect)
     for (edge, label, val) in [("in", tl!("In"), c.start), ("out", tl!("Out"), c.end())] {
         bui.horizontal(|ui| {
             ui.add_sized(vec2(70.0, 22.0), egui::Label::new(egui::RichText::new(label).size(12.0).color(t.text_dim)));
-            let key = egui::Id::new(("props-cap-tc", c.id.0, edge));
+            let key = egui::Id::unique(("props-cap-tc", c.id.0, edge));
             let mut buf = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| tc(val));
-            let resp = ui.add(egui::TextEdit::singleline(&mut buf).id(key.with("te")).desired_width(100.0).font(Tokens::mono(11.5)));
+            let resp = crate::widgets::accessible_name(
+                ui.add(egui::TextEdit::singleline(&mut buf).id(key.with("te")).desired_width(100.0).font(Tokens::mono(11.5))),
+                if edge == "in" { "In" } else { "Out" },
+            );
             app.auto.add(&format!("properties.caption.{edge}"), resp.rect, &tc(val));
             if resp.has_focus() {
                 ui.data_mut(|d| d.insert_temp(key, buf.clone()));
@@ -378,7 +562,7 @@ fn transcript(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         };
         ui.painter().text(c - vec2(0.0, 8.0), Align2::CENTER_CENTER, note, Tokens::ui(12.0), t.text_dim);
         let r = Rect::from_center_size(c + vec2(0.0, 26.0), vec2(200.0, 26.0));
-        let resp = ui.interact(r, egui::Id::new("text.transcript.generate"), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique("text.transcript.generate"), Sense::click());
         ui.painter().rect_filled(r, 13.0, if resp.hovered() { t.accent_hover } else { t.accent });
         ui.painter().text(r.center(), Align2::CENTER_CENTER, tl!("Transcribe"), Tokens::semibold(12.0), Color32::WHITE);
         app.auto.add("text.transcript.generate", r, "Transcribe");
diff --git a/crates/ui-egui/src/panels/timecode.rs b/crates/ui-egui/src/panels/timecode.rs
index 1dcfccccd..a9a818f2f 100644
--- a/crates/ui-egui/src/panels/timecode.rs
+++ b/crates/ui-egui/src/panels/timecode.rs
@@ -121,7 +121,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if show_name {
             ui.painter().text(pos2(r.center().x, vr.max.y + 2.0), Align2::CENTER_TOP, &caption, Tokens::ui(11.0), t.text_dim);
         }
-        let resp = ui.interact(r, egui::Id::new(("timecode-row", i)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("timecode-row", i)), Sense::click());
         elems.push((format!("timecode.row.{i}"), vr, value.clone()));
         egui::Popup::context_menu(&resp).show(|ui| {
             ui.set_min_width(200.0);
@@ -169,7 +169,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     // "+" adds a row (same settings as the last one, Duration by default)
     let ar = Rect::from_min_size(pos2(rect.max.x - 28.0, rect.max.y - 26.0), vec2(22.0, 22.0));
-    let aresp = ui.interact(ar, egui::Id::new("timecode-add"), Sense::click());
+    let aresp = ui.interact(ar, egui::Id::unique("timecode-add"), Sense::click());
     ui.painter().text(ar.center(), Align2::CENTER_CENTER, "+", Tokens::ui(16.0), if aresp.hovered() { t.tab_text_active } else { t.icon });
     elems.push(("timecode.addRow".into(), ar, "Add Row".into()));
     if aresp.on_hover_text(tl!("Add a timecode row")).clicked() {
diff --git a/crates/ui-egui/src/panels/timeline.rs b/crates/ui-egui/src/panels/timeline.rs
index c4c369298..5ec0f05a1 100644
--- a/crates/ui-egui/src/panels/timeline.rs
+++ b/crates/ui-egui/src/panels/timeline.rs
@@ -13,8 +13,9 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 
 use egui::{Align2, Color32, CursorIcon, Pos2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use filmcraft_engine::sequence_tools::{DuplicateFrames, duplicate_frames};
 use filmcraft_project::{ClipId, ItemId, MarkerId, Sequence, TrackId, TrackItem, TrackKind};
-use filmcraft_time::{FrameRate, TICKS_PER_SECOND, Tick, TimeDisplay, format_time};
+use filmcraft_time::{FrameRate, TICKS_PER_SECOND, Tick, TimeDisplay, TimeRange, format_time};
 use serde_json::{Value, json};
 
 use crate::FilmcraftApp;
@@ -22,7 +23,7 @@ use crate::icons::{self, Icon};
 use crate::state::{ThumbnailMode, TimelineView, Tool};
 use crate::theme::Tokens;
 
-use super::timeline_hit::{EdgeKind, Grab, edge_geometry, grab_at, marker_at, marker_range_rect, marker_rect, marker_under_pointer};
+use super::timeline_hit::{EDGE_PX, EdgeKind, Grab, edge_geometry, grab_at, marker_at, marker_range_rect, marker_rect, marker_under_pointer, work_area_rect};
 pub use super::timeline_hit::{Hit, ROLL_PX, hit, selection_trim_kind};
 
 const TOP_H: f32 = 58.0; // timecode + toolbar (left) / ruler (right)
@@ -32,6 +33,20 @@ const DIVIDER_H: f32 = 5.0;
 const MASTER_H: f32 = 34.0;
 /// The selected gap between two clips (#648, #668).
 const GAP_FILL: Color32 = Color32::from_gray(224);
+/// Duplicate frame marker colors, one per master clip with duplicate frames in the order they
+/// appear in the sequence.
+const DUPLICATE_FRAME_COLORS: [Color32; filmcraft_engine::sequence_tools::DUPLICATE_FRAME_COLORS] = [
+    Color32::from_rgb(0xe8, 0x4a, 0x4a),
+    Color32::from_rgb(0x3d, 0x9b, 0xe9),
+    Color32::from_rgb(0x4c, 0xc2, 0x5a),
+    Color32::from_rgb(0xf2, 0xc2, 0x2e),
+    Color32::from_rgb(0xb0, 0x5c, 0xe0),
+    Color32::from_rgb(0xf0, 0x8a, 0x2c),
+    Color32::from_rgb(0x2c, 0xd4, 0xc8),
+    Color32::from_rgb(0xec, 0x5e, 0xb0),
+    Color32::from_rgb(0x9a, 0xcd, 0x32),
+    Color32::from_rgb(0xf5, 0xf5, 0xf5),
+];
 const SNAP_PX: f32 = 9.0;
 
 /// Waveform peaks are kept per audio stream: (item, index into the media's `audio_streams`).
@@ -62,6 +77,52 @@ pub struct TlState {
     zoom_anchor: Option<(f64, f32)>,
     /// The zoom (points a second) the video thumbnails are laid out at while the view is zooming (#1094).
     thumb_pps: Option<f64>,
+    /// Show Duplicate Frame Markers: the markers of a sequence, with the session revision, the
+    /// sequence and the project they were worked out for.
+    duplicates: Option<(DuplicatesKey, DuplicateMarkers)>,
+    /// The markers being worked out on a background thread, and where the thread leaves them.
+    duplicates_pending: Option<DuplicatesKey>,
+    duplicates_done: Arc<Mutex<Option<(DuplicatesKey, DuplicateMarkers)>>>,
+}
+
+/// (session revision, sequence, project address)
+type DuplicatesKey = (u64, ItemId, usize);
+type DuplicateMarkers = Arc<HashMap<ClipId, DuplicateFrames>>;
+
+/// The duplicate frame markers of sequence `seq_id`, worked out again on a background thread
+/// after the project changes: a long sequence takes too long for a frame. Until the new markers
+/// are ready, the last ones of the same sequence are shown.
+fn duplicate_markers(app: &mut FilmcraftApp, ctx: &egui::Context, seq_id: ItemId, seq: &Sequence) -> DuplicateMarkers {
+    let key = (app.session.revision, seq_id, Arc::as_ptr(&app.session.project) as usize);
+    let done = app.tl.duplicates_done.lock().unwrap_or_else(|e| e.into_inner()).take();
+    // a job that finishes after a newer one leaves the newer markers in place
+    if let Some((k, d)) = done
+        && app.tl.duplicates.as_ref().is_none_or(|(have, _)| *have != key)
+    {
+        app.tl.duplicates = Some((k, d));
+    }
+    match &app.tl.duplicates {
+        Some((k, d)) if *k == key => return d.clone(),
+        _ => {}
+    }
+    if app.tl.duplicates_pending != Some(key) {
+        app.tl.duplicates_pending = Some(key);
+        let (project, seq, slot, ctx) = (app.session.project.clone(), seq.clone(), app.tl.duplicates_done.clone(), ctx.clone());
+        let run = move || {
+            // a panic in the comparison must not take the app down: it leaves no markers
+            let d = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| duplicate_frames(&project, &seq))).unwrap_or_default();
+            *slot.lock().unwrap_or_else(|e| e.into_inner()) = Some((key, Arc::new(d.into_iter().map(|d| (d.clip, d)).collect())));
+            ctx.request_repaint();
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        std::thread::spawn(run);
+        #[cfg(target_arch = "wasm32")]
+        run();
+    }
+    match &app.tl.duplicates {
+        Some(((_, s, _), d)) if *s == seq_id => d.clone(),
+        _ => Arc::default(),
+    }
 }
 
 impl TlState {
@@ -74,6 +135,9 @@ impl TlState {
         self.seq_peak_keys = Default::default();
         self.seq_keys_seen.clear();
         self.peak_max.clear();
+        self.duplicates = None;
+        self.duplicates_pending = None;
+        self.duplicates_done = Default::default();
     }
 }
 
@@ -115,6 +179,8 @@ pub enum Drag {
         /// The time under the pointer when the button went down: the edge moves by how far the
         /// pointer has moved since (#259).
         from: Tick,
+        /// Linked partners trim along; false when Alt was held as the drag started (#3300).
+        linked: bool,
     },
     Roll {
         left: ClipId,
@@ -139,6 +205,8 @@ pub enum Drag {
         delta: Tick,
         /// As in [`Drag::Trim`].
         from: Tick,
+        /// As in [`Drag::Trim`].
+        linked: bool,
     },
     /// Remix tool: drag a music clip's Out edge; on release `clip.remix` re-plans it to the new duration.
     Remix {
@@ -157,6 +225,15 @@ pub enum Drag {
         start: Tick,
         duration: Tick,
     },
+    /// The work area bar dragged by an end (`edge`: that end moves) or its middle (the bar moves);
+    /// `start` / `end` are where it is shown now, committed on release.
+    WorkArea {
+        edge: Option<filmcraft_edit::Edge>,
+        /// As in [`Drag::Trim`].
+        from: Tick,
+        start: Tick,
+        end: Tick,
+    },
     Pan {
         last: Pos2,
         start_scroll: f64,
@@ -294,10 +371,16 @@ pub fn zoom_about(v: &mut TimelineView, factor: f64, anchor_secs: f64, width: f3
     v.target_scroll = (anchor_secs - x as f64 / new).max(0.0);
 }
 
+/// How strongly a track's colour label tints its header and its lane.
+const TRACK_HEADER_TINT: f32 = 0.18;
+const TRACK_LANE_TINT: f32 = 0.10;
+
 fn label_color(app: &FilmcraftApp, l: filmcraft_project::Label) -> Color32 {
     crate::panels::settings::label_color(app, l)
 }
 
+/// Draw the Timeline and run its interaction. A missing or damaged active sequence shows the empty state; `stable_dt` is capped, and a project snapshot is kept
+/// while commands mutate the session.
 pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -340,7 +423,8 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             v.fit_pending = false;
             v.fit_empty = empty.then_some(v.target_pps);
         }
-        let k = 1.0 - (-dt * 20.0).exp();
+        // eased, or in one step with Settings ▸ Appearance ▸ animations off (#2325)
+        let k = if app.session.prefs.appearance.animations { 1.0 - (-dt * 20.0).exp() } else { 1.0 };
         let zooming = (v.pps - v.target_pps).abs() / v.target_pps > 0.001;
         // video thumbnails keep the layout of the zoom a gesture or animation started at (#1094)
         if zooming || matches!(app.tl.drag, Some(Drag::ZoomBar { mode: 1 | 2, .. })) {
@@ -455,6 +539,10 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         let bg = if r.index % 2 == 0 { t.tl_track_bg } else { t.tl_track_bg_alt };
         painter.rect_filled(row, 0.0, bg);
+        // a track's colour label tints its lane (#1186)
+        if let Some(l) = seq.track(r.track).and_then(|tr| tr.label) {
+            painter.rect_filled(row, 0.0, label_color(app, l).gamma_multiply(TRACK_LANE_TINT));
+        }
         painter.line_segment([pos2(row.min.x, r.rect.max.y - 0.5), pos2(row.max.x, r.rect.max.y - 0.5)], Stroke::new(1.0, t.separator));
         // the top video track also gets a line above it
         if r.kind == TrackKind::Video && r.index + 1 == nv {
@@ -484,6 +572,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if copying {
         ctx.set_cursor_icon(CursorIcon::Copy);
     }
+    let duplicates = if app.session.state.show_duplicate_frame_markers { duplicate_markers(app, &ctx, seq_id, seq) } else { Arc::default() };
     for r in &rows {
         let Some(tr) = seq.track(r.track) else { continue };
         let clip_rect = if r.kind == TrackKind::Video { vclip } else { aclip };
@@ -519,6 +608,14 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             if volume_line {
                 super::timeline_volume::paint(&p, body, it);
             }
+            // Show Duplicate Frame Markers: a stripe along the bottom under each repeated frame,
+            // in the color of the clip's master clip
+            if let Some(d) = duplicates.get(&it.id) {
+                let col = DUPLICATE_FRAME_COLORS.get(d.color).or(DUPLICATE_FRAME_COLORS.last()).copied().unwrap_or(Color32::WHITE);
+                // kept inside the clip while a trim drag shortens it
+                let inside = p.with_clip_rect(body.intersect(p.clip_rect()));
+                paint_duplicate_stripes(app, &inside, &layout, &d.ranges, start - it.start, (body.max.y - 3.0, body.max.y), visible, col, it.id);
+            }
             app.auto.add(&format!("timeline.clip.{}", it.id.0), body.intersect(content), &it.name);
             // a nest that runs past the end of its sequence's contents: that part is empty
             if !previews.contains_key(&it.id)
@@ -635,7 +732,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // divider between video and audio
     let div = Rect::from_min_max(pos2(rect.min.x, split_y), pos2(content.max.x, split_y + DIVIDER_H));
     painter.rect_filled(div, 0.0, t.app_bg);
-    let div_resp = ui.interact(div, egui::Id::new("tl-divider"), Sense::drag());
+    let div_resp = ui.interact(div, egui::Id::unique("tl-divider"), Sense::drag());
     if div_resp.hovered() || div_resp.dragged() {
         ctx.set_cursor_icon(CursorIcon::ResizeVertical);
     }
@@ -721,6 +818,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let _ = (visible, TICKS_PER_SECOND);
 }
 
+/// Shown when no sequence is open: offers the demo project and accepts project or OS-file drops to create a sequence.
 fn empty_state(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     ui.painter().text(rect.center() - vec2(0.0, 12.0), Align2::CENTER_CENTER, tl!("Drop media here to create sequence."), Tokens::ui(13.0), t.text_dim);
@@ -729,7 +827,7 @@ fn empty_state(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         ui.painter().text(rect.center() + vec2(0.0, 50.0), Align2::CENTER_CENTER, hint, Tokens::ui(12.0), t.text_dim);
     }
     let b = Rect::from_center_size(rect.center() + vec2(0.0, 20.0), vec2(170.0, 26.0));
-    let resp = ui.interact(b, egui::Id::new("tl-open-demo"), Sense::click());
+    let resp = ui.interact(b, egui::Id::unique("tl-open-demo"), Sense::click());
     app.auto.add("timeline.openDemo", b, "Open Demo Project");
     ui.painter().rect_filled(b, 13.0, if resp.hovered() { t.accent_hover } else { t.accent });
     ui.painter().text(b.center(), Align2::CENTER_CENTER, tl!("Open Demo Project"), Tokens::semibold(12.0), Color32::WHITE);
@@ -749,7 +847,8 @@ fn empty_state(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
     }
     // OS files dropped on an empty Timeline: import already happened; create a sequence from the first item
-    if let Some((items, p)) = app.pending_timeline_drop.clone()
+    if let Some((items, p, viewport)) = app.pending_timeline_drop.clone()
+        && viewport == ui.ctx().viewport_id()
         && rect.contains(p)
         && let Some((first, rest)) = items.split_first()
     {
@@ -786,6 +885,52 @@ fn paint_through_edit(p: &egui::Painter, x: f32, row: Rect) -> Rect {
     Rect::from_center_size(pos2(x, cy), vec2(2.0 * w + 2.0, 2.0 * h + 2.0))
 }
 
+/// The duplicate frame stripes of one clip, between `ys`: its `ranges` (timeline ranges in order)
+/// drawn `offset` later, as the clip is while it is dragged. Only the ranges in the `visible` time
+/// and inside the painter's clip rect are drawn, and ranges a point or less apart are drawn as
+/// one stripe; each stripe takes the automation id `timeline.duplicateFrames.<clip>.<n>`, `n`
+/// being its first range.
+#[allow(clippy::too_many_arguments)]
+fn paint_duplicate_stripes(
+    app: &mut FilmcraftApp,
+    p: &egui::Painter,
+    layout: &Layout,
+    ranges: &[TimeRange],
+    offset: Tick,
+    ys: (f32, f32),
+    visible: (Tick, Tick),
+    col: Color32,
+    clip: ClipId,
+) {
+    let first = ranges.partition_point(|r| r.end() + offset < visible.0);
+    let mut stripe: Option<(usize, f32, f32)> = None;
+    let flush = |app: &mut FilmcraftApp, s: (usize, f32, f32)| {
+        let r = Rect::from_min_max(pos2(s.1, ys.0), pos2(s.2.max(s.1 + 1.0), ys.1));
+        let shown = r.intersect(p.clip_rect());
+        if shown.width() > 0.0 && shown.height() > 0.0 {
+            p.rect_filled(r, 0.0, col);
+            app.auto.add(&format!("timeline.duplicateFrames.{}.{}", clip.0, s.0), shown, "Duplicate frames");
+        }
+    };
+    for (i, range) in ranges.iter().enumerate().skip(first) {
+        if range.start + offset > visible.1 {
+            break;
+        }
+        let (x0, x1) = (layout.x_of(range.start + offset), layout.x_of(range.end() + offset));
+        stripe = match stripe {
+            Some((n, a, b)) if x0 <= b + 1.0 => Some((n, a, b.max(x1))),
+            Some(s) => {
+                flush(app, s);
+                Some((i, x0, x1))
+            }
+            None => Some((i, x0, x1)),
+        };
+    }
+    if let Some(s) = stripe {
+        flush(app, s);
+    }
+}
+
 fn lighten(c: Color32, f: f32) -> Color32 {
     let l = |v: u8| (v as f32 + (255.0 - v as f32) * f).round() as u8;
     Color32::from_rgb(l(c.r()), l(c.g()), l(c.b()))
@@ -1242,6 +1387,7 @@ fn patch_button(ui: &mut egui::Ui, r: Rect, clip: Rect, label: &str, on: bool, s
     resp
 }
 
+/// Draw only the visible track headers, including colour label, targeting, lock and header controls clipped to each row.
 #[allow(clippy::too_many_arguments)]
 fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows: &[Row], rect: Rect, vclip: Rect, aclip: Rect, t: &Tokens) {
     let hw = app.ui.timeline.header_w;
@@ -1258,6 +1404,36 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
         }
         let p = ui.painter().with_clip_rect(visible);
         p.rect_filled(hrect, 0.0, t.tl_header_bg);
+        // 0. colour label (#1186): a tint over the header, and the strip at its left edge, which
+        // opens the colour menu
+        let strip = Rect::from_min_max(hrect.min, pos2(hrect.min.x + 9.0, hrect.max.y));
+        if let Some(l) = tr.label {
+            let c = label_color(app, l);
+            p.rect_filled(hrect, 0.0, c.gamma_multiply(TRACK_HEADER_TINT));
+            p.rect_filled(Rect::from_min_max(strip.min, pos2(strip.min.x + 5.0, strip.max.y)), 0.0, c);
+        }
+        let cresp = ui.interact(strip.intersect(visible), egui::Id::unique(("trackColor", r.track.0)), Sense::click()).on_hover_text(tl!("Track Color"));
+        app.auto.add(&format!("timeline.track.{}{}.color", if r.kind == TrackKind::Video { "V" } else { "A" }, r.index + 1), strip, "Track Color");
+        if cresp.hovered() && tr.label.is_none() {
+            p.rect_filled(Rect::from_min_max(strip.min, pos2(strip.min.x + 5.0, strip.max.y)), 0.0, t.hover);
+        }
+        egui::Popup::menu(&cresp).show(|ui| {
+            let prefix = format!("timeline.track.{}{}.color", if r.kind == TrackKind::Video { "V" } else { "A" }, r.index + 1);
+            let none = ui.selectable_label(tr.label.is_none(), tl!("None"));
+            app.auto.add(&format!("{prefix}.None"), none.rect, "None");
+            if none.clicked() {
+                actions.push(("timeline.setTrack".into(), json!({"track": r.track.0, "label": ""})));
+                ui.close();
+            }
+            // the user's label names and colours, as in Edit ▸ Label
+            let labels = app.session.prefs.labels.clone();
+            for l in filmcraft_project::Label::ALL {
+                if crate::menus::label_choice(ui, &mut app.auto, &labels, l, &prefix).clicked() {
+                    actions.push(("timeline.setTrack".into(), json!({"track": r.track.0, "label": l.name()})));
+                    ui.close();
+                }
+            }
+        });
         p.line_segment([pos2(hrect.min.x, hrect.max.y - 0.5), pos2(hrect.max.x, hrect.max.y - 0.5)], Stroke::new(1.0, t.separator));
         if r.kind == TrackKind::Video && r.index + 1 == seq.video_tracks.len() {
             p.line_segment([pos2(hrect.min.x, hrect.min.y + 0.5), pos2(hrect.max.x, hrect.min.y + 0.5)], Stroke::new(1.0, t.separator));
@@ -1268,7 +1444,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
         let patched = if r.kind == TrackKind::Video { tg.video_dest == Some(r.track) } else { tg.audio_dest == Some(r.track) };
         let pr = btn_rect(13.0);
         app.auto.add(&format!("timeline.track.{label}.sourcePatch"), pr, "Source patch");
-        if patch_button(ui, pr, visible, &label, patched, false, egui::Id::new(("patch", r.track.0)), t).clicked() {
+        if patch_button(ui, pr, visible, &label, patched, false, egui::Id::unique(("patch", r.track.0)), t).clicked() {
             actions.push(("timeline.setTargeting".into(), json!({"track": r.track.0, "sourcePatch": !patched})));
         }
         // 2. track lock
@@ -1281,7 +1457,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
             if tr.locked { Icon::Lock } else { Icon::Unlock },
             true,
             t,
-            egui::Id::new(("locked", r.track.0)),
+            egui::Id::unique(("locked", r.track.0)),
             Some(if tr.locked { t.icon_active } else { t.text_dim }),
         );
         app.auto.add(&format!("timeline.track.{label}.locked"), lock_r, "Toggle Track Lock");
@@ -1296,14 +1472,21 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
         let targeted = tg.targeted.contains(&r.track);
         let trr = btn_rect(61.0);
         app.auto.add(&format!("timeline.track.{label}.target"), trr, "Toggle track targeting");
-        if patch_button(ui, trr, visible, &label, targeted, true, egui::Id::new(("target", r.track.0)), t).clicked() {
+        if patch_button(ui, trr, visible, &label, targeted, true, egui::Id::unique(("target", r.track.0)), t).clicked() {
             actions.push(("timeline.setTargeting".into(), json!({"track": r.track.0, "targeted": !targeted})));
         }
         // 4. upper line icons
         let mut x = 102.0;
         let sr = small(x, upper_y);
-        let sresp =
-            crate::widgets::icon_toggle(ui, sr.intersect(visible), Icon::SyncLock, tr.sync_lock, t, egui::Id::new(("syncLock", r.track.0)), Some(t.text_dim));
+        let sresp = crate::widgets::icon_toggle(
+            ui,
+            sr.intersect(visible),
+            Icon::SyncLock,
+            tr.sync_lock,
+            t,
+            egui::Id::unique(("syncLock", r.track.0)),
+            Some(t.text_dim),
+        );
         app.auto.add(&format!("timeline.track.{label}.syncLock"), sr, "Toggle Sync Lock");
         if sresp.clicked() {
             actions.push(("timeline.setTrack".into(), json!({"track": r.track.0, "syncLock": !tr.sync_lock})));
@@ -1317,7 +1500,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
                 if tr.enabled { Icon::Eye } else { Icon::EyeOff },
                 true,
                 t,
-                egui::Id::new(("enabled", r.track.0)),
+                egui::Id::unique(("enabled", r.track.0)),
                 Some(t.text_dim),
             );
             app.auto.add(&format!("timeline.track.{label}.enabled"), er, "Toggle Track Output");
@@ -1333,7 +1516,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
                 tr.muted,
                 Color32::from_rgb(0x2d, 0x9d, 0x78),
                 t,
-                egui::Id::new(("mute", r.track.0)),
+                egui::Id::unique(("mute", r.track.0)),
             );
             app.auto.add(&format!("timeline.track.{label}.muted"), mr, "Mute Track");
             if mresp.clicked() {
@@ -1347,7 +1530,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
                 tr.solo,
                 Color32::from_rgb(0xf0, 0xf0, 0x4f),
                 t,
-                egui::Id::new(("solo", r.track.0)),
+                egui::Id::unique(("solo", r.track.0)),
             );
             app.auto.add(&format!("timeline.track.{label}.solo"), s2, "Solo Track");
             if so.clicked() {
@@ -1376,7 +1559,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
                 continue;
             }
             app.auto.add(&format!("timeline.track.{label}.{name}"), edge, "Drag to change the track height");
-            let eresp = ui.interact(edge, egui::Id::new(("trackh", name, r.track.0)), Sense::drag());
+            let eresp = ui.interact(edge, egui::Id::unique(("trackh", name, r.track.0)), Sense::drag());
             if eresp.hovered() || eresp.dragged() {
                 ui.ctx().set_cursor_icon(CursorIcon::ResizeVertical);
             }
@@ -1388,7 +1571,7 @@ fn draw_headers(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, rows:
         }
         let resp = ui.interact(
             Rect::from_min_max(pos2(hrect.min.x + 90.0, hrect.min.y + 26.0), hrect.max).intersect(visible),
-            egui::Id::new(("hdr", r.track.0)),
+            egui::Id::unique(("hdr", r.track.0)),
             Sense::click(),
         );
         if resp.double_clicked() {
@@ -1424,6 +1607,7 @@ pub fn ruler_steps(frame_px: f64, base: i64) -> (i64, i64) {
     (minor, label_step)
 }
 
+/// Draw editable timecode, the timeline toolbar and ruler. Rejected timecode edits report a status message; toolbar command errors are ignored.
 fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequence, layout: &Layout, t: &Tokens, seq_id: ItemId) {
     let p = ui.painter().clone();
     let rate = seq.settings.frame_rate;
@@ -1434,7 +1618,7 @@ fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequenc
     // current timecode: Premiere's big blue timecode
     let tc = format_time(app.session.playhead(), rate, seq.settings.drop_frame, TimeDisplay::Timecode, seq.settings.sample_rate as i64);
     let tc_rect = Rect::from_min_size(pos2(rect.min.x + 14.0, rect.min.y + 4.0), vec2(hw - 20.0, 20.0));
-    let tc_id = egui::Id::new(("timeline-tc", seq_id));
+    let tc_id = egui::Id::unique(("timeline-tc", seq_id));
     match crate::widgets::timecode_field(ui, tc_id, tc_rect, &tc, app.session.playhead(), Tick::ZERO, rate, seq.settings.drop_frame, t.timecode) {
         Some(Ok(time)) => {
             if let Err(e) = app.session.execute("playhead.set", json!({"time": time.0})) {
@@ -1458,7 +1642,7 @@ fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequenc
     ];
     for (icon, key, on, toggle, tip) in toggles {
         let r = Rect::from_min_size(pos2(x, y), vec2(28.0, 28.0));
-        let resp = ui.interact(r, egui::Id::new(("tl-toggle", key)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("tl-toggle", key)), Sense::click()).on_hover_text(tip);
         app.auto.add(&format!("timeline.toggle.{key}"), r, tip);
         if toggle && on {
             p.rect_filled(r, 4.0, t.pressed);
@@ -1499,6 +1683,12 @@ fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequenc
                 if c.changed() {
                     let _ = app.session.execute("sequence.showThroughEdits", json!({"on": te}));
                 }
+                let mut df = app.session.state.show_duplicate_frame_markers;
+                let c = ui.checkbox(&mut df, tl!("Show Duplicate Frame Markers"));
+                app.auto.add("timeline.settings.showDuplicateFrameMarkers", c.rect, "Show Duplicate Frame Markers");
+                if c.changed() {
+                    let _ = app.session.execute("sequence.showDuplicateFrameMarkers", json!({"on": df}));
+                }
                 ui.separator();
                 if ui.button(tl!("Expand All Tracks")).clicked() {
                     app.ui.timeline.video_track_h = 64.0;
@@ -1576,11 +1766,32 @@ fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequenc
         let hit = r.expand2(vec2(0.0, 2.0));
         app.auto.add(&format!("timeline.renderBar.{i}"), hit, what);
         if ui.rect_contains_pointer(hit) {
-            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new(("rb", i)), egui::PopupAnchor::Pointer).show(|ui| {
+            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique(("rb", i)), egui::PopupAnchor::Pointer).show(|ui| {
                 ui.label(what);
             });
         }
     }
+    // work area bar: between the markers row and the time labels, as dragged while a drag of it runs
+    let shown = match app.tl.drag {
+        Some(Drag::WorkArea { start, end, .. }) => Some(TimeRange::from_bounds(start, end)),
+        _ => seq.work_area,
+    };
+    if let Some(area) = shown {
+        let r = work_area_rect(layout, area);
+        clip.rect_filled(r, 1.0, t.text_dim);
+        for x in [r.min.x, r.max.x] {
+            clip.rect_filled(Rect::from_center_size(pos2(x, r.center().y), vec2(3.0, r.height() + 2.0)), 1.0, t.text);
+        }
+        app.auto.add("timeline.workArea", r.intersect(ruler), "Work Area Bar");
+        let fmt = |tick: Tick| format_time(tick, rate, seq.settings.drop_frame, TimeDisplay::Timecode, 48000);
+        if ui.rect_contains_pointer(r.expand2(vec2(EDGE_PX, 1.0)).intersect(ruler)) {
+            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique("work-area-tip"), egui::PopupAnchor::Pointer).show(|ui| {
+                ui.label(tlf!("Start: {tc}", tc = fmt(area.start)));
+                ui.label(tlf!("End: {tc}", tc = fmt(area.end())));
+                ui.label(tlf!("Duration: {tc}", tc = fmt(area.duration)));
+            });
+        }
+    }
     // markers: 8 × 12 pt pentagons in the marker colour, on the top row
     for m in &seq.markers {
         let x = layout.x_of(m.start);
@@ -1596,7 +1807,7 @@ fn draw_top(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, seq: &Sequenc
         let mr = marker_rect(layout, m.start);
         app.auto.add(&format!("timeline.marker.{}", m.id.0), mr, &m.name);
         if ui.rect_contains_pointer(mr) && !m.name.is_empty() {
-            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new(("mk", m.id.0)), egui::PopupAnchor::Pointer).show(|ui| {
+            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique(("mk", m.id.0)), egui::PopupAnchor::Pointer).show(|ui| {
                 ui.label(&m.name);
             });
         }
@@ -1622,6 +1833,8 @@ fn zoom_thumb(bar: Rect, seq_seconds: f64, scroll: f64, pps: f64) -> (f32, f32,
     (bar.min.x + at, w, if travel > 0.5 { range / travel as f64 } else { 0.0 })
 }
 
+/// Draw the zoom scroll bar: the thumb reflects the visible range, a press beside it centres the thumb under the pointer, and the thumb and track are
+/// registered for automation.
 fn zoom_scrollbar(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, seq_seconds: f64, t: &Tokens) {
     let p = ui.painter();
     p.rect_filled(bar, bar.height() / 2.0, t.separator);
@@ -1638,7 +1851,7 @@ fn zoom_scrollbar(app: &mut FilmcraftApp, ui: &mut egui::Ui, bar: Rect, seq_seco
     }
     app.auto.add("timeline.zoomBar", thumb, "zoom scroll bar");
     app.auto.add("timeline.zoomBar.track", bar, "zoom scroll bar track");
-    let resp = ui.interact(bar, egui::Id::new("tl-zoombar"), Sense::click_and_drag());
+    let resp = ui.interact(bar, egui::Id::unique("tl-zoombar"), Sense::click_and_drag());
     let range = (total - vis).max(0.0);
     // a press beside the thumb brings the thumb's middle under the pointer (and a drag goes on
     // from there)
@@ -1728,7 +1941,7 @@ fn vertical_scrollbar(ui: &mut egui::Ui, bar: Rect, value: &mut f32, max: f32, i
     p.rect_filled(track, track.width() / 2.0, t.separator);
     let hover = ui.rect_contains_pointer(thumb);
     p.rect_filled(thumb, thumb.width() / 2.0, if hover { t.scroll_thumb_hover } else { t.scroll_thumb });
-    let resp = ui.interact(bar, egui::Id::new(("tl-vs", id)), Sense::drag());
+    let resp = ui.interact(bar, egui::Id::unique(("tl-vs", id)), Sense::drag());
     if resp.dragged() {
         let d = resp.drag_delta().y / (bar.height() - h).max(1.0) * max;
         *value = (*value + if invert { -d } else { d }).clamp(0.0, max);
@@ -1736,7 +1949,7 @@ fn vertical_scrollbar(ui: &mut egui::Ui, bar: Rect, value: &mut f32, max: f32, i
 }
 
 /// Snap `t` to nearby candidates (edits, playhead, markers, in/out). Returns snapped tick.
-fn snap(app: &mut FilmcraftApp, seq: &Sequence, layout: &Layout, t: Tick, exclude: &[ClipId]) -> Tick {
+pub(super) fn snap(app: &mut FilmcraftApp, seq: &Sequence, layout: &Layout, t: Tick, exclude: &[ClipId]) -> Tick {
     snap_to(app, seq, layout, t, exclude, true)
 }
 
@@ -1796,6 +2009,7 @@ pub fn hit_json(app: &FilmcraftApp, pos: Pos2, mods: egui::Modifiers) -> Value {
     };
     match grab.hit() {
         Hit::Ruler => json!({"hit": "ruler", "time": t.0}),
+        Hit::WorkArea { edge } => json!({"hit": "workArea", "edge": edge.map(|e| format!("{e:?}")), "time": t.0}),
         Hit::Clip { track, clip, edge } => {
             json!({"hit": "clip", "track": track.0, "clip": clip.0, "edge": edge.map(|e| format!("{e:?}")), "kind": kind, "time": t.0})
         }
@@ -1844,16 +2058,17 @@ fn preview_drag(app: &FilmcraftApp, seq: &Sequence, out: &mut HashMap<ClipId, (T
                 out.insert(*clip, (it.start, it.duration + *delta, None));
             }
         }
-        Drag::Trim { clip, edge, delta, .. } => {
-            for c in filmcraft_engine::commands::with_links(&app.session, &[*clip]) {
+        Drag::Trim { clip, edge, delta, linked, .. } => {
+            let ids = if *linked { filmcraft_engine::commands::with_links(&app.session, &[*clip]) } else { vec![*clip] };
+            for c in ids {
                 if let Some((_, it)) = seq.find_item(c) {
                     moved(it, *edge, *delta);
                 }
             }
         }
         // a rate stretch keeps the same media in a new length: that one does squeeze
-        Drag::Stretch { clip, edge, delta, .. } => {
-            let ids = filmcraft_engine::commands::with_links(&app.session, &[*clip]);
+        Drag::Stretch { clip, edge, delta, linked, .. } => {
+            let ids = if *linked { filmcraft_engine::commands::with_links(&app.session, &[*clip]) } else { vec![*clip] };
             for c in ids {
                 if let Some((_, it)) = seq.find_item(c) {
                     let v = match edge {
@@ -2214,10 +2429,12 @@ fn scrub_playhead(app: &mut FilmcraftApp, seq: &Sequence, layout: &Layout, p: Po
     app.session.set_playhead(tt);
 }
 
+/// Handle Timeline pointer input: remember the grab from the press frame, jump the playhead on a ruler press, select a marker on its press, and reset the
+/// cancel flag once the button is released.
 fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &Layout, rect: Rect) {
     let ctx = ui.ctx().clone();
     let area = Rect::from_min_max(pos2(layout.content.min.x, layout.ruler.min.y), layout.content.max);
-    let resp = ui.interact(area, egui::Id::new("timeline-area"), Sense::click_and_drag());
+    let resp = ui.interact(area, egui::Id::unique("timeline-area"), Sense::click_and_drag());
     let pos = resp.hover_pos().or(resp.interact_pointer_pos());
     let mods = ctx.input(|i| i.modifiers);
     let tool = app.ui.tool;
@@ -2309,6 +2526,8 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 (_, Grab::Edge { .. }) => CursorIcon::ResizeColumn,
                 (Tool::Selection, Grab::Other(Hit::Transition { edge: Some(_), .. })) => CursorIcon::ResizeColumn,
                 (Tool::Selection, Grab::Other(Hit::Transition { edge: None, .. })) => CursorIcon::Grab,
+                (_, Grab::Other(Hit::WorkArea { edge: Some(_) })) => CursorIcon::ResizeColumn,
+                (_, Grab::Other(Hit::WorkArea { edge: None })) => CursorIcon::Grab,
                 (_, Grab::Volume { .. }) if tool == Tool::Pen || mods.command => CursorIcon::Crosshair,
                 (_, Grab::Volume { .. }) => CursorIcon::ResizeVertical,
                 (Tool::Razor, Grab::Other(Hit::Clip { .. })) => CursorIcon::Crosshair,
@@ -2360,6 +2579,9 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 Some(Drag::Pan { last, start_scroll: app.ui.timeline.target_scroll, start_v: app.ui.timeline.v_scroll })
             }
             (_, Grab::Other(Hit::Ruler)) => Some(Drag::Scrub { initial: app.session.playhead() }),
+            (_, Grab::Other(Hit::WorkArea { edge })) => {
+                seq.work_area.filter(|_| resp.drag_started()).map(|w| Drag::WorkArea { edge, from: t, start: w.start, end: w.end() })
+            }
             (Tool::Hand, _) => Some(Drag::Pan { last: p, start_scroll: app.ui.timeline.target_scroll, start_v: app.ui.timeline.v_scroll }),
             (Tool::Zoom, _) => {
                 if resp.clicked() {
@@ -2431,10 +2653,10 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 None
             }
             (_, Grab::Edge { clip, edge, kind, .. }) => Some(match kind {
-                EdgeKind::Trim => Drag::Trim { clip, edge, mode: filmcraft_edit::TrimMode::Regular, delta: Tick::ZERO, from: t },
-                EdgeKind::Ripple => Drag::Trim { clip, edge, mode: filmcraft_edit::TrimMode::Ripple, delta: Tick::ZERO, from: t },
+                EdgeKind::Trim => Drag::Trim { clip, edge, mode: filmcraft_edit::TrimMode::Regular, delta: Tick::ZERO, from: t, linked: !mods.alt },
+                EdgeKind::Ripple => Drag::Trim { clip, edge, mode: filmcraft_edit::TrimMode::Ripple, delta: Tick::ZERO, from: t, linked: !mods.alt },
                 EdgeKind::Roll { left, right } => Drag::Roll { left, right, delta: Tick::ZERO, from: t },
-                EdgeKind::Stretch => Drag::Stretch { clip, edge, delta: Tick::ZERO, from: t },
+                EdgeKind::Stretch => Drag::Stretch { clip, edge, delta: Tick::ZERO, from: t, linked: !mods.alt },
                 EdgeKind::Remix => Drag::Remix { clip, delta: Tick::ZERO, from: t },
             }),
             (_, Grab::Volume { clip, .. }) if resp.drag_started() => super::timeline_volume::start(seq, layout, clip, p).map(Drag::Volume),
@@ -2598,25 +2820,28 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                     Some(Drag::Move { clips, grab_tick, start_track, offset, track_delta, new_track, copy: mods.alt })
                 }
             }
-            Drag::Trim { clip, edge, mode, from, .. } => seq.find_item(clip).map(|(_, it)| {
+            Drag::Trim { clip, edge, mode, from, linked, .. } => seq.find_item(clip).map(|(_, it)| {
                 let base = if edge == filmcraft_edit::Edge::In { it.start } else { it.end() };
                 let target = snap(app, seq, layout, rate.snap_nearest(base + (t_here - from)), &[clip]);
                 // stop at the end of the media (or the neighbour), as the trim on release will (#653)
-                let delta = filmcraft_engine::commands::trim_delta(&app.session, clip, edge, mode, target - base).unwrap_or(target - base);
-                Drag::Trim { clip, edge, mode, delta, from }
+                let delta = filmcraft_engine::commands::trim_delta_linked(&app.session, clip, edge, mode, target - base, linked).unwrap_or(target - base);
+                Drag::Trim { clip, edge, mode, delta, from, linked }
             }),
             Drag::Remix { clip, from, .. } => seq.find_item(clip).map(|(_, it)| {
                 let target = rate.snap_nearest(it.end() + (t_here - from)).max(it.start + rate.frame_duration());
                 Drag::Remix { clip, delta: target - it.end(), from }
             }),
-            Drag::Stretch { clip, edge, from, .. } => seq.find_item(clip).map(|(_, it)| {
+            Drag::Stretch { clip, edge, from, linked, .. } => seq.find_item(clip).map(|(_, it)| {
                 let base = if edge == filmcraft_edit::Edge::In { it.start } else { it.end() };
                 let target = snap(app, seq, layout, rate.snap_nearest(base + (t_here - from)), &[clip]);
-                Drag::Stretch { clip, edge, delta: target - base, from }
+                Drag::Stretch { clip, edge, delta: target - base, from, linked }
             }),
             Drag::Roll { left, right, from, .. } => seq.find_item(left).map(|(_, l)| {
                 let target = snap(app, seq, layout, rate.snap_nearest(l.end() + (t_here - from)), &[left, right]);
-                Drag::Roll { left, right, delta: target - l.end(), from }
+                // stop where the roll on release stops: the media, a frame left in each clip and linked
+                // cuts
+                let delta = filmcraft_engine::commands::roll_delta(&app.session, left, right, target - l.end()).unwrap_or(target - l.end());
+                Drag::Roll { left, right, delta, from }
             }),
             Drag::Slip { clip, .. } => {
                 let start = resp.interact_pointer_pos().map(|_| ()).and(ctx.input(|i| i.pointer.press_origin()));
@@ -2635,6 +2860,21 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 let (start, duration) = span.unwrap_or((start, duration));
                 Some(Drag::Transition { id, edge, from, start, duration })
             }
+            Drag::WorkArea { edge, from, start, end } => {
+                // the bar as it was at the press: the sequence keeps it until the release
+                let (s0, e0) = seq.work_area.map(|w| (w.start, w.end())).unwrap_or((start, end));
+                let fd = rate.frame_duration();
+                let delta = rate.snap_nearest(t_here - from);
+                let (start, end) = match edge {
+                    Some(filmcraft_edit::Edge::In) => (snap(app, seq, layout, rate.snap_nearest(s0 + delta), &[]).min(e0 - fd).max(Tick::ZERO), e0),
+                    Some(filmcraft_edit::Edge::Out) => (s0, snap(app, seq, layout, rate.snap_nearest(e0 + delta), &[]).max(s0 + fd)),
+                    None => {
+                        let d = delta.max(Tick::ZERO - s0);
+                        (s0 + d, e0 + d)
+                    }
+                };
+                Some(Drag::WorkArea { edge, from, start, end })
+            }
             Drag::Volume(v) => Some(Drag::Volume(super::timeline_volume::drag(app, ui, seq, layout, v, p.y))),
             Drag::Marquee { start, before, add, individual } => {
                 let r = Rect::from_two_pos(start, p);
@@ -2684,18 +2924,20 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 Drag::Move { clips, offset, track_delta, new_track, copy, .. } if offset != Tick::ZERO || track_delta != 0 || new_track.is_some() => {
                     // #1104: dropped past the last track, the clips go onto a new one
                     let to = |tid| new_track.map_or_else(|| json!(shift_track(seq, tid, track_delta).unwrap_or(tid).0), |_| json!("new"));
+                    let mut seen = std::collections::HashSet::new();
                     let moves: Vec<Value> = clips
                         .iter()
+                        .filter(|c| seen.insert(**c))
                         .filter_map(|c| seq.find_item(*c).map(|(tid, it)| json!({"clip": c.0, "track": to(tid), "time": (it.start + offset).max(Tick::ZERO).0})))
                         .collect();
                     // Option held while dropping copies (Premiere: Option-drag duplicates)
                     Some(app.session.execute("timeline.move", json!({"moves": moves, "insert": mods.command, "linked": false, "copy": copy || mods.alt})))
                 }
-                Drag::Trim { clip, edge, mode, delta, .. } if delta != Tick::ZERO => Some(app.session.execute(
+                Drag::Trim { clip, edge, mode, delta, linked, .. } if delta != Tick::ZERO => Some(app.session.execute(
                     "timeline.trim",
-                    json!({"clip": clip.0, "edge": if edge == filmcraft_edit::Edge::In {"in"} else {"out"}, "mode": if mode == filmcraft_edit::TrimMode::Ripple {"ripple"} else {"regular"}, "delta": delta.0}),
+                    json!({"clip": clip.0, "edge": if edge == filmcraft_edit::Edge::In {"in"} else {"out"}, "mode": if mode == filmcraft_edit::TrimMode::Ripple {"ripple"} else {"regular"}, "delta": delta.0, "linked": linked}),
                 )),
-                Drag::Stretch { clip, edge, delta, .. } if delta != Tick::ZERO => Some(app.session.execute("timeline.rateStretch", json!({"clip": clip.0, "edge": if edge == filmcraft_edit::Edge::In {"in"} else {"out"}, "delta": delta.0}))),
+                Drag::Stretch { clip, edge, delta, linked, .. } if delta != Tick::ZERO => Some(app.session.execute("timeline.rateStretch", json!({"clip": clip.0, "edge": if edge == filmcraft_edit::Edge::In {"in"} else {"out"}, "delta": delta.0, "linked": linked}))),
                 Drag::Remix { clip, delta, .. } if delta != Tick::ZERO => {
                     let d = seq.find_item(clip).map(|(_, it)| it.duration + delta).unwrap_or(Tick::ZERO);
                     Some(app.session.execute("clip.remix", json!({"clip": clip.0, "duration": d.0})))
@@ -2707,6 +2949,10 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                     let moved = seq.all_tracks().find_map(|tr| tr.transitions.iter().find(|x| x.id == id)).is_some_and(|x| (x.start, x.duration) != (start, duration));
                     moved.then(|| app.session.execute("sequence.setTransition", json!({"transition": id.0, "start": start.0, "duration": duration.0})))
                 }
+                Drag::WorkArea { start, end, .. } => {
+                    let moved = seq.work_area.is_some_and(|w| (w.start, w.end()) != (start, end));
+                    moved.then(|| app.session.execute("sequence.setWorkArea", json!({"start": start.0, "end": end.0})))
+                }
                 Drag::Marquee { start, before, add, individual } => {
                     app.session.state.selection = before;
                     // egui ends a drag on Escape: that cancels the box, as in the Project panel
@@ -2728,6 +2974,21 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         }
     }
 
+    // ---- double-click the work area bar: it spans the part of the sequence the ruler shows
+    if resp.double_clicked()
+        && let Some(p) = resp.interact_pointer_pos()
+        && let Hit::WorkArea { .. } = hit(seq, layout, p)
+    {
+        let start = rate.snap_nearest(layout.tick_at(layout.content.min.x).max(Tick::ZERO));
+        let end = rate.snap_nearest(layout.tick_at(layout.content.max.x)).min(seq.duration());
+        // a ruler scrolled past the end of the sequence leaves the bar as it is
+        if end > start
+            && let Err(e) = app.session.execute("sequence.setWorkArea", json!({"start": start.0, "end": end.0}))
+        {
+            app.ui.status = e.to_string();
+        }
+    }
+
     // ---- double-click a transition: Set Transition Duration (Premiere)
     if resp.double_clicked()
         && tool == Tool::Selection
@@ -2767,11 +3028,11 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
 
     // ---- context menu on clips (right-clicking an unselected clip selects it first); on a clip's
     // edge, the edit point menu instead (right-clicking an unselected edit point selects it first)
-    let edit_point_menu_id = egui::Id::new("timeline.editPointMenu.target");
+    let edit_point_menu_id = egui::Id::unique("timeline.editPointMenu.target");
     // the clip right-clicked, remembered while its menu is open: Unlink leaves only it selected
-    let menu_clip_id = egui::Id::new("timeline.clipMenu.clip");
+    let menu_clip_id = egui::Id::unique("timeline.clipMenu.clip");
     // right-clicking empty time between clips selects the gap and opens its menu (#648, #668)
-    let gap_menu_id = egui::Id::new("timeline.gapMenu.open");
+    let gap_menu_id = egui::Id::unique("timeline.gapMenu.open");
     if resp.secondary_clicked()
         && let Some(p) = resp.interact_pointer_pos()
     {
@@ -2786,7 +3047,7 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         }
     }
     // on a marker of the ruler, the marker menu instead (right-clicking a marker selects it first)
-    let marker_menu_id = egui::Id::new("timeline.markerMenu.target");
+    let marker_menu_id = egui::Id::unique("timeline.markerMenu.target");
     if resp.secondary_clicked()
         && let Some(p) = resp.interact_pointer_pos()
     {
@@ -2822,76 +3083,80 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         }
     }
     resp.context_menu(|ui| {
-        ui.set_min_width(220.0);
-        if let Some(marker) = ctx.data(|d| d.get_temp::<Option<MarkerId>>(marker_menu_id)).flatten() {
-            marker_menu(app, &ctx, ui, marker);
-            return;
-        }
-        if let Some(target) = ctx.data(|d| d.get_temp::<Option<EditPointTarget>>(edit_point_menu_id)).flatten() {
-            edit_point_menu(app, &ctx, ui, seq, target);
-            return;
-        }
-        if ctx.data(|d| d.get_temp::<bool>(gap_menu_id)).unwrap_or(false) {
-            gap_menu(app, &ctx, ui);
-            return;
-        }
-        let sel = app.session.state.selection.clone();
-        let picked: Vec<&filmcraft_project::TrackItem> = sel.iter().filter_map(|c| seq.find_item(*c).map(|(_, it)| it)).collect();
-        let all_enabled = !picked.is_empty() && picked.iter().all(|it| it.enabled);
-        let linked = picked.iter().any(|it| it.link.is_some());
-        let mut first = true;
-        for group in CLIP_MENU {
-            if !std::mem::take(&mut first) {
-                ui.separator();
+        // a long menu scrolls instead of running off the bottom of the screen (#2852)
+        let max_height = (ui.ctx().content_rect().height() - 16.0).max(0.0);
+        egui::ScrollArea::vertical().id_salt("clip-menu-scroll").max_height(max_height).min_scrolled_height(max_height).show(ui, |ui| {
+            ui.set_min_width(220.0);
+            if let Some(marker) = ctx.data(|d| d.get_temp::<Option<MarkerId>>(marker_menu_id)).flatten() {
+                marker_menu(app, &ctx, ui, marker);
+                return;
             }
-            for &(label, cmd) in *group {
-                if cmd == "edit.label" {
-                    ui.add_enabled_ui(!picked.is_empty(), |ui| {
-                        let menu = ui.menu_button(crate::i18n::t(label), |ui| {
-                            // the user's label names and colours, as in Edit ▸ Label (#786)
-                            let labels = app.session.prefs.labels.clone();
-                            for l in filmcraft_project::Label::ALL {
-                                if crate::menus::label_choice(ui, &mut app.auto, &labels, l, "timeline.clipMenu.label").clicked() {
-                                    if let Err(error) = app.session.execute("edit.label", json!({"label":l.name()})) {
-                                        app.ui.status = error.to_string();
+            if let Some(target) = ctx.data(|d| d.get_temp::<Option<EditPointTarget>>(edit_point_menu_id)).flatten() {
+                edit_point_menu(app, &ctx, ui, seq, target);
+                return;
+            }
+            if ctx.data(|d| d.get_temp::<bool>(gap_menu_id)).unwrap_or(false) {
+                gap_menu(app, &ctx, ui);
+                return;
+            }
+            let sel = app.session.state.selection.clone();
+            let picked: Vec<&filmcraft_project::TrackItem> = sel.iter().filter_map(|c| seq.find_item(*c).map(|(_, it)| it)).collect();
+            let all_enabled = !picked.is_empty() && picked.iter().all(|it| it.enabled);
+            let linked = picked.iter().any(|it| it.link.is_some());
+            let mut first = true;
+            for group in CLIP_MENU {
+                if !std::mem::take(&mut first) {
+                    ui.separator();
+                }
+                for &(label, cmd) in *group {
+                    if cmd == "edit.label" {
+                        ui.add_enabled_ui(!picked.is_empty(), |ui| {
+                            let menu = ui.menu_button(crate::i18n::t(label), |ui| {
+                                // the user's label names and colours, as in Edit ▸ Label (#786)
+                                let labels = app.session.prefs.labels.clone();
+                                for l in filmcraft_project::Label::ALL {
+                                    if crate::menus::label_choice(ui, &mut app.auto, &labels, l, "timeline.clipMenu.label").clicked() {
+                                        if let Err(error) = app.session.execute("edit.label", json!({"label":l.name()})) {
+                                            app.ui.status = error.to_string();
+                                        }
+                                        ui.close();
                                     }
-                                    ui.close();
+                                }
+                            });
+                            app.auto.add_response("timeline.clipMenu.edit.label", &menu.response, crate::i18n::t(label));
+                        });
+                        continue;
+                    }
+                    if cmd == "clip.multicam" {
+                        multicam_menu(app, ui, &picked);
+                        continue;
+                    }
+                    let label = match cmd {
+                        "clip.enable" if all_enabled => tl!("✓ Enable"),
+                        "clip.link" if linked => tl!("Unlink"),
+                        _ => crate::i18n::t(label),
+                    };
+                    let r = ui.add_enabled(!sel.is_empty() && app.session.is_enabled(cmd), egui::Button::new(label));
+                    app.auto.add(&format!("timeline.clipMenu.{cmd}"), r.rect, label);
+                    if r.clicked() {
+                        match crate::menus::invoke(app, &ctx, cmd, json!({})) {
+                            // Unlink (#220): the clips were selected together because they were linked;
+                            // keep only the one right-clicked, so it can be dragged away from the others
+                            Ok(v) if cmd == "clip.link" && v["linked"] == json!(false) => {
+                                if let Some(clip) = ctx.data(|d| d.get_temp::<ClipId>(menu_clip_id))
+                                    && app.session.state.selection.contains(&clip)
+                                {
+                                    let _ = app.session.execute("timeline.select", json!({"clips": [clip.0]}));
                                 }
                             }
-                        });
-                        app.auto.add_response("timeline.clipMenu.edit.label", &menu.response, crate::i18n::t(label));
-                    });
-                    continue;
-                }
-                if cmd == "clip.multicam" {
-                    multicam_menu(app, ui, &picked);
-                    continue;
-                }
-                let label = match cmd {
-                    "clip.enable" if all_enabled => tl!("✓ Enable"),
-                    "clip.link" if linked => tl!("Unlink"),
-                    _ => crate::i18n::t(label),
-                };
-                let r = ui.add_enabled(!sel.is_empty() && app.session.is_enabled(cmd), egui::Button::new(label));
-                app.auto.add(&format!("timeline.clipMenu.{cmd}"), r.rect, label);
-                if r.clicked() {
-                    match crate::menus::invoke(app, &ctx, cmd, json!({})) {
-                        // Unlink (#220): the clips were selected together because they were linked;
-                        // keep only the one right-clicked, so it can be dragged away from the others
-                        Ok(v) if cmd == "clip.link" && v["linked"] == json!(false) => {
-                            if let Some(clip) = ctx.data(|d| d.get_temp::<ClipId>(menu_clip_id))
-                                && app.session.state.selection.contains(&clip)
-                            {
-                                let _ = app.session.execute("timeline.select", json!({"clips": [clip.0]}));
-                            }
+                            Ok(_) => {}
+                            Err(e) => app.ui.status = e,
                         }
-                        Ok(_) => {}
-                        Err(e) => app.ui.status = e,
+                        ui.close();
                     }
-                    ui.close();
                 }
             }
-        }
+        });
     });
 
     // ---- drops: project items and effects
@@ -3044,7 +3309,8 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         }
     }
     // ---- OS file drops imported with "drop imports to the timeline": placed at the drop point, one after another
-    if let Some((items, p)) = app.pending_timeline_drop.clone()
+    if let Some((items, p, viewport)) = app.pending_timeline_drop.clone()
+        && viewport == ui.ctx().viewport_id()
         && layout.content.contains(p)
         && app.timeline_drop_target(ui.ctx(), p)
     {
@@ -3065,7 +3331,8 @@ fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         }
     }
     // preview of OS files being dragged over the Timeline: a placeholder where the drop would start
-    if let Some((count, p)) = app.file_drag_hover
+    if let Some((count, p, viewport)) = app.file_drag_hover
+        && viewport == ui.ctx().viewport_id()
         && layout.content.contains(p)
         && app.timeline_drop_target(ui.ctx(), p)
     {
@@ -3155,7 +3422,7 @@ mod trim_preview_tests {
         let music = seq.audio_tracks.iter().flat_map(|t| &t.items).find(|i| i.name.contains("Ambient")).unwrap().clone();
         for (edge, delta) in [(filmcraft_edit::Edge::In, 5), (filmcraft_edit::Edge::Out, -5), (filmcraft_edit::Edge::In, -1)] {
             let delta = Tick(delta * filmcraft_time::TICKS_PER_SECOND);
-            app.tl.drag = Some(Drag::Trim { clip: music.id, edge, mode: filmcraft_edit::TrimMode::Regular, delta, from: Tick::ZERO });
+            app.tl.drag = Some(Drag::Trim { clip: music.id, edge, mode: filmcraft_edit::TrimMode::Regular, delta, from: Tick::ZERO, linked: true });
             let (mut out, mut edited) = (HashMap::new(), HashMap::new());
             preview_drag(&app, &seq, &mut out, &mut edited);
             let shown = edited.get(&music.id).expect("the trimmed clip is drawn from its edited item");
@@ -3186,7 +3453,7 @@ mod trim_preview_tests {
         assert_same_media(&right, &edited[&right.id]);
         assert_eq!(edited[&right.id].start, right.start + delta);
         // Rate Stretch keeps the same media in a new length: drawn from the original item
-        app.tl.drag = Some(Drag::Stretch { clip: left.id, edge: filmcraft_edit::Edge::Out, delta, from: Tick::ZERO });
+        app.tl.drag = Some(Drag::Stretch { clip: left.id, edge: filmcraft_edit::Edge::Out, delta, from: Tick::ZERO, linked: true });
         let (mut out, mut edited) = (HashMap::new(), HashMap::new());
         preview_drag(&app, &seq, &mut out, &mut edited);
         assert!(edited.is_empty() && out.contains_key(&left.id));
diff --git a/crates/ui-egui/src/panels/timeline_automation.rs b/crates/ui-egui/src/panels/timeline_automation.rs
index 4e4ecc086..dc35df9d2 100644
--- a/crates/ui-egui/src/panels/timeline_automation.rs
+++ b/crates/ui-egui/src/panels/timeline_automation.rs
@@ -97,9 +97,16 @@ fn band(r: &Row) -> Rect {
 pub fn header_button(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, r: &Row, rect: Rect, visible: Rect, label: &str, t: &Tokens) {
     let Some(tr) = seq.track(r.track) else { return };
     let showing = app.ui.timeline.track_lanes.get(&r.track.0).cloned();
-    let resp =
-        crate::widgets::icon_toggle(ui, rect.intersect(visible), Icon::Keyframe, showing.is_some(), t, egui::Id::new(("lanebtn", r.track.0)), Some(LANE_COL))
-            .on_hover_text(tl!("Show Keyframes"));
+    let resp = crate::widgets::icon_toggle(
+        ui,
+        rect.intersect(visible),
+        Icon::Keyframe,
+        showing.is_some(),
+        t,
+        egui::Id::unique(("lanebtn", r.track.0)),
+        Some(LANE_COL),
+    )
+    .on_hover_text(tl!("Show Keyframes"));
     app.auto.add(&format!("timeline.track.{label}.keyframes"), rect, "Show Keyframes");
     let opts = lane_options(tr);
     egui::Popup::menu(&resp).show(|ui| {
@@ -130,8 +137,9 @@ struct KfDrag {
     grab: egui::Vec2,
 }
 
+/// Single stable id for the in-flight track-automation keyframe drag.
 fn drag_id() -> egui::Id {
-    egui::Id::new("tl-lane-kf-drag")
+    egui::Id::unique("tl-lane-kf-drag")
 }
 
 /// Draw the shown lanes (after clips) and handle their editing (after the timeline's own interaction,
@@ -173,7 +181,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
         // add keyframes: Pen tool, or ⌘-click with any tool
         let adding = app.ui.tool == Tool::Pen || ui.input(|i| i.modifiers.command);
         if adding {
-            let bresp = ui.interact(vis, egui::Id::new(("lane-band", r.track.0)), Sense::click());
+            let bresp = ui.interact(vis, egui::Id::unique(("lane-band", r.track.0)), Sense::click());
             if bresp.hovered() {
                 ui.ctx().set_cursor_icon(CursorIcon::Crosshair);
             }
@@ -199,7 +207,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
                 continue;
             }
             let hr = Rect::from_center_size(c, vec2(11.0, 11.0));
-            let resp = ui.interact(hr, egui::Id::new(("lane-kf", r.track.0, i)), Sense::click_and_drag());
+            let resp = ui.interact(hr, egui::Id::unique(("lane-kf", r.track.0, i)), Sense::click_and_drag());
             let hot = resp.hovered() || dragging.is_some();
             icons::paint(&p, Rect::from_center_size(c, vec2(9.0, 9.0)), Icon::Keyframe, if hot { Color32::WHITE } else { LANE_COL });
             app.auto.add(&format!("timeline.track.{label}.lane.kf.{i}"), hr, &format!("{name} keyframe {v:.1}"));
@@ -221,7 +229,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layout: &
             }
             if dragging.is_some() {
                 let nv = denorm(tr, &key, ((b.max.y - c.y) / b.height()).clamp(0.0, 1.0));
-                egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new("lane-kf-tip"), egui::PopupAnchor::Pointer).show(|ui| {
+                egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique("lane-kf-tip"), egui::PopupAnchor::Pointer).show(|ui| {
                     ui.label(if key == LANE_VOLUME { format!("{nv:.2} dB") } else { format!("{nv:.2}") });
                 });
             }
diff --git a/crates/ui-egui/src/panels/timeline_captions.rs b/crates/ui-egui/src/panels/timeline_captions.rs
index 6b93456ae..6831bd72b 100644
--- a/crates/ui-egui/src/panels/timeline_captions.rs
+++ b/crates/ui-egui/src/panels/timeline_captions.rs
@@ -1,7 +1,8 @@
 //! Caption track rows of the Timeline: drawn in their own area above the video tracks (Premiere's
 //! layout). Each row has a header (C1…, name, format, output eye, lock) and caption blocks in a
-//! distinct colour showing their text. Click selects (Cmd/Shift adds), dragging the body moves,
-//! dragging an edge trims, double-click opens the Text panel's Captions tab. Every gesture ends in
+//! distinct colour showing their text. Click selects (Cmd/Shift adds), dragging the body moves
+//! the selection (Option-drag copies it), dragging an edge trims, the Razor tool splits (Shift:
+//! every caption track), double-click opens the Text panel's Captions tab. Every gesture ends in
 //! one `captions.*` command; every element registers an automation id (`timeline.caption.*`,
 //! `timeline.captionTrack.C1.*`).
 
@@ -14,6 +15,7 @@ use super::timeline::Layout;
 use crate::FilmcraftApp;
 use crate::dock::PanelKind;
 use crate::icons::Icon;
+use crate::state::Tool;
 use crate::theme::Tokens;
 
 /// Height of one caption track row.
@@ -34,8 +36,9 @@ enum Gesture {
     TrimOut,
 }
 
+/// Single stable id for the live caption drag `(caption, gesture, delta ticks)`.
 fn drag_id() -> egui::Id {
-    egui::Id::new("caption-drag")
+    egui::Id::unique("caption-drag")
 }
 
 /// Live drag state: (caption, gesture, delta ticks).
@@ -43,10 +46,11 @@ fn drag_state(ctx: &egui::Context) -> Option<(u64, u8, i64)> {
     ctx.data(|d| d.get_temp::<(u64, u8, i64)>(drag_id()))
 }
 
-fn block_rect(c: &filmcraft_project::Caption, row: Rect, layout: &Layout, drag: Option<(u64, u8, i64)>) -> Rect {
+/// Where a caption is drawn while a drag is live: a move carries the whole selection along with
+/// the grabbed caption, a trim only the grabbed one.
+fn block_rect(c: &filmcraft_project::Caption, row: Rect, layout: &Layout, drag: Option<(u64, u8, i64)>, sel: &[ClipId]) -> Rect {
     let (mut s, mut e) = (c.start, c.end());
-    if let Some((id, g, d)) = drag.filter(|d| d.0 == c.id.0) {
-        let _ = id;
+    if let Some((_, g, d)) = drag.filter(|d| moves_with(c.id, *d, sel)) {
         match g {
             0 => {
                 s += Tick(d);
@@ -59,6 +63,11 @@ fn block_rect(c: &filmcraft_project::Caption, row: Rect, layout: &Layout, drag:
     Rect::from_min_max(pos2(layout.x_of(s), row.min.y + 2.0), pos2(layout.x_of(e).max(layout.x_of(s) + 1.0), row.max.y - 2.0))
 }
 
+/// Whether caption `id` follows the live drag `(grabbed, gesture, delta)`.
+fn moves_with(id: ClipId, (grabbed, g, d): (u64, u8, i64), sel: &[ClipId]) -> bool {
+    d != 0 && (id.0 == grabbed || (g == 0 && sel.contains(&ClipId(grabbed)) && sel.contains(&id)))
+}
+
 /// Paint headers and caption blocks.
 pub fn paint(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area: Rect, layout: &Layout, t: &Tokens) {
     if seq.caption_tracks.is_empty() {
@@ -85,7 +94,7 @@ pub fn paint(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area: Re
         app.auto.add(&format!("timeline.captionTrack.{label}"), badge, &tr.name);
         // right-click the header: delete this track or every empty caption track (registered
         // before the lock / eye toggles so those stay on top)
-        let hresp = ui.interact(hrect, egui::Id::new(("cap-header", tr.id.0)), Sense::click());
+        let hresp = ui.interact(hrect, egui::Id::unique(("cap-header", tr.id.0)), Sense::click());
         hresp.context_menu(|ui| {
             for (key, text, cmd, p) in [
                 ("delete", tl!("Delete Caption Track"), "captions.deleteTrack", json!({"track": tr.id.0})),
@@ -107,7 +116,7 @@ pub fn paint(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area: Re
             if tr.locked { Icon::Lock } else { Icon::Unlock },
             true,
             t,
-            egui::Id::new(("cap-lock", tr.id.0)),
+            egui::Id::unique(("cap-lock", tr.id.0)),
             Some(if tr.locked { t.icon_active } else { t.text_dim }),
         );
         app.auto.add(&format!("timeline.captionTrack.{label}.locked"), lock_r, "Toggle Caption Track Lock");
@@ -121,7 +130,7 @@ pub fn paint(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area: Re
             if tr.enabled { Icon::Eye } else { Icon::EyeOff },
             true,
             t,
-            egui::Id::new(("cap-eye", tr.id.0)),
+            egui::Id::unique(("cap-eye", tr.id.0)),
             Some(t.text_dim),
         );
         app.auto.add(&format!("timeline.captionTrack.{label}.enabled"), eye_r, "Toggle Caption Track Output");
@@ -139,8 +148,13 @@ pub fn paint(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area: Re
         // caption blocks
         let p = painter.with_clip_rect(lane);
         let (v0, v1) = (layout.tick_at(content.min.x - 2.0), layout.tick_at(content.max.x + 2.0));
+        let copying = drag.is_some_and(|d| d.1 == 0) && ui.input(|i| i.modifiers.alt);
         for c in tr.captions.iter().filter(|c| c.end() >= v0 && c.start <= v1) {
-            let r = block_rect(c, row, layout, drag);
+            let r = block_rect(c, row, layout, drag, &sel);
+            // Option-drag copies: the original stays where it is under the copy being placed
+            if copying && drag.is_some_and(|d| moves_with(c.id, d, &sel)) {
+                p.rect_filled(block_rect(c, row, layout, None, &sel), 3.0, FILL);
+            }
             let selected = sel.contains(&c.id);
             p.rect_filled(r, 3.0, if selected { FILL_SEL } else { FILL });
             if selected {
@@ -174,20 +188,66 @@ pub fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, area:
     let ctx = ui.ctx().clone();
     let rate = seq.settings.frame_rate;
     let drag = drag_state(&ctx);
+    let sel = app.session.state.caption_selection.clone();
     let mut actions: Vec<(String, Value)> = Vec::new();
     for (tr, row) in seq.caption_tracks.iter().zip(rows(area, seq.caption_tracks.len())) {
         let lane = Rect::from_min_max(pos2(layout.content.min.x, row.min.y), pos2(layout.content.max.x, row.max.y));
         for c in &tr.captions {
-            let r = block_rect(c, row, layout, drag).intersect(lane);
+            let r = block_rect(c, row, layout, drag, &sel).intersect(lane);
             if r.width() <= 0.0 {
                 continue;
             }
-            interact_block(app, ui, tr, c, r, rate, &mut actions);
+            if app.ui.tool == Tool::Razor {
+                razor_block(app, ui, seq, layout, tr, c, r, row, &mut actions);
+            } else {
+                interact_block(app, ui, tr, c, r, rate, &mut actions);
+            }
         }
     }
     run(app, ui, actions);
 }
 
+/// The Razor tool over a caption: a white line where it would cut, and a click splits the caption
+/// there (Shift: every caption on an unlocked caption track at that time), as it cuts clips.
+#[allow(clippy::too_many_arguments)]
+fn razor_block(
+    app: &mut FilmcraftApp,
+    ui: &mut egui::Ui,
+    seq: &Sequence,
+    layout: &Layout,
+    tr: &CaptionTrack,
+    c: &filmcraft_project::Caption,
+    r: Rect,
+    row: Rect,
+    actions: &mut Vec<(String, Value)>,
+) {
+    let ctx = ui.ctx().clone();
+    let resp = ui.interact(r, egui::Id::unique(("caption-block", c.id.0)), Sense::click_and_drag());
+    if tr.locked {
+        return;
+    }
+    let rate = seq.settings.frame_rate;
+    let at = |app: &mut FilmcraftApp, x: f32| super::timeline::snap(app, seq, layout, rate.snap_nearest(layout.tick_at(x)), &[]);
+    if let Some(p) = resp.hover_pos() {
+        ctx.set_cursor_icon(CursorIcon::Crosshair);
+        let x = layout.x_of(at(app, p.x));
+        ui.painter().with_clip_rect(layout.content).line_segment([pos2(x, row.min.y), pos2(x, row.max.y)], Stroke::new(1.0, Color32::WHITE));
+    }
+    // a press that starts a drag cuts as well, as on clips
+    if (resp.clicked() || resp.drag_started())
+        && let Some(p) = ctx.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
+    {
+        let t = at(app, p.x);
+        if ctx.input(|i| i.modifiers.shift) {
+            actions.push(("captions.split".into(), json!({"time": t.0})));
+        } else if c.start < t && t < c.end() {
+            actions.push(("captions.split".into(), json!({"caption": c.id.0, "time": t.0})));
+        }
+    }
+}
+
+/// Handle one caption block: 5 px trim edges (capped at a quarter width), hover cursor, selection and double-click, and drag state; locked tracks are
+/// read-only.
 fn interact_block(
     app: &mut FilmcraftApp,
     ui: &mut egui::Ui,
@@ -198,7 +258,7 @@ fn interact_block(
     actions: &mut Vec<(String, Value)>,
 ) {
     let ctx = ui.ctx().clone();
-    let resp = ui.interact(r, egui::Id::new(("caption-block", c.id.0)), Sense::click_and_drag());
+    let resp = ui.interact(r, egui::Id::unique(("caption-block", c.id.0)), Sense::click_and_drag());
     let edge = 5.0f32.min(r.width() / 4.0);
     let gesture_at = |x: f32| {
         if x - r.min.x < edge {
@@ -240,7 +300,7 @@ fn interact_block(
             Gesture::TrimIn => 1,
             Gesture::TrimOut => 2,
         };
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("caption-drag-origin"), p.x));
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique("caption-drag-origin"), p.x));
         ctx.data_mut(|d| d.insert_temp(drag_id(), (c.id.0, g, 0i64)));
         if !app.session.state.caption_selection.contains(&c.id) {
             actions.push(("captions.select".into(), json!({"captions": [c.id.0]})));
@@ -250,7 +310,10 @@ fn interact_block(
         && let (Some((id, g, _)), Some(p)) = (drag_state(&ctx), resp.interact_pointer_pos())
         && id == c.id.0
     {
-        let x0 = ctx.data(|d| d.get_temp::<f32>(egui::Id::new("caption-drag-origin"))).unwrap_or(p.x);
+        if g == 0 && ctx.input(|i| i.modifiers.alt) {
+            ctx.set_cursor_icon(CursorIcon::Copy);
+        }
+        let x0 = ctx.data(|d| d.get_temp::<f32>(egui::Id::unique("caption-drag-origin"))).unwrap_or(p.x);
         let pps = app.ui.timeline.pps;
         let d = rate.snap_nearest(Tick::from_seconds_f64((p.x - x0) as f64 / pps));
         ctx.data_mut(|dd| dd.insert_temp(drag_id(), (id, g, d.0)));
@@ -269,7 +332,9 @@ fn interact_block(
                     } else {
                         vec![id]
                     };
-                    actions.push(("captions.move".into(), json!({"captions": sel, "delta": d})));
+                    // Option held on the drop copies (Premiere: Option-drag duplicates)
+                    let cmd = if ctx.input(|i| i.modifiers.alt) { "captions.duplicate" } else { "captions.move" };
+                    actions.push((cmd.into(), json!({"captions": sel, "delta": d})));
                 }
                 1 => actions.push(("captions.trim".into(), json!({"caption": id, "edge": "in", "delta": d}))),
                 _ => actions.push(("captions.trim".into(), json!({"caption": id, "edge": "out", "delta": d}))),
diff --git a/crates/ui-egui/src/panels/timeline_hit.rs b/crates/ui-egui/src/panels/timeline_hit.rs
index f94e9be92..95a7fe313 100644
--- a/crates/ui-egui/src/panels/timeline_hit.rs
+++ b/crates/ui-egui/src/panels/timeline_hit.rs
@@ -51,6 +51,11 @@ pub(crate) fn edge_geometry(seq: &Sequence, layout: &Layout, track: TrackId, cli
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub enum Hit {
     Ruler,
+    /// The work area bar on the ruler; `edge` is its start (`In`) or end (`Out`) when the press is
+    /// on one of its ends (dragging it moves that end), `None` on its middle (dragging moves it).
+    WorkArea {
+        edge: Option<Edge>,
+    },
     Clip {
         track: TrackId,
         clip: ClipId,
@@ -96,8 +101,35 @@ pub fn marker_at(seq: &Sequence, layout: &Layout, pos: Pos2) -> Option<Tick> {
     marker_under_pointer(seq, layout, pos).map(|m| m.start)
 }
 
+/// Where the Timeline ruler draws (and hit-tests) the work area bar, between the markers row and
+/// the time labels.
+pub fn work_area_rect(layout: &Layout, area: filmcraft_time::TimeRange) -> Rect {
+    let y = layout.ruler.min.y + 14.0;
+    Rect::from_min_max(pos2(layout.x_of(area.start), y), pos2(layout.x_of(area.end()), y + 6.0))
+}
+
+/// The part of the work area bar under the pointer: an end (an edge zone, narrower on a short
+/// bar so its middle stays grabbable) or its middle.
+pub fn work_area_at(seq: &Sequence, layout: &Layout, pos: Pos2) -> Option<Option<Edge>> {
+    let r = work_area_rect(layout, seq.work_area?);
+    let zone = zone(r.width())?;
+    if !r.expand2(vec2(zone, 1.0)).contains(pos) || !layout.ruler.contains(pos) {
+        return None;
+    }
+    Some(if (pos.x - r.min.x).abs() <= zone {
+        Some(Edge::In)
+    } else if (r.max.x - pos.x).abs() <= zone {
+        Some(Edge::Out)
+    } else {
+        None
+    })
+}
+
 pub fn hit(seq: &Sequence, layout: &Layout, pos: Pos2) -> Hit {
     if layout.ruler.contains(pos) {
+        if let Some(edge) = work_area_at(seq, layout, pos) {
+            return Hit::WorkArea { edge };
+        }
         return Hit::Ruler;
     }
     if !layout.content.contains(pos) {
@@ -477,6 +509,32 @@ mod tests {
         assert_eq!(marker_under_pointer(&seq, &layout, at).unwrap().id.0, 9);
     }
 
+    #[test]
+    fn the_work_area_bar_has_two_ends_and_a_middle() {
+        let (mut seq, l, _) = fixture(clips());
+        // hidden, the bar's row is plain ruler
+        assert_eq!(hit(&seq, &l, pos2(300.0, 17.0)), Hit::Ruler);
+        seq.work_area = Some(filmcraft_time::TimeRange::from_bounds(Tick::from_seconds_f64(2.0), Tick::from_seconds_f64(5.0)));
+        let y = work_area_rect(&l, seq.work_area.unwrap()).center().y;
+        assert_eq!(hit(&seq, &l, pos2(197.0, y)), Hit::WorkArea { edge: Some(Edge::In) });
+        assert_eq!(hit(&seq, &l, pos2(204.0, y)), Hit::WorkArea { edge: Some(Edge::In) });
+        assert_eq!(hit(&seq, &l, pos2(350.0, y)), Hit::WorkArea { edge: None });
+        assert_eq!(hit(&seq, &l, pos2(503.0, y)), Hit::WorkArea { edge: Some(Edge::Out) });
+        assert_eq!(hit(&seq, &l, pos2(510.0, y)), Hit::Ruler, "past its end zone");
+        // the markers row and the time labels stay ruler
+        assert_eq!(hit(&seq, &l, pos2(350.0, 8.0)), Hit::Ruler);
+        assert_eq!(hit(&seq, &l, pos2(350.0, 30.0)), Hit::Ruler);
+        assert_eq!(grab_at(&seq, &l, pos2(350.0, y), Tool::Selection, Modifiers::NONE, false), Grab::Other(Hit::WorkArea { edge: None }));
+        // a bar a few px wide keeps its middle third; hostile points grab nothing
+        seq.work_area = Some(filmcraft_time::TimeRange::from_bounds(Tick::from_seconds_f64(2.0), Tick::from_seconds_f64(2.09)));
+        assert_eq!(hit(&seq, &l, pos2(204.5, y)), Hit::WorkArea { edge: None });
+        assert_eq!(hit(&seq, &l, pos2(f32::NAN, y)), Hit::None);
+        for pps in [0.0, f64::NAN, f64::INFINITY] {
+            let broken = Layout { pps, ..l.clone() };
+            assert!(!matches!(hit(&seq, &broken, pos2(204.5, y)), Hit::WorkArea { edge: Some(_) }), "pps {pps}");
+        }
+    }
+
     use egui::Modifiers;
 
     use crate::state::Tool;
diff --git a/crates/ui-egui/src/panels/timeline_volume.rs b/crates/ui-egui/src/panels/timeline_volume.rs
index 3b904ffdf..217359e59 100644
--- a/crates/ui-egui/src/panels/timeline_volume.rs
+++ b/crates/ui-egui/src/panels/timeline_volume.rs
@@ -191,7 +191,7 @@ fn run(app: &mut FilmcraftApp, acts: Vec<(&str, Value)>) {
 /// The level next to the pointer while dragging: one line, always as wide, so it does not jump.
 fn tip(ui: &egui::Ui, db: f64) {
     let text = if db <= FADER_MIN_DB { format!("{:>7} dB", "-∞") } else { format!("{db:>+7.2} dB") };
-    egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new("tl-volume-tip"), egui::PopupAnchor::Pointer).show(|ui| {
+    egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique("tl-volume-tip"), egui::PopupAnchor::Pointer).show(|ui| {
         ui.add(egui::Label::new(egui::RichText::new(text).font(Tokens::mono(12.0))).wrap_mode(egui::TextWrapMode::Extend));
     });
 }
@@ -205,8 +205,9 @@ struct KeyDrag {
     begun: bool,
 }
 
+/// Single stable id for the in-flight audio keyframe drag; interaction runs above the clips.
 fn key_drag_id() -> egui::Id {
-    egui::Id::new("tl-volume-key-drag")
+    egui::Id::unique("tl-volume-key-drag")
 }
 
 /// The keyframes on the lines of the audio clips in view: drag one in time and level, right-click
@@ -256,7 +257,7 @@ pub fn interact(app: &mut FilmcraftApp, ui: &mut egui::Ui, seq: &Sequence, layou
                     continue;
                 }
                 let kr = Rect::from_center_size(c, vec2(11.0, 11.0));
-                let resp = ui.interact(kr, egui::Id::new(("tl-volume-kf", it.id.0, i)), Sense::click_and_drag());
+                let resp = ui.interact(kr, egui::Id::unique(("tl-volume-kf", it.id.0, i)), Sense::click_and_drag());
                 app.auto.add(&format!("timeline.clip.{}.volume.kf.{i}", it.id.0), kr, "Volume keyframe");
                 let mine = held.filter(|h| h.clip == it.id && h.index == i);
                 if resp.hovered() || mine.is_some() {
diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
index 34106c6b9..d55fccf58 100644
--- a/crates/ui-egui/src/panels/tools.rs
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -11,7 +11,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let mut y = rect.min.y + 4.0;
     let size = 32.0;
-    let held_id = egui::Id::new("tools-held");
+    let held_id = egui::Id::unique("tools-held");
     if ui.input(|i| i.pointer.any_pressed()) {
         ui.data_mut(|d| d.remove::<egui::Id>(held_id));
     }
@@ -23,8 +23,8 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         } else {
             format!("{} ({})", app.ui.language.tr(current.label()), current.shortcut())
         };
-        let resp = ui.interact(r, egui::Id::new(("tool", format!("{:?}", group[0]))), Sense::click_and_drag()).on_hover_text(tip);
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, resp.enabled(), app.ui.tool == current, current.label()));
+        let resp = ui.interact(r, egui::Id::unique(("tool", format!("{:?}", group[0]))), Sense::click_and_drag()).on_hover_text(tip);
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, resp.enabled(), app.ui.tool == current, current.label()));
         for tl in &group {
             if *tl == current {
                 app.auto.add_response(&format!("tools.{tl:?}"), &resp, tl.label());
diff --git a/crates/ui-egui/src/panels/transform_handles.rs b/crates/ui-egui/src/panels/transform_handles.rs
index c767e3ed3..1100eeaa4 100644
--- a/crates/ui-egui/src/panels/transform_handles.rs
+++ b/crates/ui-egui/src/panels/transform_handles.rs
@@ -398,7 +398,7 @@ pub fn monitor_overlay(app: &mut FilmcraftApp, ui: &mut egui::Ui, pic: Rect, fra
         return;
     }
     let mut actions: Vec<(String, Value)> = Vec::new();
-    let id = egui::Id::new("program-transform");
+    let id = egui::Id::unique("program-transform");
     let drag_id = id.with("drag");
     let double = ui.input(|i| i.pointer.button_double_clicked(egui::PointerButton::Primary));
     // the monitor around the picture as well as on it (its clip reaches past the picture area)
diff --git a/crates/ui-egui/src/panels/transition_controls.rs b/crates/ui-egui/src/panels/transition_controls.rs
index dcea6ad38..1b12fd3ad 100644
--- a/crates/ui-egui/src/panels/transition_controls.rs
+++ b/crates/ui-egui/src/panels/transition_controls.rs
@@ -11,6 +11,11 @@
 //! [`trn::drag_span`]); each drag is one undo step. Clicking or dragging the ruler moves the
 //! playhead. The divider between the settings and the timeline is the clip view's.
 //!
+//! Dragging the cut line, over the transition or where it crosses clip A or B, moves the cut and
+//! the transition together, as Premiere's Move a cut and transition together describes it: one
+//! `timeline.roll` on release, so the clips' In and Out points change and the sequence keeps its
+//! length.
+//!
 //! Not here yet: the A/B preview thumbnails with their Start / End sliders, Show Actual Sources,
 //! and a rolling edit by dragging clip A or B in the transition's timeline.
 //!
@@ -19,7 +24,9 @@
 //! `.y`; a list's entries `.param.<id>.option.<n>` while open); its timeline's
 //! `effectControls.transition.timeline`, `.timeline.ruler`, `.timeline.a` / `.timeline.b` (the
 //! clips, labelled with their names), `.timeline.span` (the transition) with its ends
-//! `.timeline.span.in` / `.timeline.span.out`, `.timeline.playhead`; `effectControls.divider`;
+//! `.timeline.span.in` / `.timeline.span.out`, `.timeline.cut` (the cut line over the transition,
+//! between two clips) and `.timeline.cut.a` / `.timeline.cut.b` (where it crosses the clips),
+//! `.timeline.playhead`; `effectControls.divider`;
 //! the dialog's `transitionDuration.value`, `.ok`, `.cancel`.
 
 use egui::{Align2, Pos2, Rect, RichText, Sense, Stroke, pos2, vec2};
@@ -40,6 +47,8 @@ const MIN_LIST_W: f32 = 260.0;
 const MIN_LANE_W: f32 = 60.0;
 const RULER_H: f32 = 24.0;
 const BAR_H: f32 = 18.0;
+/// How far either side of the cut line a press over the transition grabs the cut.
+const CUT_PX: f32 = 3.0;
 /// How far into the transition from either end a press grabs that end (the Timeline's width).
 const EDGE_PX: f32 = 7.0;
 
@@ -159,8 +168,9 @@ pub fn effect_controls(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, id
 
             for pd in def.map(|d| d.params.as_slice()).unwrap_or(&[]) {
                 let value = x.effect.params.get(pd.id).map_or(&pd.default, |p| &p.value);
-                ui.label(crate::i18n::t(pd.label));
-                if let Some(v) = param_widget(ui, &mut elems, pd.id, &pd.kind, value, (fw, fh)) {
+                let label = crate::i18n::t(pd.label);
+                ui.label(label);
+                if let Some(v) = param_widget(ui, &mut elems, pd.id, label, &pd.kind, value, (fw, fh)) {
                     changes.push(v);
                 }
                 ui.end_row();
@@ -179,7 +189,7 @@ pub fn effect_controls(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, id
             changes.push(c);
         }
         let divider = Rect::from_min_max(pos2(split - 2.0, rect.min.y), pos2(split + 4.0, rect.max.y));
-        let dresp = ui.interact(divider, egui::Id::new("tr-ec-divider"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
+        let dresp = ui.interact(divider, egui::Id::unique("tr-ec-divider"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeHorizontal);
         if dresp.dragged() {
             app.ui.effect_controls_split = (list_w + dresp.drag_delta().x).clamp(MIN_LIST_W, max_list);
         }
@@ -201,10 +211,13 @@ pub fn effect_controls(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect, id
 /// A drag in the transition's timeline: the end it grabbed (`None`: the middle), where the
 /// transition was when it began, and the stretch of time the lane showed then, so the drag is
 /// measured against a ruler that holds still while the transition changes under it. `begun` once
-/// its first change went through: the rest merge into that undo step.
+/// its first change went through: the rest merge into that undo step. `cut` when it grabbed the
+/// cut line instead, with `roll` how far the cut has moved so far (applied on release).
 #[derive(Clone, Copy, Debug)]
 struct LaneDrag {
     edge: Option<Edge>,
+    cut: bool,
+    roll: Tick,
     start: Tick,
     duration: Tick,
     view: (Tick, Tick),
@@ -252,9 +265,12 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
     let (_, cut, _) = trn::bounds(track, x)?;
     let clip_a = x.from.and_then(|c| track.item(c)).map(|it| (it.start, it.end(), it.name.clone()));
     let clip_b = x.to.and_then(|c| track.item(c)).map(|it| (it.start, it.end(), it.name.clone()));
-    let mem = egui::Id::new(("tr-ec-lane-drag", id.0));
+    let mem = egui::Id::unique(("tr-ec-lane-drag", id.0));
     let mut drag: Option<LaneDrag> = ui.data(|d| d.get_temp(mem));
     let v = drag.map_or_else(|| view(x, cut, frame), |d| d.view);
+    // while the cut is dragged, the clips' edges at the cut and the transition are drawn where it goes
+    let roll = drag.filter(|d| d.cut).map_or(Tick::ZERO, |d| d.roll);
+    let two_sided = clip_a.is_some() && clip_b.is_some();
     let painter = ui.painter().with_clip_rect(lane.intersect(ui.clip_rect()));
     painter.rect_filled(lane, 0.0, t.tl_bg);
     let ruler = Rect::from_min_max(lane.min, pos2(lane.max.x, lane.min.y + RULER_H));
@@ -267,7 +283,8 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
     let (row_a, row_x, row_b) = (row(0.0), row(1.0), row(2.0));
     for ((clip, r), key) in [(&clip_a, row_a), (&clip_b, row_b)].into_iter().zip(["a", "b"]) {
         let Some((s, e, name)) = clip else { continue };
-        let bar = Rect::from_min_max(pos2(x_of(lane, v, *s).max(lane.min.x), r.min.y), pos2(x_of(lane, v, *e).min(lane.max.x), r.max.y));
+        let (s, e) = if key == "a" { (*s, *e + roll) } else { (*s + roll, *e) };
+        let bar = Rect::from_min_max(pos2(x_of(lane, v, s).max(lane.min.x), r.min.y), pos2(x_of(lane, v, e).min(lane.max.x), r.max.y));
         if bar.width() <= 0.0 {
             continue;
         }
@@ -276,7 +293,7 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
         elems.push((format!("effectControls.transition.timeline.{key}"), bar, name.clone()));
     }
     // the transition, outlined as selected (it is), with the Timeline's end zones
-    let (x0, x1) = (x_of(lane, v, x.start), x_of(lane, v, x.end()));
+    let (x0, x1) = (x_of(lane, v, x.start + roll), x_of(lane, v, x.end() + roll));
     let span = Rect::from_min_max(pos2(x0, row_x.min.y), pos2(x1.max(x0 + 1.0), row_x.max.y));
     painter.rect_filled(span, 0.0, egui::Color32::from_black_alpha(90));
     painter.rect_stroke(span, 0.0, Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
@@ -295,8 +312,30 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
     elems.push(("effectControls.transition.timeline.span.in".into(), Rect::from_min_max(span.min, pos2(span.min.x + zone, span.max.y)), "start".into()));
     elems.push(("effectControls.transition.timeline.span.out".into(), Rect::from_min_max(pos2(span.max.x - zone, span.min.y), span.max), "end".into()));
     // the cut, through all three rows
-    let cx = x_of(lane, v, cut);
+    let cx = x_of(lane, v, cut + roll);
     painter.line_segment([pos2(cx, row_a.min.y), pos2(cx, row_b.max.y)], Stroke::new(1.0, t.text_dim));
+    // where a press grabs the cut: on its line over the transition, outside the ends' zones
+    let middle = Rect::from_min_max(pos2(span.min.x + zone, span.min.y), pos2(span.max.x - zone, span.max.y));
+    let cut_zone = Rect::from_min_max(pos2(cx - CUT_PX, span.min.y), pos2(cx + CUT_PX, span.max.y)).intersect(middle);
+    let cut_zone = (two_sided && cut_zone.width() > 0.0).then_some(cut_zone);
+    let on_cut = |px: f32| cut_zone.is_some_and(|z| z.x_range().contains(px));
+    if let Some(z) = cut_zone {
+        elems.push(("effectControls.transition.timeline.cut".into(), z, "cut".into()));
+    }
+    // and where it crosses the clips' rows, which also holds when the cut is at the transition's
+    // edge (Start or End at Cut) or the transition is too narrow for the zone over it
+    let cut_rows: Vec<Rect> = if two_sided {
+        [(row_a, "a"), (row_b, "b")]
+            .into_iter()
+            .map(|(r, k)| {
+                let z = Rect::from_min_max(pos2(cx - CUT_PX, r.min.y), pos2(cx + CUT_PX, r.max.y));
+                elems.push((format!("effectControls.transition.timeline.cut.{k}"), z, "cut".into()));
+                z
+            })
+            .collect()
+    } else {
+        Vec::new()
+    };
     // the playhead, while it is in view
     let ph = app.session.playhead();
     if ph >= v.0 && ph <= v.1 {
@@ -311,13 +350,13 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
     elems.push(("effectControls.transition.timeline.ruler".into(), ruler, "time ruler".into()));
     // the ruler moves the playhead (once the sequence is no longer borrowed, below)
     let mut seek = None;
-    let rresp = ui.interact(ruler, egui::Id::new(("tr-ec-ruler", id.0)), Sense::click_and_drag());
+    let rresp = ui.interact(ruler, egui::Id::unique(("tr-ec-ruler", id.0)), Sense::click_and_drag());
     if (rresp.dragged() || rresp.clicked())
         && let Some(pos) = rresp.interact_pointer_pos()
     {
         seek = Some(rate.snap_nearest(tick_at(lane, v, pos.x.clamp(lane.min.x, lane.max.x))).max(Tick::ZERO));
     }
-    // the transition: its middle slides it, its ends change its duration
+    // the transition: its middle slides it, its ends change its duration, its cut line moves the cut
     let grab = |px: f32| -> Option<Edge> {
         if px < span.min.x + zone {
             Some(Edge::In)
@@ -327,17 +366,36 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
             None
         }
     };
-    let sresp = ui.interact(span, egui::Id::new(("tr-ec-span", id.0)), Sense::click_and_drag());
+    let sresp = ui.interact(span, egui::Id::unique(("tr-ec-span", id.0)), Sense::click_and_drag());
+    let cresp = cut_rows.iter().enumerate().map(|(i, z)| ui.interact(*z, egui::Id::unique(("tr-ec-cut", id.0, i)), Sense::drag())).reduce(|a, b| a.union(b));
+    // the transition's drag or the cut's, whichever is going on
+    let resp = cresp.as_ref().map_or_else(|| sresp.clone(), |c| sresp.union(c.clone()));
     if let Some(h) = sresp.hover_pos() {
         ui.ctx().set_cursor_icon(if grab(h.x).is_some() { egui::CursorIcon::ResizeColumn } else { egui::CursorIcon::Grab });
     }
     if sresp.drag_started() {
         let from = ui.input(|i| i.pointer.press_origin()).or(sresp.interact_pointer_pos()).map_or(span.center().x, |p: Pos2| p.x);
-        drag = Some(LaneDrag { edge: grab(from), start: x.start, duration: x.duration, view: v, from_x: from, begun: false });
+        let edge = grab(from);
+        let cut = edge.is_none() && on_cut(from);
+        drag = Some(LaneDrag { edge, cut, roll: Tick::ZERO, start: x.start, duration: x.duration, view: v, from_x: from, begun: false });
+    }
+    if let Some(c) = &cresp
+        && c.drag_started()
+    {
+        let from = ui.input(|i| i.pointer.press_origin()).or(c.interact_pointer_pos()).map_or(cx, |p: Pos2| p.x);
+        drag = Some(LaneDrag { edge: None, cut: true, roll: Tick::ZERO, start: x.start, duration: x.duration, view: v, from_x: from, begun: false });
     }
     let mut change = None;
-    if sresp.dragged()
+    if resp.dragged()
         && let Some(d) = drag.as_mut()
+        && d.cut
+        && let (Some(pos), Some(a), Some(b)) = (resp.interact_pointer_pos(), x.from, x.to)
+    {
+        // as far as `timeline.roll` will move it on release; 0 when the roll would fail
+        d.roll = filmcraft_engine::commands::roll_delta(&app.session, a, b, rate.snap_nearest(ticks_for(lane, d.view, pos.x - d.from_x))).unwrap_or(Tick::ZERO);
+    } else if sresp.dragged()
+        && let Some(d) = drag.as_mut()
+        && !d.cut
         && let Some(pos) = sresp.interact_pointer_pos()
     {
         let delta = rate.snap_nearest(ticks_for(lane, d.view, pos.x - d.from_x));
@@ -349,14 +407,28 @@ fn timeline(app: &mut FilmcraftApp, ui: &mut egui::Ui, lane: Rect, id: Transitio
             d.begun = true;
         }
     }
+    // over the cut line (and not an end), the pointer shows that it moves the cut
+    if sresp.hover_pos().is_some_and(|h| grab(h.x).is_none() && on_cut(h.x)) || cresp.as_ref().is_some_and(|c| c.hovered()) || drag.is_some_and(|d| d.cut) {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
+    }
+    // a drag of the cut is one rolling edit, made when it is released
+    let rolled = match (drag, x.from, x.to) {
+        (Some(d), Some(a), Some(b)) if resp.drag_stopped() && d.cut && d.roll != Tick::ZERO => Some((a, b, d.roll)),
+        _ => None,
+    };
     // released, or a drag that lost its transition (deleted, deselected) while it went on
-    if !sresp.dragged() && !sresp.drag_started() {
+    if !resp.dragged() && !resp.drag_started() {
         drag = None;
     }
     if let Some(tk) = seek {
         app.stop();
         app.session.set_playhead(tk);
     }
+    if let Some((a, b, d)) = rolled
+        && let Err(e) = app.session.execute("timeline.roll", json!({"left": a.0, "right": b.0, "delta": d.0}))
+    {
+        app.ui.status = e.to_string();
+    }
     ui.data_mut(|m| match drag {
         Some(d) => {
             m.insert_temp(mem, d);
@@ -399,7 +471,7 @@ fn paint_ruler(p: &egui::Painter, ruler: Rect, view: (Tick, Tick), rate: FrameRa
 }
 
 /// One of a transition's own settings. Returns the change, as `sequence.setTransition` params.
-fn param_widget(ui: &mut egui::Ui, elems: &mut Elems, pid: &str, kind: &ParamKind, value: &ParamValue, frame: (f64, f64)) -> Option<Value> {
+fn param_widget(ui: &mut egui::Ui, elems: &mut Elems, pid: &str, label: &str, kind: &ParamKind, value: &ParamValue, frame: (f64, f64)) -> Option<Value> {
     let eid = format!("effectControls.transition.param.{pid}");
     let drag = |r: &egui::Response| json!({"merge": true, "begin": r.drag_started() || !r.dragged()});
     match (kind, value) {
@@ -426,7 +498,7 @@ fn param_widget(ui: &mut egui::Ui, elems: &mut Elems, pid: &str, kind: &ParamKin
         }
         (ParamKind::Bool, ParamValue::Bool(b)) => {
             let mut b = *b;
-            let r = ui.checkbox(&mut b, "");
+            let r = crate::widgets::accessible_name(ui.checkbox(&mut b, ""), label);
             elems.push((eid, r.rect, b.to_string()));
             r.changed().then(|| json!({"params": { pid: b }}))
         }
@@ -444,7 +516,8 @@ fn param_widget(ui: &mut egui::Ui, elems: &mut Elems, pid: &str, kind: &ParamKin
                 }
             });
             elems.extend(options);
-            elems.push((eid, r.response.rect, shown.to_string()));
+            let response = crate::widgets::accessible_name(r.response, label);
+            elems.push((eid, response.rect, shown.to_string()));
             picked.map(|i| json!({"params": { pid: i }}))
         }
         (ParamKind::Color, ParamValue::Color(c)) => {
diff --git a/crates/ui-egui/src/panels/trim_monitor.rs b/crates/ui-egui/src/panels/trim_monitor.rs
index ba65b9474..9522feca0 100644
--- a/crates/ui-egui/src/panels/trim_monitor.rs
+++ b/crates/ui-egui/src/panels/trim_monitor.rs
@@ -5,7 +5,7 @@
 //! outgoing side, in the incoming picture the incoming side, between them rolls.
 //!
 //! J/K/L and Space are routed to dynamic trimming / loop playback in `menus::invoke`; the engine
-//! state machine (`filmcraft_engine::trim`) is advanced here once per frame with the UI clock.
+//! state machine (`filmcraft_engine::trim`) is advanced from logic with the monotonic host clock.
 //!
 //! Automation ids: `trimMonitor.outgoing`, `trimMonitor.incoming`, `trimMonitor.roll`,
 //! `trimMonitor.outTimecode`, `trimMonitor.inTimecode`, `trimMonitor.outShift`,
@@ -35,21 +35,21 @@ pub fn trim_mode(app: &FilmcraftApp) -> bool {
     !app.session.state.edit_points.is_empty() && app.ui.focused != crate::dock::PanelKind::Source
 }
 
-/// Advance dynamic trimming / loop playback to the current UI time (once per frame).
-pub fn advance(app: &mut FilmcraftApp, ctx: &egui::Context) {
+/// Advance dynamic trimming / loop playback to a monotonic host time. Called from logic; a
+/// repeated call at the same time is idempotent because `trim.tick` receives an absolute clock.
+pub fn advance_at(app: &mut FilmcraftApp, clock: f64) {
     if !app.session.trim_play.active() {
         return;
     }
-    let clock = ctx.input(|i| i.time);
     if let Err(e) = app.session.execute("trim.tick", json!({"clock": clock})) {
         app.ui.status = e.to_string();
     }
-    ctx.request_repaint();
 }
 
 /// Route a transport command in trim mode (J/K/L/Space/Shift+K). `None` = not handled.
 pub fn route_transport(app: &mut FilmcraftApp, ctx: &egui::Context, id: &str) -> Option<Result<Value, String>> {
-    let clock = ctx.input(|i| i.time);
+    let _ = ctx;
+    let clock = app.now();
     let trimming = trim_mode(app);
     let (cmd, params) = match id {
         "playback.forward" if trimming => ("trim.shuttle", json!({"direction": "forward", "clock": clock})),
@@ -239,7 +239,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // drag to trim: px → frames (6 px per frame), applied on release as one trim
     let fpp = 1.0 / 6.0;
     for (r, which) in [(lp, "out"), (rp, "in"), (mid, "roll")] {
-        let resp = ui.interact(r, egui::Id::new(("trim-monitor-drag", which)), Sense::drag());
+        let resp = ui.interact(r, egui::Id::unique(("trim-monitor-drag", which)), Sense::drag());
         if resp.dragged() || resp.hovered() {
             ui.ctx().set_cursor_icon(egui::CursorIcon::ResizeColumn);
         }
@@ -248,7 +248,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             // the same one data_mut() holds, and that lock is not reentrant (deadlock)
             let dx = resp.drag_delta().x;
             let total = ui.ctx().data_mut(|d| {
-                let v = d.get_temp_mut_or_default::<f32>(egui::Id::new("trim-monitor-dx"));
+                let v = d.get_temp_mut_or_default::<f32>(egui::Id::unique("trim-monitor-dx"));
                 *v += dx;
                 *v
             });
@@ -256,7 +256,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             ui.painter().text(pos2(r.center().x, r.max.y - 14.0), Align2::CENTER_CENTER, shift_text(n), Tokens::semibold(14.0), col);
         }
         if resp.drag_stopped() {
-            let total = ui.ctx().data_mut(|d| d.remove_temp::<f32>(egui::Id::new("trim-monitor-dx")).unwrap_or(0.0));
+            let total = ui.ctx().data_mut(|d| d.remove_temp::<f32>(egui::Id::unique("trim-monitor-dx")).unwrap_or(0.0));
             let n = (total * fpp).round() as i64;
             // egui ends a drag on Escape: that stop abandons it (#580)
             if n != 0 && !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
@@ -295,10 +295,9 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     ];
     let total: f32 = buttons.iter().map(|b| b.3 + 4.0).sum();
     let mut x = bar.center().x - total / 2.0;
-    let ctx = ui.ctx().clone();
     for (id, label, tip, w) in buttons {
         let r = Rect::from_min_size(pos2(x, bar.min.y), vec2(w, bar.height()));
-        let resp = ui.interact(r, egui::Id::new(id), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(id), Sense::click()).on_hover_text(tip);
         let bg = if resp.is_pointer_button_down_on() {
             t.pressed
         } else if resp.hovered() {
@@ -316,7 +315,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
         app.auto.add(id, r, tip);
         if resp.clicked() {
             let res = match id {
-                "trimMonitor.playAround" => app.session.execute("trim.playAround", json!({"clock": ctx.input(|i| i.time), "toggle": true})),
+                "trimMonitor.playAround" => app.session.execute("trim.playAround", json!({"clock": app.now(), "toggle": true})),
                 "trimMonitor.backwardMany" => app.session.execute("trim.backwardMany", json!({})),
                 "trimMonitor.backward" => app.session.execute("trim.backward", json!({})),
                 "trimMonitor.forward" => app.session.execute("trim.forward", json!({})),
@@ -331,7 +330,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     // exit trim mode
     let r = Rect::from_min_size(pos2(rect.max.x - 30.0, bar.min.y + 3.0), vec2(22.0, 22.0));
-    let resp = ui.interact(r, egui::Id::new("trimMonitor.exit"), Sense::click()).on_hover_text(tl!("Exit Trim Mode"));
+    let resp = ui.interact(r, egui::Id::unique("trimMonitor.exit"), Sense::click()).on_hover_text(tl!("Exit Trim Mode"));
     let c = if resp.hovered() { t.tab_text_active } else { t.text_dim };
     ui.painter().line_segment([r.min + vec2(6.0, 6.0), r.max - vec2(6.0, 6.0)], Stroke::new(1.5, c));
     ui.painter().line_segment([pos2(r.max.x - 6.0, r.min.y + 6.0), pos2(r.min.x + 6.0, r.max.y - 6.0)], Stroke::new(1.5, c));
diff --git a/crates/ui-egui/src/panels/tts.rs b/crates/ui-egui/src/panels/tts.rs
index 8bc12e7cb..8e00bcfba 100644
--- a/crates/ui-egui/src/panels/tts.rs
+++ b/crates/ui-egui/src/panels/tts.rs
@@ -329,7 +329,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             actions.push(Action::Run("tts.preview", json!({"sample": true, "voice": d.voice, "pitch": d.pitch.id(), "pace": d.pace}), true));
         }
         ui.add_space(8.0);
-        let (hr, open) = crate::widgets::section_header(ui, egui::Id::new("tts-advanced"), "Advanced", d.advanced_open, &t, true);
+        let (hr, open) = crate::widgets::section_header(ui, egui::Id::unique("tts-advanced"), "Advanced", d.advanced_open, &t, true);
         auto.add("tts.advanced", visible(ui, hr.rect), "Advanced");
         d.advanced_open = open;
         if open {
@@ -378,7 +378,7 @@ pub fn show(app: &mut FilmcraftApp, ui: &mut egui::Ui, rect: Rect) {
             .desired_width(w)
             .desired_rows(8)
             .char_limit(filmcraft_tts::MAX_TEXT_BYTES);
-        let r = ui.add(te);
+        let r = crate::widgets::accessible_name(ui.add(te), "Text");
         auto.add("tts.text", visible(ui, r.rect), "Text");
     });
 
@@ -445,7 +445,7 @@ fn label(ui: &mut egui::Ui, t: &Tokens, text: &str) {
 
 #[allow(clippy::too_many_arguments)]
 fn button(ui: &mut egui::Ui, t: &Tokens, r: Rect, icon: Icon, text: &str, primary: bool, active: bool, id: &str) -> egui::Response {
-    let resp = ui.interact(r, egui::Id::new(id), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(id), Sense::click());
     let p = ui.painter();
     let (bg, fg) = match (primary, active) {
         (true, true) => (if resp.hovered() { t.accent_hover } else { t.accent }, egui::Color32::WHITE),
diff --git a/crates/ui-egui/src/panels/voiceover.rs b/crates/ui-egui/src/panels/voiceover.rs
index 1a80990f4..deb3080e3 100644
--- a/crates/ui-egui/src/panels/voiceover.rs
+++ b/crates/ui-egui/src/panels/voiceover.rs
@@ -38,13 +38,13 @@ struct Draft {
 }
 
 fn draft_id() -> egui::Id {
-    egui::Id::new("voiceover-settings-draft")
+    egui::Id::unique("voiceover-settings-draft")
 }
 
 /// The microphone button of an audio track header. Returns the requested action.
 pub fn header_button(app: &mut FilmcraftApp, ui: &mut egui::Ui, track: TrackId, r: Rect, visible: Rect, label: &str, t: &Tokens) -> Option<Action> {
     let recording_here = app.session.voiceover.rec.as_ref().is_some_and(|x| x.track == track);
-    let resp = ui.interact(r.intersect(visible), egui::Id::new(("vo", track.0)), Sense::click());
+    let resp = ui.interact(r.intersect(visible), egui::Id::unique(("vo", track.0)), Sense::click());
     if resp.hovered() {
         ui.painter().rect_filled(r, 2.0, t.hover);
     }
@@ -220,7 +220,7 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
         tl!("● Recording").into()
     };
     let r = Rect::from_center_size(pos2(screen.center().x, screen.min.y + 90.0), vec2(220.0, 64.0));
-    egui::Area::new(egui::Id::new("voiceover-countdown")).order(egui::Order::Foreground).fixed_pos(r.min).interactable(false).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("voiceover-countdown")).order(egui::Order::Foreground).fixed_pos(r.min).interactable(false).show(ctx, |ui| {
         let p = ui.painter();
         p.rect_filled(r, 8.0, Color32::from_black_alpha(180));
         p.rect_stroke(r, 8.0, Stroke::new(2.0, RED), egui::StrokeKind::Inside);
@@ -232,18 +232,18 @@ pub fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
 
 fn settings_dialog(app: &mut FilmcraftApp, ctx: &egui::Context) {
     let Some(Some(mut d)) = ctx.data(|m| m.get_temp::<Option<Draft>>(draft_id())) else { return };
-    crate::widgets::revert_drag_on_escape(ctx, egui::Id::new("voiceover-settings-before-drag"), &mut d);
+    crate::widgets::revert_drag_on_escape(ctx, egui::Id::unique("voiceover-settings-before-drag"), &mut d);
     let mut elems: Vec<(String, Rect, String)> = Vec::new();
     let mut close = false;
     let mut apply = false;
     let mut discard = false;
     let accent = app.tokens.accent;
     // the title is translated; the window keeps one id whatever the interface language
-    let id = egui::Id::new("voiceover-settings");
+    let id = egui::Id::unique("voiceover-settings");
     egui::Window::new(tl!("Voice-Over Record Settings")).id(id).collapsible(false).resizable(false).centered(ctx).show(ctx, |ui| {
         egui::Grid::new("voiceover-grid").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
             ui.label(tl!("Name:"));
-            let r = ui.add(egui::TextEdit::singleline(&mut d.prefs.name).desired_width(220.0));
+            let r = crate::widgets::accessible_name(ui.add(egui::TextEdit::singleline(&mut d.prefs.name).desired_width(220.0)), "Name");
             elems.push(("voiceover.name".into(), r.rect, d.prefs.name.clone()));
             ui.end_row();
             ui.label(tl!("Source:"));
diff --git a/crates/ui-egui/src/panels/workspaces.rs b/crates/ui-egui/src/panels/workspaces.rs
index 5678bd171..2f02942c9 100644
--- a/crates/ui-egui/src/panels/workspaces.rs
+++ b/crates/ui-egui/src/panels/workspaces.rs
@@ -56,17 +56,12 @@ pub fn route(app: &mut FilmcraftApp, id: &str, params: &Value) -> Option<Result<
 
 /// Save the current layout as the saved layout of `name`.
 fn save(app: &mut FilmcraftApp, name: &str) -> Result<(), String> {
-    crate::dock::Layout { root: app.ui.dock.clone(), floating: app.ui.floating.clone() }.validate()?;
-    let layout = serde_json::to_value(&app.ui.dock).map_err(|e| e.to_string())?;
-    let floating = if app.ui.floating.is_empty() { serde_json::Value::Null } else { serde_json::to_value(&app.ui.floating).map_err(|e| e.to_string())? };
+    let entry = dock::SavedWorkspace::new(name, &app.ui.dock)?;
     let mut next = app.workspaces.clone();
     let saved = &mut next.saved;
     match saved.iter_mut().find(|s| s.name == name) {
-        Some(s) => {
-            s.layout = layout;
-            s.floating = floating;
-        }
-        None => saved.push(dock::SavedWorkspace { name: name.to_string(), layout, floating }),
+        Some(s) => *s = entry,
+        None => saved.push(entry),
     }
     next.current = name.to_string();
     app.set_workspaces(next)
@@ -181,7 +176,7 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
         WorkspaceDialog::Edit { .. } => ("Edit Workspaces", tl!("Edit Workspaces")),
     };
     egui::Window::new(shown)
-        .id(egui::Id::new(title))
+        .id(egui::Id::unique(title))
         .collapsible(false)
         .resizable(false)
         .pivot(Align2::CENTER_CENTER)
@@ -218,7 +213,7 @@ pub fn dialogs(app: &mut FilmcraftApp, ctx: &egui::Context) {
                 let own = sel.as_deref().is_some_and(|s| !is_builtin(s));
                 ui.horizontal(|ui| {
                     ui.label(tl!("Name:"));
-                    let r = ui.add_enabled(own, egui::TextEdit::singleline(name));
+                    let r = crate::widgets::accessible_name(ui.add_enabled(own, egui::TextEdit::singleline(name)), "Name");
                     push("workspaces.edit.name", &r, "Name");
                     let r = ui.add_enabled(own && sel.as_deref() != Some(name.trim()), egui::Button::new(tl!("Rename")));
                     push("workspaces.edit.rename", &r, "Rename");
diff --git a/crates/ui-egui/src/rtl.rs b/crates/ui-egui/src/rtl.rs
index 7b71769cf..8b6eac690 100644
--- a/crates/ui-egui/src/rtl.rs
+++ b/crates/ui-egui/src/rtl.rs
@@ -4,21 +4,16 @@
 //! last fallbacks of every UI font family. A build without them looks up one installed face per
 //! script once (Noto Sans Arabic, SF Arabic, Segoe UI…) and reuses it across theme changes.
 //!
-//! Reading order: egui shapes each font run with harfrust, so a word's letters join and run right
-//! to left, but it places the runs left to right in logical order with no bidi pass: in
-//! "كلمة أخرى" the second word comes out first. [`Lines`] lays out document text (captions) in
-//! reading order for display. Lines are broken on the logical text as egui wraps it, each line's
-//! runs are put in visual order by the Unicode Bidirectional Algorithm (UAX #9, as the text engine
-//! does for titles), and every right-to-left word becomes its own layout section, which egui's
-//! shaper draws right to left. Text being edited keeps egui's logical order: `TextEdit` maps the
-//! caret by character index, so a reordered galley would put it in the wrong place.
+//! Reading order: the egui 0.37 fork performs UAX #9 shaping, run ordering and bracket mirroring.
+//! [`Lines`] lays out document text (captions) with one logical `LayoutJob` and
+//! `TextDirection::Auto`, so the text engine produces visual order itself. Keeping the old
+//! word-by-word reversal would reverse Arabic/Hebrew twice. Text being edited keeps egui's logical
+//! order: `TextEdit` maps the caret by character index.
 
-use std::borrow::Cow;
-use std::ops::Range;
 use std::sync::{Arc, OnceLock};
 
-use egui::epaint::text::{ByteIndex, LayoutJob, LayoutSection, TextFormat};
-use egui::{Color32, FontData, FontDefinitions, FontId, Galley, Painter, Rect, Vec2, pos2};
+use egui::epaint::text::{LayoutJob, TextDirection, TextFormat};
+use egui::{Align, Color32, FontData, FontDefinitions, FontId, Galley, Painter, Rect, Vec2, pos2};
 use filmcraft_text::fonts::{CraftFont, Face};
 use unicode_bidi::{BidiClass, BidiInfo, bidi_class};
 
@@ -89,7 +84,7 @@ fn system_fonts() -> &'static [(String, Arc<FontData>)] {
             let Some(data) = face.data() else {
                 continue;
             };
-            let font = FontData { font: Cow::Owned(data), index: face.info.index, tweak: Default::default() };
+            let font = FontData::from_blob(Arc::new(data), face.info.index);
             out.push((format!("system-{}", s.code.to_lowercase()), Arc::new(font)));
             chosen.push(face);
         }
@@ -133,116 +128,7 @@ pub(crate) fn has_rtl(text: &str) -> bool {
     text.chars().any(|c| matches!(bidi_class(c), BidiClass::R | BidiClass::AL))
 }
 
-/// Characters that stay together, in logical order, in a right-to-left word: letters, marks and
-/// joiners. egui shapes such a word as one right-to-left run.
-fn in_word(c: char) -> bool {
-    matches!(bidi_class(c), BidiClass::R | BidiClass::AL | BidiClass::NSM | BidiClass::BN)
-}
-
-/// A bracket shown right to left takes its mirrored glyph (UAX #9 rule L4).
-fn mirror(c: char) -> char {
-    match c {
-        '(' => ')',
-        ')' => '(',
-        '[' => ']',
-        ']' => '[',
-        '{' => '}',
-        '}' => '{',
-        '<' => '>',
-        '>' => '<',
-        '«' => '»',
-        '»' => '«',
-        '‹' => '›',
-        '›' => '‹',
-        _ => c,
-    }
-}
-
-/// The layout sections of one line of `bidi.text` (byte range `line`, inside one paragraph), left
-/// to right. A left-to-right run stays whole, except that Arabic-Indic digits get a section each
-/// so the shaper cannot run them right to left. A right-to-left run is split into words
-/// ([`in_word`]) and single other characters (mirrored), listed in reverse: egui shapes each word
-/// right to left itself.
-fn line_sections(bidi: &BidiInfo<'_>, line: Range<usize>) -> Vec<String> {
-    let text = bidi.text;
-    let Some(whole) = text.get(line.clone()).filter(|s| !s.is_empty()) else {
-        return Vec::new();
-    };
-    let Some(para) = bidi.paragraphs.iter().find(|p| p.range.start <= line.start && line.end <= p.range.end) else {
-        return vec![whole.to_owned()];
-    };
-    let (levels, runs) = bidi.visual_runs(para, line);
-    let mut out = Vec::new();
-    for run in runs {
-        let Some(s) = text.get(run.clone()) else {
-            continue;
-        };
-        if levels.get(run.start).is_some_and(|l| l.is_rtl()) {
-            let mut units = Vec::new();
-            let mut word = String::new();
-            for c in s.chars() {
-                if in_word(c) {
-                    word.push(c);
-                    continue;
-                }
-                if !word.is_empty() {
-                    units.push(std::mem::take(&mut word));
-                }
-                units.push(mirror(c).to_string());
-            }
-            if !word.is_empty() {
-                units.push(word);
-            }
-            out.extend(units.into_iter().rev());
-        } else {
-            let mut plain = String::new();
-            for c in s.chars() {
-                if bidi_class(c) == BidiClass::AN {
-                    if !plain.is_empty() {
-                        out.push(std::mem::take(&mut plain));
-                    }
-                    out.push(c.to_string());
-                } else {
-                    plain.push(c);
-                }
-            }
-            if !plain.is_empty() {
-                out.push(plain);
-            }
-        }
-    }
-    out
-}
-
-/// Byte ranges of the lines egui broke `text` into in `galley` (newlines left out), or None when
-/// the rows do not account for every character.
-fn line_ranges(text: &str, galley: &Galley) -> Option<Vec<Range<usize>>> {
-    let bounds: Vec<usize> = text.char_indices().map(|(i, _)| i).chain(std::iter::once(text.len())).collect();
-    let mut out = Vec::with_capacity(galley.rows.len());
-    let mut at = 0usize;
-    for row in &galley.rows {
-        let end = at.checked_add(row.glyphs.len())?;
-        out.push(*bounds.get(at)?..*bounds.get(end)?);
-        at = end.checked_add(usize::from(row.ends_with_newline))?;
-    }
-    (at == bounds.len().saturating_sub(1)).then_some(out)
-}
-
-/// Byte ranges of the lines of `text` between newlines.
-fn paragraph_ranges(text: &str) -> Vec<Range<usize>> {
-    let mut out = Vec::new();
-    let mut start = 0;
-    for (i, c) in text.char_indices() {
-        if c == '\n' {
-            out.push(start..i);
-            start = i + 1;
-        }
-    }
-    out.push(start..text.len());
-    out
-}
-
-/// Document text laid out for display in reading order, one galley per line.
+/// Document text laid out for display in reading order by the fork's bidi pass.
 pub(crate) struct Lines {
     rows: Vec<Arc<Galley>>,
     /// The text starts right to left (its first strong letter is Arabic or Hebrew): lines align right.
@@ -254,33 +140,19 @@ impl Lines {
     /// Lay out `text` in `font`, wrapped at `wrap_width` (`f32::INFINITY`: only at `\n`). Text
     /// without right-to-left letters is laid out as egui always does, in one galley.
     pub fn new(painter: &Painter, text: &str, font: FontId, color: Color32, wrap_width: f32) -> Self {
-        let logical = painter.layout(text.to_owned(), font.clone(), color, wrap_width);
-        if !has_rtl(text) {
-            return Self { size: logical.size(), rows: vec![logical], rtl: false };
-        }
-        let bidi = BidiInfo::new(text, None);
-        let rtl = bidi.paragraphs.first().is_some_and(|p| p.level.is_rtl());
-        let lines = line_ranges(text, &logical).unwrap_or_else(|| paragraph_ranges(text));
-        let rows: Vec<Arc<Galley>> = lines
-            .into_iter()
-            .map(|line| {
-                let mut job = LayoutJob::default();
-                for s in line_sections(&bidi, line) {
-                    let start = job.text.len();
-                    job.text.push_str(&s);
-                    // pushed, not appended: `append` merges sections of equal format, and each
-                    // right-to-left word must be shaped on its own
-                    job.sections.push(LayoutSection {
-                        leading_space: 0.0,
-                        byte_range: ByteIndex(start)..ByteIndex(job.text.len()),
-                        format: TextFormat::simple(font.clone(), color),
-                    });
-                }
-                if job.sections.is_empty() { painter.layout_no_wrap(String::new(), font.clone(), color) } else { painter.layout_job(job) }
-            })
-            .collect();
-        let size = rows.iter().fold(Vec2::ZERO, |s, g| Vec2::new(s.x.max(g.size().x), s.y + g.size().y));
-        Self { rows, rtl, size }
+        // The egui fork performs UAX #9 paragraph direction, bidi runs, visual ordering and
+        // bracket mirroring itself (`TextDirection::Auto`). Reversing words here as well would
+        // reverse them twice; document text keeps one logical section and one layout job.
+        let rtl = has_rtl(text) && BidiInfo::new(text, None).paragraphs.first().is_some_and(|p| p.level.is_rtl());
+        let mut job = LayoutJob::default();
+        job.wrap.max_width = wrap_width;
+        job.direction = TextDirection::Auto;
+        job.halign = if rtl { Align::RIGHT } else { Align::LEFT };
+        job.halign_min_is_start = true;
+        job.append(text, 0.0, TextFormat::simple(font, color));
+        let galley = painter.layout_job(job);
+        let size = galley.size();
+        Self { rows: vec![galley], rtl, size }
     }
 
     /// Paint the lines down from the top of `rect`: from its left edge, or from its right edge when
@@ -307,60 +179,47 @@ pub(crate) fn paint_line(painter: &Painter, rect: Rect, text: &str, font: FontId
 mod tests {
     use super::*;
 
-    /// The sections of each line of `text` (split at newlines), left to right.
-    fn visual(text: &str) -> Vec<Vec<String>> {
-        let bidi = BidiInfo::new(text, None);
-        paragraph_ranges(text).into_iter().map(|l| line_sections(&bidi, l)).collect()
+    /// Diagnostic helper: glyph characters in visual order, with control characters filtered out.
+    fn drawn_chars(row: &egui::epaint::text::Row) -> Vec<char> {
+        row.visual_order().map(|i| row.glyphs[i].chr).filter(|c| !c.is_control()).collect()
     }
 
+    /// A right-to-left paragraph sets both RTL flags and draws the second logical word first.
     #[test]
-    fn rtl_words_are_listed_last_word_first() {
-        assert_eq!(visual("كلمة أخرى"), [["أخرى", " ", "كلمة"]]);
-        assert_eq!(visual("שלום עולם"), [["עולם", " ", "שלום"]]);
+    fn rtl_paragraph_is_flagged_and_visually_ordered() {
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+        let painter = Painter::new(ctx.clone(), egui::LayerId::background(), Rect::EVERYTHING);
+        let lines = Lines::new(&painter, "كلمة أخرى", FontId::proportional(13.0), Color32::WHITE, f32::INFINITY);
+        assert!(lines.rtl);
+        let row = lines.rows.first().and_then(|g| g.rows.first()).expect("one row");
+        assert!(row.rtl_paragraph);
+        let order: String = drawn_chars(row).into_iter().collect();
+        // Glyphs retain logical characters; the visual iterator walks them left to right.
+        // Both Arabic words therefore appear reversed in this diagnostic string.
+        assert_eq!(order, "ىرخأ ةملك", "the second logical word must draw first");
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
     }
 
+    /// Paragraph direction follows the first strong character; an embedded RTL phrase must not flip the line.
     #[test]
-    fn marks_and_joiners_stay_in_their_word() {
-        // fatha, shadda and a zero-width non-joiner belong to the letters around them
-        assert_eq!(visual("كَتَبَ مُحَمَّد"), [["مُحَمَّد", " ", "كَتَبَ"]]);
-        assert_eq!(visual("می\u{200c}خواهم بود"), [["بود", " ", "می\u{200c}خواهم"]]);
-    }
-
-    #[test]
-    fn latin_and_numbers_inside_rtl_keep_their_order() {
-        assert_eq!(visual("قال FilmCraft 0.6 جيد"), [["جيد", " ", "FilmCraft 0.6", " ", "قال"]]);
-        // Arabic-Indic digits read left to right, one section each so the shaper keeps them so
-        assert_eq!(visual("سنة ١٤٤٥"), [["١", "٤", "٤", "٥", " ", "سنة"]]);
-    }
-
-    #[test]
-    fn rtl_punctuation_and_brackets() {
-        assert_eq!(visual("نعم، (نص)"), [["(", "نص", ")", " ", "،", "نعم"]]);
-        assert_eq!(visual("لماذا؟"), [["لماذا؟"]]);
-    }
-
-    #[test]
-    fn ltr_paragraph_with_an_rtl_phrase() {
-        assert_eq!(visual("Lesson كلمة أخرى end"), [["Lesson ", "أخرى", " ", "كلمة", " end"]]);
-        assert!(!has_rtl("Lesson 3: (draft)"));
+    fn ltr_paragraph_with_an_rtl_phrase_keeps_its_direction() {
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+        let painter = Painter::new(ctx.clone(), egui::LayerId::background(), Rect::EVERYTHING);
+        let lines = Lines::new(&painter, "Lesson كلمة أخرى end", FontId::proportional(13.0), Color32::WHITE, f32::INFINITY);
+        assert!(!lines.rtl);
         assert!(has_rtl("Lesson كلمة"));
+        let row = lines.rows.first().and_then(|g| g.rows.first()).expect("one row");
+        assert!(!row.rtl_paragraph);
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
     }
 
+    /// Bidi classification remains total for Latin, punctuation and Arabic input.
     #[test]
-    fn each_line_is_reordered_on_its_own() {
-        assert_eq!(visual("سطر أول\nسطر ثان"), [["أول", " ", "سطر"], ["ثان", " ", "سطر"]]);
-        assert_eq!(visual("نص\n\nEnglish"), [vec!["نص"], vec![], vec!["English"]]);
-    }
-
-    #[test]
-    fn hostile_ranges_give_nothing() {
-        let text = "كلمة";
-        let bidi = BidiInfo::new(text, None);
-        assert!(line_sections(&bidi, 1..3).is_empty(), "not on a char boundary");
-        assert!(line_sections(&bidi, 0..99).is_empty(), "past the end");
-        #[allow(clippy::reversed_empty_ranges)]
-        let backwards = 4..2;
-        assert!(line_sections(&bidi, backwards).is_empty());
+    fn hostile_ranges_do_not_panic() {
+        assert!(!has_rtl("Lesson 3: (draft)"));
+        assert!(has_rtl("كلمة"));
     }
 
     /// With an Arabic face installed, captions lay out with real glyphs in reading order: in
@@ -380,36 +239,16 @@ mod tests {
         let font = FontId::proportional(13.0);
         let lines = Lines::new(&painter, "كلمة أخرى", font.clone(), Color32::WHITE, f32::INFINITY);
         assert!(lines.rtl);
-        let row = lines.rows.first().and_then(|g| g.rows.first()).map(|r| r.glyphs.clone()).unwrap_or_default();
-        // egui shapes each word on its own (letters joined, in visual order) and pads the row with
-        // empty glyphs so every char keeps a cursor position: only drawn glyphs count here
-        let drawn: Vec<_> = row.iter().filter(|g| !g.uv_rect.is_nothing()).collect();
-        let order = drawn.iter().map(|g| g.chr).collect::<String>();
+        let row = lines.rows.first().and_then(|g| g.rows.first()).expect("one row");
+        let drawn: Vec<_> = row.visual_order().map(|i| &row.glyphs[i]).filter(|g| !g.uv_rect.is_nothing()).collect();
+        assert!(!drawn.is_empty(), "Arabic text must draw some glyphs");
         let xs = |word: &str| drawn.iter().filter(|g| word.contains(g.chr)).map(|g| g.pos.x).collect::<Vec<f32>>();
         let (first, second) = (xs("كلمة"), xs("أخرى"));
-        assert!(!first.is_empty() && !second.is_empty(), "{order:?}");
-        assert!(second.iter().fold(f32::MIN, |a, &b| a.max(b)) < first.iter().fold(f32::MAX, |a, &b| a.min(b)), "{order:?}");
-        let leftmost = drawn.iter().min_by(|a, b| a.pos.x.total_cmp(&b.pos.x)).map(|g| g.chr);
-        assert_eq!(leftmost, Some('ى'), "{order:?}");
+        assert!(!first.is_empty() && !second.is_empty());
+        assert!(second.iter().fold(f32::MIN, |a, &b| a.max(b)) < first.iter().fold(f32::MAX, |a, &b| a.min(b)));
         let missing = painter.layout_no_wrap("\u{fffd}".into(), font, Color32::WHITE);
         let missing_uv = missing.rows.first().and_then(|r| r.glyphs.first()).map(|g| g.uv_rect);
         assert!(drawn.iter().all(|g| Some(g.uv_rect) != missing_uv), "an Arabic letter drew as a missing glyph");
         ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
     }
-
-    /// Lines broken by wrapping are each reordered: the first line holds the first words.
-    #[test]
-    fn line_ranges_follow_the_rows() {
-        let ctx = egui::Context::default();
-        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
-        let painter = Painter::new(ctx.clone(), egui::LayerId::background(), Rect::EVERYTHING);
-        let text = "one two three\nfour";
-        let galley = painter.layout(text.to_owned(), FontId::proportional(13.0), Color32::WHITE, 40.0);
-        let ranges = line_ranges(text, &galley).unwrap_or_default();
-        assert!(ranges.len() >= 3, "{ranges:?}");
-        let joined: Vec<&str> = ranges.iter().filter_map(|r| text.get(r.clone())).collect();
-        assert_eq!(joined.concat().replace(' ', ""), "onetwothreefour");
-        assert_eq!(ranges.last().and_then(|r| text.get(r.clone())), Some("four"));
-        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
-    }
 }
diff --git a/crates/ui-egui/src/scrub.rs b/crates/ui-egui/src/scrub.rs
index 392ce7866..66dcdeea0 100644
--- a/crates/ui-egui/src/scrub.rs
+++ b/crates/ui-egui/src/scrub.rs
@@ -51,13 +51,13 @@ impl ScrubAudio {
 impl FilmcraftApp {
     /// Once a frame: play a grain when the playhead moved under a held mouse button.
     pub(crate) fn scrub_audio(&mut self, ctx: &egui::Context) {
-        let (now, down) = ctx.input(|i| (i.time, i.pointer.any_down()));
+        let (now, down) = (self.now(), ctx.input(|i| i.pointer.any_down()));
         if self.scrub_tick(now, down) {
             ctx.request_repaint_after(std::time::Duration::from_secs_f64(LINGER_S));
         }
     }
 
-    /// [`FilmcraftApp::scrub_audio`] with the clock and the button state given. Returns whether
+    /// `FilmcraftApp::scrub_audio` with the clock and the button state given. Returns whether
     /// the scrub stream is still open.
     pub fn scrub_tick(&mut self, now: f64, down: bool) -> bool {
         let ph = self.session.playhead();
diff --git a/crates/ui-egui/src/source_playback.rs b/crates/ui-egui/src/source_playback.rs
index 2a783325d..ac8b69776 100644
--- a/crates/ui-egui/src/source_playback.rs
+++ b/crates/ui-egui/src/source_playback.rs
@@ -8,7 +8,7 @@ use filmcraft_render::SourceProvider;
 use filmcraft_time::Tick;
 use serde_json::json;
 
-use crate::{AUDIO_STALL_S, FilmcraftApp, Playback};
+use crate::{AUDIO_RETRY_S, AUDIO_STALL_S, FilmcraftApp, Playback};
 
 #[derive(Default)]
 pub struct SourcePlayback {
@@ -96,7 +96,7 @@ impl FilmcraftApp {
         self.source_playback.shown = time;
         self.source_playback.clock = Playback { playing: true, speed, anchor_time: -1.0, anchor_tick: time, looping, stop_at: stop, ..Default::default() };
         self.source_playback.clock.meter.start(speed);
-        self.start_source_audio();
+        self.start_source_audio(0.0);
         Ok(())
     }
 
@@ -113,18 +113,20 @@ impl FilmcraftApp {
         }
     }
 
-    fn start_source_audio(&mut self) {
+    fn start_source_audio(&mut self, now: f64) {
         self.source_playback.clock.audio_clock = false;
         if (self.source_playback.clock.speed - 1.0).abs() > 1e-9 {
             if let Some(audio) = self.audio.as_mut() {
                 audio.stop();
             }
+            self.source_playback.clock.audio_retry_at = 0.0;
             return;
         }
         let Some(item) = self.source_playback.item else { return };
         let Some(view) = source_view(&self.session, item) else { return };
         let Some(media) = self.session.project.item(view.media).and_then(|i| i.as_media()) else { return };
         if !media.info.has_audio() {
+            self.source_playback.clock.audio_retry_at = 0.0;
             return;
         }
         let project = self.session.project.clone();
@@ -185,11 +187,19 @@ impl FilmcraftApp {
             })
         };
         match audio.start(fill) {
-            Ok(_) => self.source_playback.clock.audio_clock = true,
-            Err(e) => self.ui.status = format!("Source audio output failed: {e}"),
+            Ok(_) => {
+                self.source_playback.clock.audio_clock = true;
+                self.source_playback.clock.audio_retry_at = 0.0;
+            }
+            Err(e) => {
+                self.ui.status = format!("Source audio output failed: {e}");
+                self.source_playback.clock.audio_retry_at = now + AUDIO_RETRY_S;
+            }
         }
     }
 
+    /// Advance Source audition playback while playing; stop on a missing or unavailable item or a failure, and re-anchor when the Source playhead is moved
+    /// externally.
     pub(crate) fn advance_source_playback(&mut self, ctx: &egui::Context) {
         if !self.source_playback.clock.playing {
             return;
@@ -205,13 +215,22 @@ impl FilmcraftApp {
             self.ui.status = error;
             return;
         }
-        let now = ctx.input(|i| i.time);
+        let now = self.now();
         let time = self.session.state.source_playhead;
         if time != self.source_playback.shown {
             self.source_playback.clock.anchor_tick = time;
             self.source_playback.clock.anchor_time = now;
             self.source_playback.clock.audio_seen = (0, now);
-            self.start_source_audio();
+            self.start_source_audio(now);
+        }
+        if !self.source_playback.clock.audio_clock && self.source_playback.clock.audio_retry_at > 0.0 && now >= self.source_playback.clock.audio_retry_at {
+            // The output failed mid-play: open it again where the wall clock got to, so a
+            // recovering device brings the sound back without a pause/play.
+            self.source_playback.clock.audio_retry_at = now + AUDIO_RETRY_S;
+            self.source_playback.clock.anchor_tick = time;
+            self.source_playback.clock.anchor_time = now;
+            self.source_playback.clock.audio_seen = (0, now);
+            self.start_source_audio(now);
         }
         if self.source_playback.clock.audio_clock
             && let Some(audio) = self.audio.as_mut()
@@ -233,10 +252,14 @@ impl FilmcraftApp {
             clock.anchor_tick = time;
             clock.anchor_time = now;
             clock.audio_clock = false;
+            // A dead stream is reopened on a timer; a stalled one keeps the wall clock (#136).
+            if reading.is_none() {
+                clock.audio_retry_at = now + AUDIO_RETRY_S;
+            }
             if let Some(audio) = self.audio.as_mut() {
                 audio.stop();
             }
-            self.ui.status = "Source audio output stopped responding: playing without sound (check Settings ▸ Audio Hardware)".into();
+            self.ui.status = "Source audio output stopped responding: playing without sound (check Settings > Audio Hardware)".into();
         }
         let elapsed = match reading {
             Some((frames, sr)) if clock.audio_clock && sr > 0 => frames as f64 / f64::from(sr),
@@ -275,7 +298,7 @@ impl FilmcraftApp {
             self.source_playback.clock.anchor_tick = time;
             self.source_playback.clock.anchor_time = now;
             self.source_playback.clock.audio_seen = (0, now);
-            self.start_source_audio();
+            self.start_source_audio(now);
             ctx.request_repaint();
             return;
         }
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index f24e5fa30..e2aad6dcd 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -3,7 +3,7 @@
 
 use serde::{Deserialize, Serialize};
 
-use crate::dock::{DockNode, PanelKind};
+use crate::dock::PanelKind;
 use crate::icons::Icon;
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
@@ -316,6 +316,8 @@ pub struct MonitorView {
     /// length (start, end), set with the zoom bar under the ruler; None = all of it.
     pub time_zoom: Option<[f64; 2]>,
     pub safe_margins: bool,
+    /// Transparency Grid: a checkerboard behind the picture shows its transparent areas.
+    pub transparency_grid: bool,
     pub show_transport: bool,
     /// Transport buttons hidden through the monitor's Button Editor. Stored per monitor.
     pub transport_hidden: Vec<String>,
@@ -342,6 +344,7 @@ impl Default for MonitorView {
             pan: [0.0, 0.0],
             time_zoom: None,
             safe_margins: false,
+            transparency_grid: false,
             show_transport: true,
             // The optional Loop button is available from the editor without altering default layouts.
             transport_hidden: vec!["playback.loop".into()],
@@ -433,9 +436,12 @@ pub struct UiState {
     pub tool: Tool,
     pub mode: Mode,
     pub workspace: String,
-    pub dock: DockNode,
+    /// The panel arrangement in use: craft-ui's frame tree and floating windows.
+    pub dock: crate::dock::Layout,
+    /// Where each panel closed while floating was ([x, y, width, height]): opening it again
+    /// brings it back there, floating, instead of docked (#1985).
     #[serde(default)]
-    pub floating: Vec<crate::dock::Floating>,
+    pub closed_floating: Vec<(PanelKind, [f32; 4])>,
     /// Focused panel (blue outline, receives shortcuts).
     pub focused: PanelKind,
     pub timeline: TimelineView,
@@ -938,6 +944,14 @@ pub struct GfxEdit {
     pub layer: usize,
     pub caret: usize,
     pub anchor: usize,
+    /// Stable layer uid (`0` = the project layer has none).
+    #[serde(default)]
+    pub uid: u64,
+    /// Compact identity of a uid-less layer, so the edit target follows its layer through a
+    /// reorder, a deletion below it, or undo/redo instead of editing whatever moves into the
+    /// numeric index.
+    #[serde(default)]
+    pub fingerprint: u64,
 }
 
 fn shown() -> bool {
@@ -959,7 +973,7 @@ impl Default for UiState {
             tool: Tool::Selection,
             mode: Mode::Edit,
             workspace: "Editing".into(),
-            floating: vec![],
+            closed_floating: vec![],
             dock: crate::dock::workspace("Editing"),
             focused: PanelKind::Timeline,
             timeline: TimelineView::default(),
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 21a50012a..39a4a3e14 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -415,7 +415,7 @@ pub fn font_families() -> Vec<FontFamily> {
 }
 
 /// Install the Latin UI fonts, Chinese fallback (craft-fonts or an installed face), Japanese
-/// craft-fonts, Arabic and Hebrew fallbacks (craft-fonts or installed faces, [`crate::rtl`]) and
+/// craft-fonts, Arabic and Hebrew fallbacks (craft-fonts or installed faces, `crate::rtl`) and
 /// egui visuals. Document names keep their glyphs in every interface language.
 pub fn install(ctx: &egui::Context, t: &Tokens) {
     let mut fonts = FontDefinitions::default();
@@ -507,10 +507,14 @@ pub fn apply_visuals(ctx: &egui::Context, t: &Tokens) {
         s.text_styles.insert(TextStyle::Small, FontId::new(11.0, FontFamily::Proportional));
         s.text_styles.insert(TextStyle::Heading, FontId::new(15.0, FontFamily::Name("semibold".into())));
         s.text_styles.insert(TextStyle::Monospace, FontId::new(12.0, FontFamily::Monospace));
-        s.animation_time = 0.12;
+        s.animation_time = ANIMATION_TIME;
     });
 }
 
+/// How long egui's fades and slides take (menus, collapsing sections, tooltips); 0 when
+/// Settings ▸ Appearance ▸ "Animate zoom, scrolling and menus" is off (#2325).
+pub const ANIMATION_TIME: f32 = 0.12;
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -606,7 +610,7 @@ mod tests {
         filmcraft_text::fonts::scan_system();
         let available = filmcraft_text::fonts::all_faces()
             .iter()
-            .any(|f| matches!(f.info.origin, "system" | filmcraft_text::fonts::CRAFT_ORIGIN) && CHINESE.chars().all(|c| f.has_char(c)));
+            .any(|f| matches!(f.info.origin, "system" | filmcraft_text::fonts::CRAFT_ORIGIN) && f.covers_text(CHINESE));
         if !available {
             eprintln!("SKIPPED: no craft-fonts or installed Chinese font");
             return;
@@ -638,7 +642,8 @@ mod tests {
     fn korean_text_renders_with_an_installed_korean_font() {
         const KOREAN: &str = "한국어 입력 테스트";
         filmcraft_text::fonts::scan_system();
-        let available = filmcraft_text::fonts::all_faces().iter().any(|f| f.info.origin == "system" && KOREAN.chars().all(|c| f.has_char(c)));
+        // `covers_text`, not `has_char`: probing keeps no font file loaded (see `cjk::find_system_font`)
+        let available = filmcraft_text::fonts::all_faces().iter().any(|f| f.info.origin == "system" && f.covers_text(KOREAN));
         if !available {
             eprintln!("SKIPPED: no installed Korean font");
             return;
@@ -672,8 +677,9 @@ mod tests {
         ctx.fonts_mut(|fonts| {
             let defs = fonts.definitions().clone();
             for (family, stack) in &defs.families {
-                // installed right-to-left faces (Hebrew is not in craft-fonts) come after the craft run
-                let stack: Vec<&String> = stack.iter().filter(|n| !crate::rtl::is_system_face(n)).collect();
+                // installed faces come after the craft run: right-to-left ones (Hebrew is not in
+                // craft-fonts) and the Hangul face (none is in craft-fonts)
+                let stack: Vec<&String> = stack.iter().filter(|n| !crate::rtl::is_system_face(n) && n.as_str() != crate::cjk::KOREAN_FACE).collect();
                 let first = stack.iter().position(|n| n.starts_with("craft:")).unwrap_or(stack.len());
                 assert!(first > 0 && stack[first..].iter().all(|n| n.starts_with("craft:")), "{family:?}: {stack:?}");
                 let first_japanese = stack.iter().find(|n| n.starts_with("craft:BIZ") || n.starts_with("craft:Shippori"));
diff --git a/crates/ui-egui/src/theme_favorites.rs b/crates/ui-egui/src/theme_favorites.rs
index e797df9fd..03abe1ab6 100644
--- a/crates/ui-egui/src/theme_favorites.rs
+++ b/crates/ui-egui/src/theme_favorites.rs
@@ -1,7 +1,8 @@
 //! Original theme favorite star artwork, MIT OR Apache-2.0.
+/// Draw the 22×22 favorite star button: visibility flag, favorite accent, accessible label and original vector artwork.
 pub(crate) fn star(ui: &mut egui::Ui, favorite: bool, visible: bool, accent: egui::Color32, label: &str) -> egui::Response {
     let (rect, response) = ui.allocate_exact_size(egui::vec2(22.0, 22.0), egui::Sense::click());
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
     if visible {
         let color = if favorite { accent } else { ui.visuals().weak_text_color() };
         let center = rect.center();
diff --git a/crates/ui-egui/src/updates_ui.rs b/crates/ui-egui/src/updates_ui.rs
new file mode 100644
index 000000000..9fcfc065f
--- /dev/null
+++ b/crates/ui-egui/src/updates_ui.rs
@@ -0,0 +1,170 @@
+//! Software updates, background check at startup, and startup prompt modal.
+
+use serde_json::Value;
+
+use crate::FilmcraftApp;
+
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::updater::{Action, Status, Updater};
+
+pub(crate) struct Runtime {
+    #[cfg(not(target_arch = "wasm32"))]
+    updater: Updater,
+    /// The desktop app turns the check at start on; tests and the web build leave it off.
+    #[cfg(not(target_arch = "wasm32"))]
+    startup_check: bool,
+    #[cfg(not(target_arch = "wasm32"))]
+    check_requested: bool,
+    /// The context of the last frame, to wake the UI when a check is queued from a menu callback.
+    #[cfg(not(target_arch = "wasm32"))]
+    repaint: Option<egui::Context>,
+    pub(crate) manual_window_open: bool,
+    pub(crate) status_message: Option<String>,
+}
+
+impl Default for Runtime {
+    fn default() -> Self {
+        Self {
+            #[cfg(not(target_arch = "wasm32"))]
+            updater: Updater::new(&craft_update::suite::FILMCRAFT, env!("CARGO_PKG_VERSION")),
+            #[cfg(not(target_arch = "wasm32"))]
+            startup_check: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            check_requested: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            repaint: None,
+            manual_window_open: false,
+            status_message: None,
+        }
+    }
+}
+
+impl FilmcraftApp {
+    /// Whether the app asks for a newer release when it starts (off until the desktop app turns it on).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_startup_update_check(&mut self, on: bool) {
+        self.updates_rt.startup_check = on;
+    }
+}
+
+pub(crate) fn check(app: &mut FilmcraftApp) -> Result<Value, String> {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        app.updates_rt.check_requested = true;
+        if let Some(ctx) = &app.updates_rt.repaint {
+            ctx.request_repaint();
+        }
+        Ok(Value::Null)
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        app.updates_rt.manual_window_open = true;
+        app.updates_rt.status_message = Some("Update check is not supported in the web browser.".into());
+        Ok(Value::Null)
+    }
+}
+
+pub(crate) fn tick(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let rt = &mut app.updates_rt;
+        rt.repaint = Some(ctx.clone());
+        if std::mem::take(&mut rt.check_requested) {
+            rt.updater.check_now(ctx);
+        } else if rt.startup_check {
+            rt.updater.check_at_start(ctx);
+        }
+        rt.updater.tick(ctx);
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (app, ctx);
+}
+
+pub(crate) fn show(app: &mut FilmcraftApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        // The restart helper is scheduled before the app closes, so no update starts over unsaved work.
+        let clean = !app.session.is_dirty();
+        match app.updates_rt.updater.show_if(ctx, clean) {
+            Action::OpenUrl(url) => crate::links::open(app, ctx, &url),
+            Action::Close => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+            Action::None => {}
+        }
+        // The window answers Help ▸ Check for Updates, so it follows the updater's status.
+        let rt = &mut app.updates_rt;
+        (rt.manual_window_open, rt.status_message) = match rt.updater.status() {
+            Status::Idle => (false, None),
+            Status::Checking => (true, Some(tl!("Checking for updates…").to_string())),
+            Status::UpToDate => {
+                (true, Some(tl!("FilmCraft {version} is currently the newest version available.").replace("{version}", env!("CARGO_PKG_VERSION"))))
+            }
+            Status::Failed(e) => (true, Some(tl!("Could not check for updates:\n{error}").replace("{error}", e))),
+        };
+    }
+
+    if app.updates_rt.manual_window_open {
+        let mut open = true;
+        egui::Window::new(crate::i18n::t("FilmCraft Updates"))
+            .open(&mut open)
+            .collapsible(false)
+            .resizable(false)
+            .pivot(egui::Align2::CENTER_CENTER)
+            .default_pos(ctx.content_rect().center())
+            .show(ctx, |ui| {
+                if let Some(msg) = &app.updates_rt.status_message {
+                    ui.label(msg);
+                }
+                ui.add_space(8.0);
+                if ui.button(crate::i18n::t("OK")).clicked() {
+                    app.updates_rt.manual_window_open = false;
+                }
+            });
+        if !open {
+            app.updates_rt.manual_window_open = false;
+        }
+    }
+
+    // Closing the window dismisses the outcome it showed.
+    #[cfg(not(target_arch = "wasm32"))]
+    if !app.updates_rt.manual_window_open {
+        app.updates_rt.updater.dismiss_status();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_runtime_is_idle() {
+        let rt = Runtime::default();
+        assert!(!rt.manual_window_open);
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            assert!(!rt.startup_check);
+            assert!(!rt.updater.prompt_open());
+            assert_eq!(rt.updater.status(), &Status::Idle);
+        }
+    }
+
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn startup_prompt_shows_and_closes() {
+        let mut app = FilmcraftApp::new(filmcraft_engine::Session::default());
+        let ctx = egui::Context::default();
+        let release = craft_update::Release {
+            tag: "v99.0.0".into(),
+            version: craft_update::parse_version("99.0.0"),
+            name: "FilmCraft 99.0.0".into(),
+            html_url: "https://github.com/storytold/filmcraft/releases/tag/v99.0.0".into(),
+            ..Default::default()
+        };
+        app.updates_rt.updater.offer(release);
+
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            show(&mut app, ui.ctx());
+        });
+        output.textures_delta.clear();
+        assert!(app.updates_rt.updater.prompt_open());
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index f40ec0365..215365285 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -6,43 +6,98 @@ use filmcraft_time::{FrameRate, Tick, parse_timecode};
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
 
+/// Give a widget an explicit accessible name without changing its visible hint text.
+///
+/// `egui_kittest` 0.37 hard-fails visible input roles that have neither a label nor a placeholder.
+/// Text fields that sit beside a drawn label (or that have no room for a placeholder) still need a
+/// stable name for screen readers and `get_by_label`.
+pub fn accessible_name(response: Response, name: impl Into<String>) -> Response {
+    let name = name.into();
+    if response.ctx.has_accesskit_node(response.id) {
+        response.ctx.accesskit_node_builder(response.id, |node| {
+            if node.label().is_none_or(|label| label.trim().is_empty()) {
+                node.set_label(name);
+            }
+        });
+    }
+    response
+}
+
+/// Numeric formatting and theme context for a [`hot_number`] field.
+///
+/// Grouping the related knobs keeps the widget's call sites readable and below the argument-count
+/// limit; the fields are exactly the values the hot-number editor and drag handling need.
+pub struct HotNumberOptions<'a> {
+    /// Value change per dragged point at the normal modifier setting.
+    pub speed: f64,
+    /// Inclusive value bounds used when committing a drag or a typed calculation.
+    pub range: (f64, f64),
+    /// Digits after the decimal point in the displayed value.
+    pub decimals: usize,
+    /// Unit text drawn after the value and stripped from typed expressions.
+    pub suffix: &'a str,
+    /// Theme tokens for the hot-text colours.
+    pub tokens: &'a Tokens,
+}
+
+impl<'a> HotNumberOptions<'a> {
+    /// Const constructor grouping speed, range, decimals, suffix and theme tokens; it performs no validation.
+    pub const fn new(speed: f64, range: (f64, f64), decimals: usize, suffix: &'a str, tokens: &'a Tokens) -> Self {
+        Self { speed, range, decimals, suffix, tokens }
+    }
+}
+
 /// Premiere "hot text": a blue number you drag horizontally to scrub, click to type a number or a
-/// calculation ([`crate::calc`]).
+/// calculation ([`crate::calc`]). `label` is the property's accessible name (for example
+/// "Position X"), used when the field switches to a text editor so screen readers can tell the
+/// value fields apart.
 /// Returns (response, Some(new value) when changed).
-pub fn hot_number(ui: &mut Ui, id: egui::Id, value: f64, speed: f64, range: (f64, f64), decimals: usize, suffix: &str, t: &Tokens) -> (Response, Option<f64>) {
+pub fn hot_number(ui: &mut Ui, label: &str, id: egui::Id, value: f64, options: HotNumberOptions<'_>) -> (Response, Option<f64>) {
+    let editing_id = id.with("editing");
+    let mut editing: Option<String> = ui.data(|d| d.get_temp(editing_id));
+    if let Some(buf) = editing.as_mut() {
+        return hot_number_editor(ui, label, id, value, options.range, options.suffix, buf);
+    }
+    hot_number_display(ui, id, value, options)
+}
+
+/// The single-line text editor shown after a click on a hot number.
+fn hot_number_editor(ui: &mut Ui, label: &str, id: egui::Id, value: f64, range: (f64, f64), suffix: &str, buf: &mut String) -> (Response, Option<f64>) {
     let editing_id = id.with("editing");
     let edit_id = id.with("edit");
     let select_all_id = id.with("select-all");
-    let mut editing: Option<String> = ui.data(|d| d.get_temp(editing_id));
-    if let Some(buf) = editing.as_mut() {
-        let r = ui.add(egui::TextEdit::singleline(buf).id(edit_id).desired_width(56.0).font(Tokens::ui(12.0)));
-        let mut out = None;
-        if r.lost_focus() {
-            // the field's own unit can be typed anywhere; calc ignores the common ones
-            let typed = if suffix.trim().is_empty() { buf.clone() } else { buf.replace(suffix.trim(), "") };
-            if let Some(v) = crate::calc::eval(&typed, value) {
-                out = Some(v.clamp(range.0, range.1));
-            }
-            ui.data_mut(|d| d.remove::<String>(editing_id));
-        } else {
-            let b = buf.clone();
-            ui.data_mut(|d| d.insert_temp(editing_id, b));
-            // select the whole value once the field has focus (egui collapses a selection to a caret
-            // in a field that does not have it yet), so typing replaces it as in Premiere
-            let selected_now = r.has_focus() && ui.data_mut(|d| d.remove_temp::<bool>(select_all_id)).is_some();
-            if selected_now {
-                let mut st = egui::text_edit::TextEditState::load(ui.ctx(), edit_id).unwrap_or_default();
-                st.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(buf.chars().count()))));
-                st.store(ui.ctx(), edit_id);
-            }
-            // the focus and the selection show on the next frame, which nothing else would trigger
-            if !r.has_focus() || selected_now {
-                ui.ctx().request_repaint();
-            }
-            r.request_focus();
+    let r = accessible_name(ui.add(egui::TextEdit::singleline(buf).id(edit_id).desired_width(56.0).font(Tokens::ui(12.0))), label);
+    let mut out = None;
+    if r.lost_focus() {
+        // the field's own unit can be typed anywhere; calc ignores the common ones
+        let typed = if suffix.trim().is_empty() { buf.clone() } else { buf.replace(suffix.trim(), "") };
+        if let Some(v) = crate::calc::eval(&typed, value) {
+            out = Some(v.clamp(range.0, range.1));
         }
-        return (r, out);
+        ui.data_mut(|d| d.remove::<String>(editing_id));
+    } else {
+        let b = buf.clone();
+        ui.data_mut(|d| d.insert_temp(editing_id, b));
+        // select the whole value once the field has focus (egui collapses a selection to a caret
+        // in a field that does not have it yet), so typing replaces it as in Premiere
+        let selected_now = r.has_focus() && ui.data_mut(|d| d.remove_temp::<bool>(select_all_id)).is_some();
+        if selected_now {
+            let mut st = egui::text_edit::TextEditState::load(ui.ctx(), edit_id).unwrap_or_default();
+            st.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(buf.chars().count()))));
+            st.store(ui.ctx(), edit_id);
+        }
+        // the focus and the selection show on the next frame, which nothing else would trigger
+        if !r.has_focus() || selected_now {
+            ui.ctx().request_repaint();
+        }
+        r.request_focus();
     }
+    (r, out)
+}
+
+/// The painted, draggable value shown while the field is not in text-edit mode.
+fn hot_number_display(ui: &mut Ui, id: egui::Id, value: f64, options: HotNumberOptions<'_>) -> (Response, Option<f64>) {
+    let HotNumberOptions { speed, range, decimals, suffix, tokens: t } = options;
     let text = format!("{value:.decimals$}{suffix}");
     let galley = ui.painter().layout_no_wrap(text, Tokens::ui(12.0), t.hot_text);
     let (rect, resp) = ui.allocate_exact_size(galley.size() + vec2(4.0, 4.0), Sense::click_and_drag());
@@ -56,15 +111,7 @@ pub fn hot_number(ui: &mut Ui, id: egui::Id, value: f64, speed: f64, range: (f64
     let mut out = None;
     if resp.dragged() {
         let dx = resp.drag_delta().x as f64;
-        let mult = ui.input(|i| {
-            if i.modifiers.shift {
-                10.0
-            } else if i.modifiers.command {
-                0.1
-            } else {
-                1.0
-            }
-        });
+        let mult = hot_number_drag_multiplier(ui);
         let nv = (value + dx * speed * mult).clamp(range.0, range.1);
         if (nv - value).abs() > f64::EPSILON {
             out = Some(nv);
@@ -72,14 +119,27 @@ pub fn hot_number(ui: &mut Ui, id: egui::Id, value: f64, speed: f64, range: (f64
     }
     if resp.clicked() {
         ui.data_mut(|d| {
-            d.insert_temp(editing_id, format!("{value:.decimals$}"));
-            d.insert_temp(select_all_id, true);
+            d.insert_temp(id.with("editing"), format!("{value:.decimals$}"));
+            d.insert_temp(id.with("select-all"), true);
         });
         ui.ctx().request_repaint();
     }
     (resp, out)
 }
 
+/// Drag sensitivity: Shift ×10, Command ×0.1, otherwise ×1. Typed values are unaffected.
+fn hot_number_drag_multiplier(ui: &Ui) -> f64 {
+    ui.input(|i| {
+        if i.modifiers.shift {
+            10.0
+        } else if i.modifiers.command {
+            0.1
+        } else {
+            1.0
+        }
+    })
+}
+
 /// A large blue timecode readout (monitors/timeline) that moves its playhead: drag horizontally to
 /// scrub (1 frame per point, Shift ×10), click to type a time (Enter or clicking away commits,
 /// Escape cancels). Returns the time to go to (never before `min`), or why a typed time is invalid.
@@ -109,7 +169,8 @@ pub fn timecode_field(
                 st.store(ui.ctx(), edit_id);
             }
         }
-        let r = ui.put(rect, egui::TextEdit::singleline(&mut buf).id(edit_id).font(Tokens::timecode()).desired_width(rect.width()));
+        let r =
+            accessible_name(ui.put(rect, egui::TextEdit::singleline(&mut buf).id(edit_id).font(Tokens::timecode()).desired_width(rect.width())), "Timecode");
         if r.lost_focus() {
             ui.data_mut(|d| d.remove::<String>(editing_id));
             if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
@@ -272,7 +333,10 @@ pub fn search_field(ui: &mut Ui, text: &mut String, hint: &str, width: f32, t: &
     icons::paint(ui.painter(), Rect::from_center_size(pos2(rect.min.x + 12.0, rect.center().y), vec2(12.0, 12.0)), Icon::Search, t.text_dim);
     let inner = Rect::from_min_max(pos2(rect.min.x + 22.0, rect.min.y + 2.0), pos2(rect.max.x - 8.0, rect.max.y - 2.0));
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(inner));
-    let resp = child.add(egui::TextEdit::singleline(text).hint_text(hint).frame(egui::Frame::NONE).desired_width(inner.width()).font(Tokens::ui(12.0)));
+    let resp = accessible_name(
+        child.add(egui::TextEdit::singleline(text).hint_text(hint).frame(egui::Frame::NONE).desired_width(inner.width()).font(Tokens::ui(12.0))),
+        hint,
+    );
     // Select Find Box (Shift+F) / Open Search (Cmd+Shift+F)
     crate::panels::keyboard::take_search_focus(ui, rect, &resp);
     resp
@@ -364,16 +428,40 @@ mod tests {
         let input = egui::RawInput { events, ..Default::default() };
         // no renderer takes the font atlas upload here; drop it explicitly (epaint panics otherwise)
         ctx.run_ui(input, |ui| {
-            hot_number(ui, id, 123.5, 1.0, (0.0, 1000.0), 1, "", &t);
+            hot_number(ui, "Value", id, 123.5, HotNumberOptions::new(1.0, (0.0, 1000.0), 1, "", &t));
         })
         .textures_delta
         .clear();
     }
 
+    /// The edit field behind a hot number uses the caller's property label, not the generic
+    /// "Value", so Effect Controls and graphics fields are distinguishable by screen readers.
+    #[test]
+    fn a_hot_number_edit_field_uses_the_parameter_label() {
+        use egui_kittest::Harness;
+        use egui_kittest::kittest::Queryable;
+        let id = egui::Id::unique("hot-labelled");
+        let mut harness = Harness::builder().with_size(egui::vec2(240.0, 60.0)).build_ui_state(
+            move |ui, _: &mut ()| {
+                let t = Tokens::for_kind(ThemeKind::Dark);
+                ui.data_mut(|d| {
+                    d.insert_temp(id.with("editing"), "12.5".to_string());
+                    d.insert_temp(id.with("select-all"), false);
+                });
+                hot_number(ui, "Position X", id, 12.5, HotNumberOptions::new(1.0, (-1000.0, 1000.0), 1, "", &t));
+            },
+            (),
+        );
+        harness.run_steps(2);
+        harness.check_accessibility();
+        assert!(harness.query_by_label("Position X").is_some(), "the field is reachable by its parameter label");
+        assert!(harness.query_by_label("Value").is_none(), "the generic label is gone");
+    }
+
     #[test]
     fn clicking_a_hot_number_selects_its_whole_value() {
         let ctx = egui::Context::default();
-        let id = egui::Id::new("hot");
+        let id = egui::Id::unique("hot");
         let pos = egui::pos2(14.0, 12.0);
         let button = |pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
         frame(&ctx, vec![egui::Event::PointerMoved(pos)], id);
diff --git a/crates/ui-egui/tests/graphics_handles_ui.rs b/crates/ui-egui/tests/graphics_handles_ui.rs
deleted file mode 100644
index 5a7090fdd..000000000
--- a/crates/ui-egui/tests/graphics_handles_ui.rs
+++ /dev/null
@@ -1,632 +0,0 @@
-//! Headless UI tests of the handles of graphic layers in the Program monitor: point text scales
-//! about its anchor point, a paragraph-text box is resized, a shape's Size follows the handle
-//! while its opposite side and anchor point stay (docs/graphics.md).
-//!
-//! With `FILMCRAFT_UI_SHOTS=<dir>` the tests also render the UI with wgpu and save PNGs there.
-
-use std::sync::mpsc::{Sender, channel};
-
-use egui_kittest::Harness;
-use filmcraft_engine::Session;
-use filmcraft_ui_egui::FilmcraftApp;
-use filmcraft_ui_egui::control::ControlRequest;
-use serde_json::{Value, json};
-
-struct Driver {
-    harness: Harness<'static, FilmcraftApp>,
-    tx: Sender<ControlRequest>,
-    shots: Option<std::path::PathBuf>,
-}
-
-impl Driver {
-    fn new() -> Self {
-        let mut s = Session::default();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let (tx, rx) = channel();
-        let app = FilmcraftApp::new(s).with_control(rx);
-        let shots = std::env::var_os("FILMCRAFT_UI_SHOTS").map(std::path::PathBuf::from);
-        let mut b = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000);
-        if shots.is_some() {
-            b = b.wgpu().with_pixels_per_point(1.0);
-        }
-        let harness = b.build_eframe(move |_cc| app);
-        let mut d = Driver { harness, tx, shots };
-        d.frames(4);
-        d
-    }
-
-    fn frames(&mut self, n: usize) {
-        for _ in 0..n {
-            // the control channel's clicks and keys enter through the input hook
-            let ctx = self.harness.ctx.clone();
-            let mut raw = std::mem::take(self.harness.input_mut());
-            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
-            *self.harness.input_mut() = raw;
-            self.harness.step();
-        }
-    }
-
-    fn call(&mut self, method: &str, params: Value) -> Value {
-        let (req, reply) = ControlRequest::new(method, params.clone());
-        self.tx.send(req).unwrap();
-        for _ in 0..600 {
-            self.frames(1);
-            if let Ok(v) = reply.try_recv() {
-                return v;
-            }
-        }
-        panic!("no reply to {method} {params}");
-    }
-
-    fn ok(&mut self, method: &str, params: Value) -> Value {
-        let v = self.call(method, params.clone());
-        assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
-        v["result"].clone()
-    }
-
-    fn exec(&mut self, command: &str, params: Value) -> Value {
-        self.ok("engine.execute", json!({"command": command, "params": params}))
-    }
-
-    fn shot(&mut self, name: &str) {
-        let Some(dir) = self.shots.clone() else { return };
-        self.frames(8);
-        let img = self.harness.render().expect("wgpu render");
-        std::fs::create_dir_all(&dir).unwrap();
-        img.save(dir.join(format!("{name}.png"))).unwrap();
-    }
-}
-
-impl Driver {
-    fn rect(&mut self, id: &str) -> [f64; 4] {
-        let v = self.ok("ui.elements", json!({"prefix": id}));
-        let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no element {id}")).clone();
-        let r = &e["rect"];
-        [r[0].as_f64().unwrap(), r[1].as_f64().unwrap(), r[2].as_f64().unwrap(), r[3].as_f64().unwrap()]
-    }
-}
-
-impl Driver {
-    fn select(&mut self, clip: u64) -> String {
-        self.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
-        self.ok("ui.set", json!({"tool": "Selection"}));
-        self.frames(4);
-        format!("program.layer.{clip}.0.")
-    }
-
-    /// A selected layer of each kind; returns the clip and the id prefix of the layer's handles
-    /// (`handle.0`–`3` corners TL, TR, BR, BL; `handle.4`–`7` the top, right, bottom and left
-    /// edges) and anchor point (`anchor`).
-    fn point_text(&mut self) -> (u64, String) {
-        let r = self.exec("graphics.newText", json!({"text": "Title", "position": [600, 500], "size": 120}));
-        let clip = r["clip"].as_u64().unwrap();
-        (clip, self.select(clip))
-    }
-
-    fn paragraph_text(&mut self) -> (u64, String) {
-        let r = self.exec("graphics.newText", json!({"text": FOX, "position": [500, 300], "box": [700, 500], "size": 80}));
-        let clip = r["clip"].as_u64().unwrap();
-        (clip, self.select(clip))
-    }
-
-    fn shape(&mut self) -> String {
-        let r = self.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [500, 300]}));
-        let clip = r["clip"].as_u64().unwrap();
-        self.select(clip)
-    }
-
-    /// Centre of element `pre` + `what` ("handle.2", "anchor").
-    fn at(&mut self, pre: &str, what: &str) -> (f64, f64) {
-        let r = self.rect(&format!("{pre}{what}"));
-        (r[0] + r[2] / 2.0, r[1] + r[3] / 2.0)
-    }
-
-    fn handle(&mut self, pre: &str, n: usize) -> (f64, f64) {
-        self.at(pre, &format!("handle.{n}"))
-    }
-
-    fn drag(&mut self, from: (f64, f64), by: (f64, f64)) {
-        // Control gestures use explicit modifiers and isolate ambient native keyboard state.
-        let m = self.harness.ctx.input(|input| input.modifiers);
-        self.ok(
-            "ui.drag",
-            json!({"from": {"x": from.0, "y": from.1}, "to": {"x": from.0 + by.0, "y": from.1 + by.1}, "steps": 6,
-            "modifiers": {"shift":m.shift,"alt":m.alt,"ctrl":m.ctrl,"command":m.command}}),
-        );
-        self.frames(4);
-    }
-
-    fn hover(&mut self, at: (f64, f64)) {
-        self.harness.input_mut().events.push(egui::Event::PointerMoved(egui::pos2(at.0 as f32, at.1 as f32)));
-        self.frames(2);
-    }
-
-    fn cursor(&self) -> egui::CursorIcon {
-        self.harness.output().platform_output.cursor_icon
-    }
-
-    /// Press or let go of Shift as a keyboard reports it. The drag fixture then explicitly
-    /// forwards the held modifiers to the control gesture.
-    fn hold_shift(&mut self, on: bool) {
-        let m = if on { egui::Modifiers::SHIFT } else { egui::Modifiers::NONE };
-        self.harness.input_mut().events.push(egui::Event::ModifiersChanged(m));
-        self.frames(1);
-    }
-
-    fn drag_handle(&mut self, pre: &str, n: usize, dx: f64, dy: f64) {
-        let h = self.handle(pre, n);
-        self.drag(h, (dx, dy));
-    }
-
-    fn layer(&mut self, clip: u64) -> Value {
-        self.exec("graphics.list", json!({"clip": clip}))["layers"][0].clone()
-    }
-}
-
-const FOX: &str = "The quick brown fox jumps over the lazy dog";
-
-fn near(a: (f64, f64), b: (f64, f64)) -> bool {
-    (a.0 - b.0).abs() < 1.5 && (a.1 - b.1).abs() < 1.5
-}
-
-fn num(v: &Value) -> f64 {
-    v.as_f64().unwrap_or_else(|| panic!("not a number: {v}"))
-}
-
-#[test]
-fn point_text_handles_scale_it_about_its_anchor() {
-    let mut d = Driver::new();
-    let (clip, pre) = d.point_text();
-    let before = d.layer(clip);
-    assert_eq!(before["textType"], "point");
-    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
-    assert!(
-        (anchor.0 - tl.0).abs() < 1.5 && anchor.1 > tl.1 && anchor.1 < br.1,
-        "the anchor is on the first baseline's left end: {anchor:?} in {tl:?}..{br:?}"
-    );
-
-    // a corner dragged down: the text grows, both axes alike, and the anchor does not move
-    d.drag_handle(&pre, 2, 0.0, 40.0);
-    let after = d.layer(clip);
-    let f = num(&after["scale"]) / 100.0;
-    assert!(f > 1.2, "bigger: {f}");
-    assert_eq!(after["scale"], after["scaleWidth"], "uniform");
-    assert_eq!(after["position"], before["position"]);
-    assert_eq!(after["anchor"], before["anchor"]);
-    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor stays put");
-    d.shot("point-text-scaled");
-    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    for (was, now) in [(tl, tl2), (br, br2)] {
-        let want = (anchor.0 + (was.0 - anchor.0) * f, anchor.1 + (was.1 - anchor.1) * f);
-        assert!(near(now, want), "every corner moves away from the anchor by the scale: {was:?} -> {now:?}, expected {want:?}");
-    }
-    // the handle is nearer than 60 points to the anchor, so it scales as if 60 points further away
-    let reach = (br.1 - anchor.1) + 60.0;
-    assert!((f - (1.0 + 40.0 / reach)).abs() < 0.02, "scale {f} for 40 points with the handle {} from the anchor", br.1 - anchor.1);
-
-    // sideways travel of a corner does nothing
-    d.drag_handle(&pre, 2, 80.0, 0.0);
-    assert!((num(&d.layer(clip)["scale"]) / 100.0 - f).abs() < 0.01);
-
-    // an edge handle scales the whole text too: the right edge follows the pointer, since it is
-    // further than 60 points from the anchor
-    let (right, top) = (d.handle(&pre, 5), d.handle(&pre, 4));
-    d.drag_handle(&pre, 5, 50.0, 0.0);
-    let l = d.layer(clip);
-    assert_eq!(l["scale"], l["scaleWidth"], "still uniform");
-    let (right2, top2) = (d.handle(&pre, 5), d.handle(&pre, 4));
-    assert!((right2.0 - right.0 - 50.0).abs() < 2.0, "right edge follows the pointer: {right:?} -> {right2:?}");
-    assert!(top2.1 < top.1 - 2.0, "and the text got taller with it: {top:?} -> {top2:?}");
-    assert!(near(d.at(&pre, "anchor"), anchor));
-
-    // towards the anchor shrinks; one undo step per drag
-    let s = num(&l["scale"]);
-    d.drag_handle(&pre, 4, 0.0, 30.0);
-    assert!(num(&d.layer(clip)["scale"]) < s - 5.0);
-    d.exec("edit.undo", json!({}));
-    assert_eq!(num(&d.layer(clip)["scale"]), s);
-}
-
-#[test]
-fn the_anchor_point_can_be_dragged_without_moving_the_layer() {
-    let mut d = Driver::new();
-    let (clip, pre) = d.point_text();
-    d.exec("graphics.set", json!({"clip": clip, "props": {"scale": 200, "scale_width": 200}}));
-    d.frames(4);
-    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
-    let before = d.layer(clip);
-    d.drag(anchor, (90.0, -40.0));
-    let after = d.layer(clip);
-    assert!(near(d.at(&pre, "anchor"), (anchor.0 + 90.0, anchor.1 - 40.0)), "the anchor follows the pointer");
-    assert!(near(d.handle(&pre, 0), tl) && near(d.handle(&pre, 2), br), "the layer stays where it is");
-    // the position moves with the anchor; the anchor moves half as far in the layer's own pixels (scale 200)
-    let (dp, da) = (num(&after["position"][0]) - num(&before["position"][0]), num(&after["anchor"][0]) - num(&before["anchor"][0]));
-    assert!(dp > 10.0 && (da - dp / 2.0).abs() < 0.01, "position {dp}, anchor {da}");
-    assert_eq!(after["scale"], before["scale"]);
-
-    // now a handle scales about the moved anchor
-    d.drag_handle(&pre, 2, 0.0, 30.0);
-    assert!(near(d.at(&pre, "anchor"), (anchor.0 + 90.0, anchor.1 - 40.0)));
-    assert!(num(&d.layer(clip)["scale"]) > 201.0);
-}
-
-#[test]
-fn paragraph_text_handles_resize_the_box_and_the_text_reflows() {
-    let mut d = Driver::new();
-    let (clip, pre) = d.paragraph_text();
-    let before = d.layer(clip);
-    assert_eq!(before["textType"], "paragraph");
-    assert_eq!(before["overflow"], false, "{before}");
-    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
-    assert!(near(anchor, tl), "the anchor is on the box's top-left corner: {anchor:?} vs {tl:?}");
-    let k = (br.0 - tl.0) / 700.0; // screen points per canvas pixel
-
-    // bottom-right corner: it follows the pointer on both axes, the top-left stays, nothing scales
-    let (dx, dy) = (-70.0 * k, 50.0 * k);
-    d.drag_handle(&pre, 2, dx, dy);
-    let after = d.layer(clip);
-    assert!(near(d.handle(&pre, 0), tl));
-    assert!(near(d.handle(&pre, 2), (br.0 + dx, br.1 + dy)), "the corner follows the pointer");
-    assert!((num(&after["box"][0]) - 630.0).abs() < 1.0 && (num(&after["box"][1]) - 550.0).abs() < 1.0, "{}", after["box"]);
-    assert_eq!(after["overflow"], false);
-    assert_eq!(after["scale"], 100.0);
-    assert_eq!(after["position"], before["position"]);
-    assert_eq!(after["anchor"], before["anchor"]);
-
-    // a box too low for its text hides the rest (and says so); the font size is untouched
-    d.drag_handle(&pre, 6, 0.0, -400.0 * k);
-    let low = d.layer(clip);
-    assert_eq!(low["overflow"], true, "{low}");
-    d.shot("paragraph-text-overflow");
-    assert_eq!(low["scale"], 100.0);
-    d.exec("edit.undo", json!({}));
-    assert_eq!(d.layer(clip)["overflow"], false);
-
-    // the left edge: it follows the pointer, the right edge stays; the anchor stays on its spot
-    // of the picture (now outside the box) and the position is untouched
-    let (right, left) = (d.handle(&pre, 5), d.handle(&pre, 7));
-    d.drag_handle(&pre, 7, 60.0 * k, 0.0);
-    let moved = d.layer(clip);
-    assert!(near(d.handle(&pre, 5), right));
-    assert!(near(d.handle(&pre, 7), (left.0 + 60.0 * k, left.1)));
-    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor stays put");
-    assert_eq!(moved["position"], before["position"]);
-    assert!((num(&moved["anchor"][0]) + 60.0).abs() < 1.0 && num(&moved["anchor"][1]).abs() < 1e-6, "{}", moved["anchor"]);
-    assert!((num(&moved["box"][0]) - 570.0).abs() < 1.0, "{}", moved["box"]);
-    d.shot("paragraph-text-left-edge-moved");
-
-    // a side dragged past its opposite stops at a small box instead of flipping
-    d.drag_handle(&pre, 5, -900.0, 0.0);
-    let w = num(&d.layer(clip)["box"][0]);
-    assert!((w - 40.0).abs() < 0.5, "half the font size: {w}");
-}
-
-#[test]
-fn type_tool_drag_makes_paragraph_text_and_a_click_point_text() {
-    let mut d = Driver::new();
-    d.ok("ui.set", json!({"tool": "Type"}));
-    d.frames(3);
-    let pic = d.rect("program.picture");
-    let at = |fx: f64, fy: f64| (pic[0] + pic[2] * fx, pic[1] + pic[3] * fy);
-    let (a, b) = (at(0.2, 0.5), at(0.6, 0.8));
-    d.drag(a, (b.0 - a.0, b.1 - a.1));
-    d.ok("ui.type", json!({"text": FOX}));
-    let list = d.exec("graphics.list", json!({}));
-    let clip = list["clip"].as_u64().unwrap();
-    let l = &list["layers"][0];
-    assert_eq!(l["text"], FOX);
-    assert_eq!(l["textType"], "paragraph");
-    let canvas = (num(&list["canvas"][0]), num(&list["canvas"][1]));
-    assert!(
-        (num(&l["box"][0]) - canvas.0 * 0.4).abs() < 2.0 && (num(&l["box"][1]) - canvas.1 * 0.3).abs() < 2.0,
-        "the box is the dragged rectangle: {}",
-        l["box"]
-    );
-    assert!((num(&l["quad"][0][0]) - canvas.0 * 0.2).abs() < 2.0 && (num(&l["quad"][0][1]) - canvas.1 * 0.5).abs() < 2.0, "{}", l["quad"]);
-    assert_eq!(l["scale"], 100.0);
-    // the text being typed is the box
-    d.shot("paragraph-text-typing");
-    let edit = d.rect("program.textEdit");
-    assert!((edit[2] - (b.0 - a.0)).abs() < 3.0, "{edit:?}");
-
-    // a click makes point text, in the same graphic
-    d.ok("ui.key", json!({"key": "Escape"}));
-    let c = at(0.3, 0.2);
-    d.ok("ui.click", json!({"x": c.0, "y": c.1}));
-    d.ok("ui.type", json!({"text": "Title"}));
-    let list = d.exec("graphics.list", json!({"clip": clip}));
-    assert_eq!(list["layers"][1]["textType"], "point");
-    assert_eq!(list["layers"][1]["box"], json!(null));
-}
-
-/// Chinese, Japanese and Korean input methods hand over the finished text as `Ime(Commit)`, not
-/// `Text`; it is typed into the text being edited on the monitor (#1083).
-#[test]
-fn text_committed_by_an_input_method_is_typed_on_the_monitor() {
-    let mut d = Driver::new();
-    d.ok("ui.set", json!({"tool": "Type"}));
-    d.frames(3);
-    let pic = d.rect("program.picture");
-    d.ok("ui.click", json!({"x": pic[0] + pic[2] * 0.3, "y": pic[1] + pic[3] * 0.2}));
-    d.ok("ui.type", json!({"text": "A"}));
-    // the events Microsoft Pinyin sends for "ni hao" picked as 你好
-    let preedit = |text: &str| egui::Event::Ime(egui::ImeEvent::Preedit { text: text.into(), active_range_chars: None });
-    d.harness.input_mut().events.extend([preedit("ni hao"), preedit(""), egui::Event::Ime(egui::ImeEvent::Commit("你好".into()))]);
-    d.frames(4);
-    let list = d.exec("graphics.list", json!({}));
-    assert_eq!(list["layers"][0]["text"], "A你好");
-}
-
-#[test]
-fn text_properties_switches_between_point_and_paragraph_text() {
-    let mut d = Driver::new();
-    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
-    let (clip, pre) = d.paragraph_text();
-    let tl = d.handle(&pre, 0);
-    d.ok("ui.click", json!({"id": "graphics.textProperties"}));
-    d.frames(3);
-    d.ok("ui.click", json!({"id": "graphics.textProperties.type"}));
-    d.frames(3);
-    d.shot("text-properties-type-list");
-    d.ok("ui.click", json!({"id": "graphics.textProperties.type.point"}));
-    d.frames(3);
-    assert_eq!(d.layer(clip)["textType"], "paragraph", "nothing happens before OK");
-    d.shot("text-properties-dialog");
-    d.ok("ui.click", json!({"id": "graphics.textProperties.ok"}));
-    d.frames(4);
-    let l = d.layer(clip);
-    assert_eq!(l["textType"], "point");
-    assert!(l["text"].as_str().unwrap().contains('\n'), "the wrapped lines are real lines now: {}", l["text"]);
-    assert!(near(d.at(&pre, "anchor"), tl), "the anchor stays where the box's corner was");
-    assert!(d.ok("ui.elements", json!({"prefix": "graphics.textProperties.ok"})).as_array().unwrap().is_empty(), "the dialog closed");
-    // its handles scale it now
-    d.drag_handle(&pre, 2, 0.0, 40.0);
-    assert!(num(&d.layer(clip)["scale"]) > 101.0);
-
-    // Cancel changes nothing
-    d.ok("ui.click", json!({"id": "graphics.textProperties"}));
-    d.frames(3);
-    d.ok("ui.click", json!({"id": "graphics.textProperties.type"}));
-    d.frames(3);
-    d.ok("ui.click", json!({"id": "graphics.textProperties.type.paragraph"}));
-    d.frames(3);
-    d.ok("ui.click", json!({"id": "graphics.textProperties.cancel"}));
-    d.frames(3);
-    assert_eq!(d.layer(clip)["textType"], "point");
-}
-
-#[test]
-fn shape_corner_handles_scale_away_from_the_opposite_corner() {
-    let mut d = Driver::new();
-    let pre = d.shape();
-    // bottom-right: grows down and to the right, the top-left stays
-    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    d.drag_handle(&pre, 2, 60.0, 30.0);
-    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    assert!(near(tl, tl2), "top-left stays put: {tl:?} -> {tl2:?}");
-    assert!(br2.0 > br.0 + 20.0 && br2.1 > br.1 + 5.0, "bottom-right follows the pointer: {br:?} -> {br2:?}");
-    // bottom-left: grows down and to the left, the top-right stays
-    let (tr, bl) = (d.handle(&pre, 1), d.handle(&pre, 3));
-    d.drag_handle(&pre, 3, -60.0, 30.0);
-    let (tr2, bl2) = (d.handle(&pre, 1), d.handle(&pre, 3));
-    assert!(near(tr, tr2), "top-right stays put: {tr:?} -> {tr2:?}");
-    assert!(bl2.0 < bl.0 - 20.0 && bl2.1 > bl.1 + 5.0, "bottom-left follows the pointer: {bl:?} -> {bl2:?}");
-}
-
-#[test]
-fn graphic_resize_handles_show_their_screen_space_direction() {
-    let mut d = Driver::new();
-    let r = d.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [500, 300]}));
-    let clip = r["clip"].as_u64().unwrap();
-    let pre = d.select(clip);
-
-    for (handle, expected) in [
-        (0, egui::CursorIcon::ResizeNwSe),
-        (1, egui::CursorIcon::ResizeNeSw),
-        (2, egui::CursorIcon::ResizeNwSe),
-        (3, egui::CursorIcon::ResizeNeSw),
-        (4, egui::CursorIcon::ResizeVertical),
-        (5, egui::CursorIcon::ResizeHorizontal),
-        (6, egui::CursorIcon::ResizeVertical),
-        (7, egui::CursorIcon::ResizeHorizontal),
-    ] {
-        let at = d.handle(&pre, handle);
-        d.hover(at);
-        assert_eq!(d.cursor(), expected, "handle {handle}");
-    }
-
-    d.exec("graphics.set", json!({"clip": clip, "props": {"rotation": 45}}));
-    d.frames(4);
-    let at = d.handle(&pre, 4);
-    d.hover(at);
-    assert!(
-        matches!(d.cursor(), egui::CursorIcon::ResizeNeSw | egui::CursorIcon::ResizeNwSe),
-        "rotated edge handle should use a diagonal cursor, got {:?}",
-        d.cursor()
-    );
-}
-
-/// Width and height of a layer's box in its own pixels.
-fn box_size(l: &Value) -> (f64, f64) {
-    let b = &l["localBounds"];
-    (num(&b[2]) - num(&b[0]), num(&b[3]) - num(&b[1]))
-}
-
-#[test]
-fn shape_handles_change_its_size_and_shift_keeps_the_ratio() {
-    let mut d = Driver::new();
-    let pre = d.shape();
-    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
-    // a corner straight right: only wider, as in Premiere; the Size changes, not the Scale
-    let (tl, br, anchor) = (d.handle(&pre, 0), d.handle(&pre, 2), d.at(&pre, "anchor"));
-    let before = d.layer(clip);
-    d.drag_handle(&pre, 2, 60.0, 0.0);
-    let l = d.layer(clip);
-    assert_eq!((num(&l["scale"]), num(&l["scaleWidth"])), (100.0, 100.0), "{l}");
-    let (w, h) = box_size(&l);
-    assert!(w > 510.0 && (h - 300.0).abs() < 1e-3, "wider, as tall: {w} x {h}");
-    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    assert!(near(tl, tl2), "top-left stays put: {tl:?} -> {tl2:?}");
-    assert!(near(br2, (br.0 + 60.0, br.1)), "bottom-right follows the pointer: {br:?} -> {br2:?}");
-    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor point stays put");
-    assert_eq!(l["position"], before["position"]);
-
-    // with Shift both sides grow alike from the opposite corner
-    d.hold_shift(true);
-    d.drag_handle(&pre, 2, 40.0, 0.0);
-    d.hold_shift(false);
-    let l2 = d.layer(clip);
-    let (w2, h2) = box_size(&l2);
-    assert!(h2 > 310.0, "taller too: {w2} x {h2}");
-    assert!((w2 / h2 - w / h).abs() < 1e-3, "same proportions: {w}x{h} -> {w2}x{h2}");
-    assert!(near(d.handle(&pre, 0), tl), "top-left still stays put");
-    assert_eq!(num(&l2["scale"]), 100.0);
-    // one undo step per drag
-    d.exec("edit.undo", json!({}));
-    assert_eq!(box_size(&d.layer(clip)), (w, h));
-}
-
-#[test]
-fn polygon_handles_keep_the_opposite_corner() {
-    let mut d = Driver::new();
-    let r = d.exec("graphics.newPolygon", json!({"sides": 5, "position": [800, 500], "size": [300, 300]}));
-    let pre = d.select(r["clip"].as_u64().unwrap());
-    // a pentagon's box is not centred on the shape's origin; the top-left corner stays anyway
-    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    d.drag_handle(&pre, 2, 50.0, 40.0);
-    assert!(near(d.handle(&pre, 0), tl), "top-left stays put");
-    assert!(near(d.handle(&pre, 2), (br.0 + 50.0, br.1 + 40.0)), "bottom-right follows the pointer");
-}
-
-/// The Corner Radius of the shape layer of graphic clip `clip`.
-fn corner_radius(d: &mut Driver, clip: u64) -> f64 {
-    let s = &d.harness.state().session;
-    let (_, it) = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap();
-    let e = it.effects.iter().find(|e| e.effect == "graphic_shape").unwrap();
-    e.param("corner_radius").unwrap().value_at(filmcraft_time::Tick::ZERO).as_f64().unwrap()
-}
-
-#[test]
-fn a_rectangles_corner_circles_round_all_its_corners() {
-    let mut d = Driver::new();
-    let pre = d.shape();
-    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
-    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    let k = (br.0 - tl.0) / 500.0; // screen points per layer pixel
-    let corners: Vec<(f64, f64)> = (0..4).map(|n| d.at(&pre, &format!("corner.{n}"))).collect();
-    // just inside each corner, on its diagonal
-    assert!(corners[0].0 > tl.0 + 5.0 && corners[0].1 > tl.1 + 5.0 && corners[2].0 < br.0 - 5.0 && corners[2].1 < br.1 - 5.0, "{corners:?}");
-
-    // the top-left circle dragged 40 points down and right: a radius of 40 points' travel
-    d.drag(corners[0], (40.0, 40.0));
-    let r = corner_radius(&mut d, clip);
-    assert!((r - 40.0 / k).abs() < 2.0, "radius {r}, expected {}", 40.0 / k);
-    // the circles moved in to the radius, all four alike
-    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    assert!(near(tl, tl2) && near(br, br2), "the box stays");
-    let c0 = d.at(&pre, "corner.0");
-    let c2 = d.at(&pre, "corner.2");
-    assert!(near(c0, (tl.0 + r * k, tl.1 + r * k)) && near(c2, (br.0 - r * k, br.1 - r * k)), "{c0:?} {c2:?}");
-
-    // any circle drags all four; past the middle it stops at half the shorter side
-    d.drag(c2, (-300.0, -300.0));
-    assert_eq!(corner_radius(&mut d, clip), 150.0);
-    // back out squares them; one undo step per drag
-    let c1 = d.at(&pre, "corner.1");
-    d.drag(c1, (200.0, -200.0));
-    assert_eq!(corner_radius(&mut d, clip), 0.0);
-    d.exec("edit.undo", json!({}));
-    assert_eq!(corner_radius(&mut d, clip), 150.0);
-}
-
-#[test]
-fn only_rectangles_big_enough_get_corner_circles() {
-    let mut d = Driver::new();
-    let r = d.exec("graphics.newShape", json!({"shape": "ellipse", "position": [800, 500], "size": [500, 300]}));
-    let pre = d.select(r["clip"].as_u64().unwrap());
-    assert!(d.ok("ui.elements", json!({"prefix": format!("{pre}corner")})).as_array().unwrap().is_empty(), "an ellipse has none");
-    let r = d.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [20, 20]}));
-    let pre = d.select(r["clip"].as_u64().unwrap());
-    assert!(d.ok("ui.elements", json!({"prefix": format!("{pre}corner")})).as_array().unwrap().is_empty(), "a tiny rectangle has none");
-}
-
-#[test]
-fn shape_edge_handles_stretch_one_axis() {
-    let mut d = Driver::new();
-    let pre = d.shape();
-    // bottom edge: taller downwards, the top edge and the width stay
-    let (tl, tr, bottom) = (d.handle(&pre, 0), d.handle(&pre, 1), d.handle(&pre, 6));
-    d.drag_handle(&pre, 6, 0.0, 40.0);
-    let (tl2, tr2, bottom2) = (d.handle(&pre, 0), d.handle(&pre, 1), d.handle(&pre, 6));
-    assert!(near(tl, tl2) && near(tr, tr2), "top edge stays put: {tl:?} {tr:?} -> {tl2:?} {tr2:?}");
-    assert!((bottom2.1 - bottom.1 - 40.0).abs() < 2.0 && (bottom2.0 - bottom.0).abs() < 1.5, "bottom follows the pointer: {bottom:?} -> {bottom2:?}");
-    // right edge: wider to the right, the left edge and the height stay
-    let (tl, bl, right) = (d.handle(&pre, 0), d.handle(&pre, 3), d.handle(&pre, 5));
-    d.drag_handle(&pre, 5, 50.0, 0.0);
-    let (tl2, bl2, right2) = (d.handle(&pre, 0), d.handle(&pre, 3), d.handle(&pre, 5));
-    assert!(near(tl, tl2) && near(bl, bl2), "left edge stays put: {tl:?} {bl:?} -> {tl2:?} {bl2:?}");
-    assert!((right2.0 - right.0 - 50.0).abs() < 2.0 && (right2.1 - right.1).abs() < 1.5, "right follows the pointer: {right:?} -> {right2:?}");
-    // top edge: taller upwards, the bottom edge stays
-    let (bl, top) = (d.handle(&pre, 3), d.handle(&pre, 4));
-    d.drag_handle(&pre, 4, 0.0, -30.0);
-    let (bl2, top2) = (d.handle(&pre, 3), d.handle(&pre, 4));
-    assert!(near(bl, bl2), "bottom edge stays put: {bl:?} -> {bl2:?}");
-    assert!((top2.1 - top.1 + 30.0).abs() < 2.0, "top follows the pointer: {top:?} -> {top2:?}");
-}
-
-#[test]
-fn a_hidden_layer_has_no_box_and_cannot_be_clicked() {
-    let mut d = Driver::new();
-    let pre = d.shape();
-    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
-    let layer = format!("program.layer.{clip}.0");
-    let ids = |d: &mut Driver| -> Vec<String> {
-        let v = d.ok("ui.elements", json!({"prefix": layer}));
-        v.as_array().unwrap().iter().map(|e| e["id"].as_str().unwrap().to_string()).collect()
-    };
-    assert_eq!(ids(&mut d).len(), 14, "the layer, its eight handles, four corner circles and its anchor: {:?}", ids(&mut d));
-    let r = d.rect(&layer);
-    let inside = (r[0] + r[2] / 4.0, r[1] + r[3] / 2.0);
-
-    // visibility off: still selected in the panel, but nothing of it is on the monitor
-    d.exec("graphics.set", json!({"clip": clip, "props": {"enabled": false}}));
-    d.frames(4);
-    assert_eq!(ids(&mut d), Vec::<String>::new());
-    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": []}));
-    d.ok("ui.click", json!({"x": inside.0, "y": inside.1}));
-    d.frames(4);
-
-    // visibility on: the click where it was selected nothing, so it has no handles; now it can be clicked
-    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"enabled": true}}));
-    d.frames(4);
-    assert_eq!(ids(&mut d), vec![layer.clone()], "not selected: no handles");
-    // (elsewhere on it, so that the two clicks are not a double click)
-    d.ok("ui.click", json!({"x": r[0] + r[2] * 0.75, "y": inside.1}));
-    d.frames(4);
-    assert_eq!(ids(&mut d).len(), 14);
-}
-
-/// A double-click on a text layer edits it with all its text selected, so typing replaces it; while
-/// it is edited, Select All selects the text again, not the timeline clips, as in Premiere (#1102).
-#[test]
-fn double_click_and_select_all_select_the_text_being_edited() {
-    let mut d = Driver::new();
-    let (clip, pre) = d.point_text();
-    let (a, b) = (d.handle(&pre, 0), d.handle(&pre, 2));
-    d.ok("ui.click", json!({"x": (a.0 + b.0) / 2.0, "y": (a.1 + b.1) / 2.0, "count": 2}));
-    d.frames(4);
-    let edit = |d: &Driver| d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.clip, e.layer, e.anchor, e.caret));
-    assert_eq!(edit(&d), Some((clip, 0, 0, "Title".len())), "the double-click selects the whole text");
-
-    // caret at the end, then Select All as the native macOS menu sends it (it takes Cmd+A first)
-    if let Some(e) = d.harness.state_mut().ui.gfx_edit.as_mut() {
-        (e.anchor, e.caret) = (5, 5);
-    }
-    let selection = d.harness.state().session.state.selection.clone();
-    let (tx, rx) = channel();
-    d.harness.state_mut().command_inbox = Some(rx);
-    tx.send("edit.selectAll".to_string()).unwrap();
-    d.frames(2);
-    assert_eq!(edit(&d), Some((clip, 0, 0, 5)), "Select All selects the text being edited");
-    assert_eq!(d.harness.state().session.state.selection, selection, "and leaves the timeline selection alone");
-}
diff --git a/crates/ui-egui/tests/graphics_ui.rs b/crates/ui-egui/tests/graphics_ui.rs
deleted file mode 100644
index c7aa5138e..000000000
--- a/crates/ui-egui/tests/graphics_ui.rs
+++ /dev/null
@@ -1,232 +0,0 @@
-//! Graphics UI, driven headless through the control channel (like `scripted.rs`): the Type tool
-//! creates a text layer on the Program monitor, typing and keys edit it, the Properties panel's
-//! controls style it, the Selection tool moves it.
-//!
-//! With `FILMCRAFT_UI_SHOTS=<dir>` the test also renders the UI with wgpu (works without a
-//! window or an unlocked screen) and writes PNGs there for review.
-
-use std::sync::mpsc::{Sender, channel};
-
-use egui_kittest::Harness;
-use filmcraft_engine::Session;
-use filmcraft_ui_egui::FilmcraftApp;
-use filmcraft_ui_egui::control::ControlRequest;
-use serde_json::{Value, json};
-
-struct Driver {
-    harness: Harness<'static, FilmcraftApp>,
-    tx: Sender<ControlRequest>,
-    shots: Option<std::path::PathBuf>,
-}
-
-impl Driver {
-    fn demo() -> Self {
-        let mut session = Session::default();
-        session.execute("file.openDemoProject", json!({})).expect("demo project");
-        let (tx, rx) = channel();
-        let app = FilmcraftApp::new(session).with_control(rx);
-        let shots = std::env::var_os("FILMCRAFT_UI_SHOTS").map(std::path::PathBuf::from);
-        let mut b = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000);
-        if shots.is_some() {
-            b = b.wgpu().with_pixels_per_point(1.0);
-        }
-        let harness = b.build_eframe(move |_cc| app);
-        let mut d = Driver { harness, tx, shots };
-        d.frames(4);
-        d
-    }
-    fn frames(&mut self, n: usize) {
-        for _ in 0..n {
-            let ctx = self.harness.ctx.clone();
-            let mut raw = std::mem::take(self.harness.input_mut());
-            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
-            *self.harness.input_mut() = raw;
-            self.harness.step();
-        }
-    }
-    fn call(&mut self, method: &str, params: Value) -> Value {
-        let (req, reply) = ControlRequest::new(method, params.clone());
-        self.tx.send(req).unwrap();
-        for _ in 0..600 {
-            self.frames(1);
-            if let Ok(v) = reply.try_recv() {
-                return v;
-            }
-        }
-        panic!("no reply to {method} {params}");
-    }
-    fn ok(&mut self, method: &str, params: Value) -> Value {
-        let r = self.call(method, params.clone());
-        assert_eq!(r["ok"], true, "{method} {params}: {r}");
-        r["result"].clone()
-    }
-    fn exec(&mut self, command: &str, params: Value) -> Value {
-        self.ok("engine.execute", json!({"command": command, "params": params}))
-    }
-    fn rect(&mut self, id: &str) -> [f64; 4] {
-        let v = self.ok("ui.elements", json!({"prefix": id}));
-        let e = v.as_array().unwrap().iter().find(|e| e["id"] == id).unwrap_or_else(|| panic!("no element {id}: {v}")).clone();
-        let r: Vec<f64> = e["rect"].as_array().unwrap().iter().map(|x| x.as_f64().unwrap()).collect();
-        [r[0], r[1], r[2], r[3]]
-    }
-    fn shot(&mut self, name: &str) {
-        let Some(dir) = self.shots.clone() else { return };
-        self.frames(8);
-        let img = self.harness.render().expect("wgpu render");
-        std::fs::create_dir_all(&dir).unwrap();
-        img.save(dir.join(format!("{name}.png"))).unwrap();
-    }
-}
-
-#[test]
-fn type_tool_edit_style_and_move() {
-    let mut d = Driver::demo();
-    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
-    d.exec("playhead.set", json!({"seconds": 2}));
-    d.ok("ui.set", json!({"tool": "Type"}));
-    d.frames(3);
-    let pic = d.rect("program.picture");
-    let (px, py) = (pic[0] + pic[2] * 0.2, pic[1] + pic[3] * 0.35);
-    d.ok("ui.click", json!({"x": px, "y": py}));
-    d.ok("ui.type", json!({"text": "Night Drive"}));
-    d.ok("ui.key", json!({"key": "Enter"}));
-    d.ok("ui.type", json!({"text": "through the city"}));
-    let list = d.exec("graphics.list", json!({}));
-    assert_eq!(list["layers"][0]["text"], "Night Drive\nthrough the city", "{list}");
-    // caret editing: Backspace ×4, select the word "Drive" with Shift+arrows… then retype
-    for _ in 0..4 {
-        d.ok("ui.key", json!({"key": "Backspace"}));
-    }
-    d.ok("ui.type", json!({"text": "town"}));
-    d.ok("ui.key", json!({"key": "ArrowUp"}));
-    d.ok("ui.key", json!({"key": "End"}));
-    for _ in 0..5 {
-        d.ok("ui.key", json!({"key": "Shift+ArrowLeft"}));
-    }
-    d.ok("ui.type", json!({"text": "Ride"}));
-    let list = d.exec("graphics.list", json!({}));
-    assert_eq!(list["layers"][0]["text"], "Night Ride\nthrough the town", "{list}");
-    // one undo step for the whole typing session (after "New Graphic")
-    let hist = d.exec("history.list", json!({}));
-    let undo: Vec<&str> = hist["undo"].as_array().unwrap().iter().filter_map(Value::as_str).collect();
-    assert_eq!(&undo[undo.len() - 2..], ["New Graphic", "Edit Text"], "{undo:?}");
-    d.shot("type-tool-editing");
-
-    // style through the Properties panel controls
-    d.ok("ui.key", json!({"key": "Escape"}));
-    d.ok("ui.set", json!({"tool": "Selection"}));
-    d.ok("ui.click", json!({"id": "graphics.prop.faux_bold"}));
-    d.ok("ui.click", json!({"id": "graphics.prop.align.1"}));
-    d.ok("ui.click", json!({"id": "graphics.prop.stroke"}));
-    d.ok("ui.click", json!({"id": "graphics.prop.shadow"}));
-    let clip = list["clip"].as_u64().unwrap();
-    d.exec("graphics.set", json!({"clip": clip, "props": {"font_style": "Bold", "fill_color": "#ffd23f", "size": 120}}));
-    let seq = d.exec("sequence.inspect", json!({}));
-    let s = seq.to_string();
-    assert!(s.contains("graphic_text"), "graphic layer in the sequence");
-    let list2 = d.exec("graphics.list", json!({"clip": clip}));
-    let q0 = list2["layers"][0]["quad"][0][0].as_f64().unwrap();
-    // selection-tool drag moves the layer
-    let lr = d.rect(&format!("program.layer.{clip}.0"));
-    let pic = d.rect("program.picture");
-    // a point on the layer that is inside the picture
-    let x0 = lr[0].max(pic[0]);
-    let x1 = (lr[0] + lr[2]).min(pic[0] + pic[2]);
-    let (cx, cy) = ((x0 + x1) / 2.0, lr[1] + lr[3] * 0.3);
-    let from = json!({"x": cx, "y": cy});
-    let to = json!({"x": cx + 60.0, "y": cy + 20.0});
-    d.ok("ui.drag", json!({"from": from, "to": to, "steps": 6}));
-    let list3 = d.exec("graphics.list", json!({"clip": clip}));
-    let q1 = list3["layers"][0]["quad"][0][0].as_f64().unwrap();
-    assert!(q1 > q0 + 20.0, "moved right: {q0} → {q1}");
-    d.shot("properties-styled");
-
-    // shapes: rectangle tool drag
-    d.ok("ui.set", json!({"tool": "Rectangle"}));
-    let pic = d.rect("program.picture");
-    d.ok("ui.drag", json!({"from": {"x": pic[0] + pic[2] * 0.15, "y": pic[1] + pic[3] * 0.75}, "to": {"x": pic[0] + pic[2] * 0.85, "y": pic[1] + pic[3] * 0.9}, "steps": 5}));
-    let list4 = d.exec("graphics.list", json!({"clip": clip}));
-    assert_eq!(list4["layers"].as_array().unwrap().len(), 2, "{list4}");
-    assert_eq!(list4["layers"][1]["kind"], "Rectangle");
-    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 1, "to": "back"}));
-    d.ok("ui.set", json!({"tool": "Selection"}));
-    d.shot("shape-layer");
-}
-
-/// The value of `param` on the text layer of graphic clip `clip`, at its first frame.
-fn text_param(d: &mut Driver, clip: u64, param: &str) -> Option<filmcraft_project::ParamValue> {
-    let s = &d.harness.state().session;
-    let (_, it) = s.active_sequence()?.find_item(filmcraft_project::ClipId(clip))?;
-    let e = it.effects.iter().find(|e| e.effect == "graphic_text")?;
-    Some(e.param(param)?.value_at(filmcraft_time::Tick::ZERO))
-}
-
-/// A drag of a property in the Properties panel is one undo step, so one Cmd+Z restores the
-/// original value (a drag was committing one undo step per frame, so undo only stepped back one
-/// frame's worth; the shadow color picker showed it as "sometimes undo works, sometimes not").
-#[test]
-fn a_property_drag_is_one_undo_step() {
-    let mut d = Driver::demo();
-    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
-    let r = d.exec("graphics.newText", json!({"text": "Title"}));
-    let clip = r["clip"].as_u64().unwrap();
-    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
-    d.frames(4);
-    // the layer's Opacity number (visible in the Align and Transform section)
-    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"opacity": 50}}));
-    d.frames(2);
-    let opacity = |d: &mut Driver| -> f64 { text_param(d, clip, "opacity").and_then(|v| v.as_f64()).unwrap() };
-    let before = opacity(&mut d);
-    let undo0 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
-    // drag the Opacity number to the left: several move frames, one undo step
-    let n = d.rect("graphics.prop.opacity");
-    let (cx, cy) = (n[0] + n[2] / 2.0, n[1] + n[3] / 2.0);
-    d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx - 60.0, "y": cy}, "steps": 6}));
-    d.frames(4);
-    let after = opacity(&mut d);
-    assert!(after < before - 5.0, "the drag changed the opacity: {before} -> {after}");
-    let undo1 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
-    assert_eq!(undo1, undo0 + 1, "a property drag is one undo step");
-    d.exec("edit.undo", json!({}));
-    assert_eq!(opacity(&mut d), before, "one undo restores the original value");
-}
-
-/// The shadow color picker popup: a drag in the 2D picker is one undo step, so one Cmd+Z
-/// restores the original color (a drag was committing one undo step per frame, so undo only
-/// stepped back one frame's worth — the reported "sometimes undo works, sometimes not").
-#[test]
-fn shadow_color_drag_is_one_undo_step() {
-    let mut d = Driver::demo();
-    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
-    let r = d.exec("graphics.newText", json!({"text": "Title"}));
-    let clip = r["clip"].as_u64().unwrap();
-    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
-    d.frames(4);
-    let color = |d: &mut Driver| text_param(d, clip, "shadow_color").and_then(|v| v.as_color());
-    // scroll the properties panel so the shadow row is visible, then open the picker
-    d.ok("ui.scroll", json!({"x": 1400.0, "y": 500.0, "dx": 0.0, "dy": -400.0}));
-    d.frames(3);
-    let sw = d.rect("graphics.prop.shadow_color");
-    d.ok("ui.click", json!({"x": sw[0] + sw[2] / 2.0, "y": sw[1] + sw[3] / 2.0}));
-    d.frames(3);
-    // the popup flips above the swatch (it does not fit below); find a point in its 2D picker
-    let undo0 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
-    let mut hit = None;
-    for (dx, dy) in [(30.0, 30.0), (150.0, 30.0), (30.0, 150.0), (150.0, 150.0)] {
-        let (px, py) = (sw[0] + dx, sw[1] - dy);
-        let before = color(&mut d);
-        d.ok("ui.drag", json!({"from": {"x": px, "y": py}, "to": {"x": px + 60.0, "y": py + 40.0}, "steps": 4}));
-        d.frames(3);
-        let after = color(&mut d);
-        if after != before {
-            hit = Some((before, after));
-            break;
-        }
-    }
-    let (before, after) = hit.expect("no drag point hit the color picker");
-    assert_ne!(after, before, "the drag changed the shadow color");
-    let undo1 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
-    assert_eq!(undo1, undo0 + 1, "a color drag is one undo step");
-    d.exec("edit.undo", json!({}));
-    assert_eq!(color(&mut d), before, "one undo restores the original color");
-}
diff --git a/crates/ui-egui/tests/audio51_ui.rs b/crates/ui-egui/tests/it/audio51_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/audio51_ui.rs
rename to crates/ui-egui/tests/it/audio51_ui.rs
diff --git a/crates/ui-egui/tests/audio_fx_editor_ui.rs b/crates/ui-egui/tests/it/audio_fx_editor_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/audio_fx_editor_ui.rs
rename to crates/ui-egui/tests/it/audio_fx_editor_ui.rs
diff --git a/crates/ui-egui/tests/it/caption_copy_paste_ui.rs b/crates/ui-egui/tests/it/caption_copy_paste_ui.rs
new file mode 100644
index 000000000..c3852b7c7
--- /dev/null
+++ b/crates/ui-egui/tests/it/caption_copy_paste_ui.rs
@@ -0,0 +1,85 @@
+//! Cmd+C / Cmd+V with a caption selected in the Timeline pastes a copy at the playhead, as with
+//! clips. The real `FilmcraftApp` under `egui_kittest` with the demo project.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    /// The demo project with snapping off, so drags land where the pointer goes; frames 1/60 s
+    /// apart, as on a display.
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        session.execute("sequence.snap", json!({"on": false})).expect("snapping off");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d.ok("ui.elements", json!({"prefix": "timeline.clip."}));
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).expect("control channel");
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    /// (start, end, text) of every caption on C1.
+    fn captions(&mut self) -> Vec<(i64, i64, String)> {
+        let r = self.exec("captions.list", json!({}));
+        r["tracks"][0]["captions"]
+            .as_array()
+            .expect("captions")
+            .iter()
+            .map(|c| (c["start"].as_i64().expect("start"), c["end"].as_i64().expect("end"), c["text"].as_str().expect("text").to_string()))
+            .collect()
+    }
+}
+
+/// Cmd+C / Cmd+V with a caption selected in the Timeline pastes a copy at the playhead.
+#[test]
+fn copy_paste_duplicates_a_caption() {
+    let mut d = Driver::demo();
+    let id = d.exec("captions.add", json!({"seconds": 1.0, "durationSeconds": 1.0, "text": "again"}))["caption"].as_u64().expect("id");
+    d.ok("ui.click", json!({"id": format!("timeline.caption.{id}")}));
+    d.ok("ui.key", json!({"key": "Cmd+C"}));
+    d.exec("playhead.set", json!({"seconds": 5.0}));
+    d.ok("ui.key", json!({"key": "Cmd+V"}));
+    let caps = d.captions();
+    assert_eq!(caps.len(), 2, "pasted: {caps:?}");
+    assert_eq!(caps[1].2, "again");
+    assert!(caps[1].0 > caps[0].1);
+}
diff --git a/crates/ui-egui/tests/it/caption_list_follow_ui.rs b/crates/ui-egui/tests/it/caption_list_follow_ui.rs
new file mode 100644
index 000000000..310a4182a
--- /dev/null
+++ b/crates/ui-egui/tests/it/caption_list_follow_ui.rs
@@ -0,0 +1,91 @@
+//! The Text panel's Captions list keeps the caption under the playhead in view as the playhead
+//! moves, so it stays lined up with the Timeline. The real `FilmcraftApp` under `egui_kittest`
+//! with the demo project.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui::{Rect, pos2};
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    /// The demo project with snapping off, so drags land where the pointer goes; frames 1/60 s
+    /// apart, as on a display.
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        session.execute("sequence.snap", json!({"on": false})).expect("snapping off");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d.ok("ui.elements", json!({"prefix": "timeline.clip."}));
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).expect("control channel");
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    fn rect(&mut self, id: &str) -> Option<Rect> {
+        self.frames(2);
+        let els = self.ok("ui.elements", json!({"prefix": id}));
+        let el = els.as_array()?.iter().find(|e| e["id"] == id)?.clone();
+        let r: Vec<f32> = el["rect"].as_array()?.iter().filter_map(|v| v.as_f64().map(|v| v as f32)).collect();
+        Some(Rect::from_min_size(pos2(*r.first()?, *r.get(1)?), egui::vec2(*r.get(2)?, *r.get(3)?)))
+    }
+}
+
+/// The Captions list keeps the caption under the playhead in view as the playhead moves on.
+#[test]
+fn captions_list_follows_the_playhead() {
+    let mut d = Driver::demo();
+    let mut last = 0;
+    for i in 0..30 {
+        last = d.exec("captions.add", json!({"seconds": i as f64, "durationSeconds": 0.5, "text": format!("word {i}")}))["caption"].as_u64().expect("id");
+    }
+    d.ok("ui.panel.show", json!({"panel": "Text"}));
+    d.ok("ui.click", json!({"id": "text.tab.Captions"}));
+    d.exec("playhead.set", json!({"seconds": 0.0}));
+    let top = d.rect("text.captions.search").expect("search").max.y;
+    let bottom = d.rect("text.captions.style.font").expect("style strip").min.y;
+    let row = format!("text.captions.{last}.row");
+    let before = d.rect(&row).expect("last row");
+    assert!(before.center().y > bottom, "the last caption starts out of view: {before:?} below {bottom}");
+    d.exec("playhead.set", json!({"seconds": 29.2}));
+    d.frames(30);
+    let after = d.rect(&row).expect("last row");
+    assert!(after.center().y > top && after.center().y < bottom, "the playhead's caption is in view: {after:?} in {top}..{bottom}");
+}
diff --git a/crates/ui-egui/tests/it/caption_option_drag_ui.rs b/crates/ui-egui/tests/it/caption_option_drag_ui.rs
new file mode 100644
index 000000000..771ef0151
--- /dev/null
+++ b/crates/ui-egui/tests/it/caption_option_drag_ui.rs
@@ -0,0 +1,117 @@
+//! Option-drag of a caption in the Timeline leaves it where it was and drops a copy where it is
+//! released, as with clips. The real `FilmcraftApp` under `egui_kittest` with the demo project.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui::{Modifiers, Pos2, Rect, pos2};
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    /// The demo project with snapping off, so drags land where the pointer goes; frames 1/60 s
+    /// apart, as on a display.
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        session.execute("sequence.snap", json!({"on": false})).expect("snapping off");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d.ok("ui.elements", json!({"prefix": "timeline.clip."}));
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).expect("control channel");
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    fn rect(&mut self, id: &str) -> Option<Rect> {
+        self.frames(2);
+        let els = self.ok("ui.elements", json!({"prefix": id}));
+        let el = els.as_array()?.iter().find(|e| e["id"] == id)?.clone();
+        let r: Vec<f32> = el["rect"].as_array()?.iter().filter_map(|v| v.as_f64().map(|v| v as f32)).collect();
+        Some(Rect::from_min_size(pos2(*r.first()?, *r.get(1)?), egui::vec2(*r.get(2)?, *r.get(3)?)))
+    }
+
+    /// (start, end, text) of every caption on C1.
+    fn captions(&mut self) -> Vec<(i64, i64, String)> {
+        let r = self.exec("captions.list", json!({}));
+        r["tracks"][0]["captions"]
+            .as_array()
+            .expect("captions")
+            .iter()
+            .map(|c| (c["start"].as_i64().expect("start"), c["end"].as_i64().expect("end"), c["text"].as_str().expect("text").to_string()))
+            .collect()
+    }
+
+    /// Press at `from`, move to `to` over `steps` frames with `mods` held, release.
+    fn drag_with(&mut self, from: Pos2, to: Pos2, steps: usize, mods: Modifiers) {
+        let push = |d: &mut Self, e: egui::Event| d.harness.input_mut().events.push(e);
+        push(self, egui::Event::ModifiersChanged(mods));
+        push(self, egui::Event::PointerMoved(from));
+        self.frames(1);
+        push(self, egui::Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: mods });
+        self.frames(1);
+        for i in 1..=steps {
+            push(self, egui::Event::PointerMoved(from + (to - from) * (i as f32 / steps as f32)));
+            self.frames(1);
+        }
+        push(self, egui::Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: mods });
+        self.frames(2);
+        push(self, egui::Event::ModifiersChanged(Modifiers::NONE));
+        self.frames(1);
+    }
+}
+
+/// Option-drag of a caption leaves it where it was and drops a copy where it is released; a
+/// plain drag still moves it.
+#[test]
+fn option_drag_copies_a_caption() {
+    let mut d = Driver::demo();
+    let id = d.exec("captions.add", json!({"seconds": 1.0, "durationSeconds": 1.0, "text": "twin"}))["caption"].as_u64().expect("id");
+    let before = d.captions();
+    let r = d.rect(&format!("timeline.caption.{id}")).expect("caption block");
+    d.drag_with(r.center(), r.center() + egui::vec2(r.width() * 2.0, 0.0), 20, Modifiers::ALT);
+    let caps = d.captions();
+    assert_eq!(caps.len(), 2, "a copy was made: {caps:?}");
+    assert_eq!(caps[0], before[0], "the original stayed");
+    assert_eq!(caps[1].2, "twin");
+    assert!(caps[1].0 > before[0].1, "the copy is to the right: {caps:?}");
+    // without Option it moves
+    let r = d.rect(&format!("timeline.caption.{id}")).expect("caption block");
+    d.drag_with(r.center(), r.center() - egui::vec2(r.width() * 0.5, 0.0), 20, Modifiers::NONE);
+    assert_eq!(d.captions().len(), 2, "a plain drag does not copy");
+}
diff --git a/crates/ui-egui/tests/caption_properties_ui.rs b/crates/ui-egui/tests/it/caption_properties_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/caption_properties_ui.rs
rename to crates/ui-egui/tests/it/caption_properties_ui.rs
diff --git a/crates/ui-egui/tests/it/caption_razor_ui.rs b/crates/ui-egui/tests/it/caption_razor_ui.rs
new file mode 100644
index 000000000..114c68d25
--- /dev/null
+++ b/crates/ui-egui/tests/it/caption_razor_ui.rs
@@ -0,0 +1,116 @@
+//! The Razor tool (C) on a caption in the Timeline cuts it, as it cuts clips. The real
+//! `FilmcraftApp` under `egui_kittest` with the demo project.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui::{Modifiers, Pos2, Rect, pos2};
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    /// The demo project with snapping off, so drags land where the pointer goes; frames 1/60 s
+    /// apart, as on a display.
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        session.execute("sequence.snap", json!({"on": false})).expect("snapping off");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d.ok("ui.elements", json!({"prefix": "timeline.clip."}));
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).expect("control channel");
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    fn rect(&mut self, id: &str) -> Option<Rect> {
+        self.frames(2);
+        let els = self.ok("ui.elements", json!({"prefix": id}));
+        let el = els.as_array()?.iter().find(|e| e["id"] == id)?.clone();
+        let r: Vec<f32> = el["rect"].as_array()?.iter().filter_map(|v| v.as_f64().map(|v| v as f32)).collect();
+        Some(Rect::from_min_size(pos2(*r.first()?, *r.get(1)?), egui::vec2(*r.get(2)?, *r.get(3)?)))
+    }
+
+    /// (start, end, text) of every caption on C1.
+    fn captions(&mut self) -> Vec<(i64, i64, String)> {
+        let r = self.exec("captions.list", json!({}));
+        r["tracks"][0]["captions"]
+            .as_array()
+            .expect("captions")
+            .iter()
+            .map(|c| (c["start"].as_i64().expect("start"), c["end"].as_i64().expect("end"), c["text"].as_str().expect("text").to_string()))
+            .collect()
+    }
+
+    /// Press at `from`, move to `to` over `steps` frames with `mods` held, release.
+    fn drag_with(&mut self, from: Pos2, to: Pos2, steps: usize, mods: Modifiers) {
+        let push = |d: &mut Self, e: egui::Event| d.harness.input_mut().events.push(e);
+        push(self, egui::Event::ModifiersChanged(mods));
+        push(self, egui::Event::PointerMoved(from));
+        self.frames(1);
+        push(self, egui::Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: mods });
+        self.frames(1);
+        for i in 1..=steps {
+            push(self, egui::Event::PointerMoved(from + (to - from) * (i as f32 / steps as f32)));
+            self.frames(1);
+        }
+        push(self, egui::Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: mods });
+        self.frames(2);
+        push(self, egui::Event::ModifiersChanged(Modifiers::NONE));
+        self.frames(1);
+    }
+
+    fn click(&mut self, at: Pos2) {
+        self.drag_with(at, at, 0, Modifiers::NONE);
+    }
+}
+
+/// With the Razor tool (C), a click on a caption in the Timeline cuts it in two there. The
+/// caption blocks took the click for selecting and moving whatever the tool, so it did nothing.
+#[test]
+fn razor_tool_splits_a_caption() {
+    let mut d = Driver::demo();
+    let id = d.exec("captions.add", json!({"seconds": 2.0, "durationSeconds": 4.0, "text": "cut me"}))["caption"].as_u64().expect("id");
+    d.ok("ui.set", json!({"tool": "razor"}));
+    let r = d.rect(&format!("timeline.caption.{id}")).expect("caption block");
+    d.click(r.center());
+    let caps = d.captions();
+    assert_eq!(caps.len(), 2, "the caption was cut: {caps:?}");
+    assert_eq!(caps[0].1, caps[1].0, "the halves meet at the cut");
+    assert!(caps.iter().all(|c| c.2 == "cut me"));
+}
diff --git a/crates/ui-egui/tests/captions_font_ui.rs b/crates/ui-egui/tests/it/captions_font_ui.rs
similarity index 64%
rename from crates/ui-egui/tests/captions_font_ui.rs
rename to crates/ui-egui/tests/it/captions_font_ui.rs
index bd6822d55..877976c74 100644
--- a/crates/ui-egui/tests/captions_font_ui.rs
+++ b/crates/ui-egui/tests/it/captions_font_ui.rs
@@ -93,3 +93,52 @@ fn caption_font_picker_sets_the_track_font() {
     d.frames(3);
     assert_eq!(d.font(track), "Noto Serif");
 }
+
+/// Every text shape on screen, with the colour of its first run.
+fn painted_text(d: &Driver) -> Vec<(String, egui::Color32)> {
+    fn walk(s: &egui::Shape, out: &mut Vec<(String, egui::Color32)>) {
+        match s {
+            egui::Shape::Text(t) => {
+                if let Some(sec) = t.galley.job.sections.first() {
+                    out.push((t.galley.text().to_string(), sec.format.color));
+                }
+            }
+            egui::Shape::Vec(v) => v.iter().for_each(|s| walk(s, out)),
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    d.harness.output().shapes.iter().for_each(|c| walk(&c.shape, &mut out));
+    out
+}
+
+/// Relative luminance (WCAG) of an opaque colour.
+fn luminance(c: egui::Color32) -> f32 {
+    let f = |v: u8| {
+        let v = v as f32 / 255.0;
+        if v <= 0.03928 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) }
+    };
+    0.2126 * f(c.r()) + 0.7152 * f(c.g()) + 0.0722 * f(c.b())
+}
+
+// Regression test for #1072: the Captions tab's "Import captions file…" button label was always
+// white, so it vanished against the light grey button in light mode.
+#[test]
+fn import_captions_button_label_is_legible_in_both_themes() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    d.ok("ui.click", json!({"id": "text.tab.Captions"}));
+    for theme in ["dark", "light"] {
+        d.ok("ui.set", json!({"theme": theme}));
+        d.frames(3);
+        assert!(d.ids("text.captions.import").iter().any(|i| i == "text.captions.import"), "{theme}: the empty Captions tab offers the import button");
+        let field_bg = d.harness.state().tokens.field_bg;
+        let (_, color) = painted_text(&d)
+            .into_iter()
+            .find(|(text, _)| text.starts_with("Import captions file"))
+            .unwrap_or_else(|| panic!("{theme}: the button label is not drawn"));
+        let (hi, lo) = (luminance(color).max(luminance(field_bg)), luminance(color).min(luminance(field_bg)));
+        let contrast = (hi + 0.05) / (lo + 0.05);
+        assert!(contrast >= 4.5, "{theme}: label {color:?} on {field_bg:?} has contrast {contrast:.2}:1");
+    }
+}
diff --git a/crates/ui-egui/tests/chrome_ui.rs b/crates/ui-egui/tests/it/chrome_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/chrome_ui.rs
rename to crates/ui-egui/tests/it/chrome_ui.rs
diff --git a/crates/ui-egui/tests/clip_audio_ui.rs b/crates/ui-egui/tests/it/clip_audio_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/clip_audio_ui.rs
rename to crates/ui-egui/tests/it/clip_audio_ui.rs
diff --git a/crates/ui-egui/tests/clip_dialogs_ui.rs b/crates/ui-egui/tests/it/clip_dialogs_ui.rs
similarity index 95%
rename from crates/ui-egui/tests/clip_dialogs_ui.rs
rename to crates/ui-egui/tests/it/clip_dialogs_ui.rs
index 72c947fb0..2d9bbf20f 100644
--- a/crates/ui-egui/tests/clip_dialogs_ui.rs
+++ b/crates/ui-egui/tests/it/clip_dialogs_ui.rs
@@ -347,6 +347,26 @@ fn quitting_with_unsaved_changes_asks_to_save() {
     assert!(!d.sent(&egui::ViewportCommand::CancelClose), "the confirmed quit goes through");
 }
 
+/// #1943: the macOS menu bar's Quit (Cmd+Q) sends `app.quit` to the command inbox; with unsaved
+/// changes that closes the window through the prompt instead of quitting outright.
+#[test]
+fn native_menu_quit_with_unsaved_changes_asks_to_save() {
+    let mut d = Driver::new();
+    d.edit();
+    let (tx, rx) = channel();
+    d.app().command_inbox = Some(rx);
+    tx.send("app.quit".to_string()).unwrap();
+    d.frames(1);
+    assert!(d.sent(&egui::ViewportCommand::Close), "Quit asks the window to close");
+    assert!(!d.app().quit_confirmed, "nothing is confirmed yet");
+    // the window's close request is cancelled and the prompt asks instead
+    d.request_close();
+    assert!(d.sent(&egui::ViewportCommand::CancelClose), "the window must stay open");
+    d.frames(2);
+    assert!(d.has("quit.save") && d.has("quit.dontSave") && d.has("quit.cancel"));
+    assert!(d.app().session.is_dirty());
+}
+
 #[test]
 fn quit_save_on_a_new_project_uses_the_save_dialog_and_scripted_quit_does_not_ask() {
     let path = std::env::temp_dir().join(format!("fc-quit-save-{}.fcproj", std::process::id()));
diff --git a/crates/ui-egui/tests/clipboard_paste_ui.rs b/crates/ui-egui/tests/it/clipboard_paste_ui.rs
similarity index 67%
rename from crates/ui-egui/tests/clipboard_paste_ui.rs
rename to crates/ui-egui/tests/it/clipboard_paste_ui.rs
index c01d2e165..40e77b629 100644
--- a/crates/ui-egui/tests/clipboard_paste_ui.rs
+++ b/crates/ui-egui/tests/it/clipboard_paste_ui.rs
@@ -3,7 +3,10 @@
 
 use std::cell::Cell;
 use std::rc::Rc;
-use std::sync::mpsc::{Sender, channel};
+use std::sync::{
+    Arc,
+    mpsc::{Sender, channel},
+};
 
 use egui_kittest::Harness;
 use filmcraft_engine::Session;
@@ -140,6 +143,46 @@ fn ctrl_v_pastes_an_image_above_the_footage() {
     assert_eq!(d.clips(), before);
 }
 
+/// A paste delivered by `Event::PasteImage` carries the image bytes: paste uses that payload even
+/// with no clipboard-media hook (the web host installs none) and without re-reading the OS.
+#[test]
+fn paste_image_event_imports_its_own_payload_without_a_clipboard_hook() {
+    let mut d = Driver::demo("paste-image-event");
+    d.ok("ui.set", json!({"focused": "Timeline"}));
+    assert!(d.app().hooks.clipboard_media.is_none());
+    let before = d.clips();
+    let image = egui::ColorImage::filled([8, 6], egui::Color32::from_rgb(10, 20, 30));
+    d.harness.input_mut().events.extend([egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), egui::Event::PasteImage(Arc::new(image))]);
+    d.frames(1);
+    d.harness.input_mut().events.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    d.frames(2);
+    let new: Vec<_> = d.clips().into_iter().filter(|c| !before.contains(c)).collect();
+    assert_eq!(new.iter().map(|c| c.3.as_str()).collect::<Vec<_>>(), ["Pasted Image 1.png"]);
+    assert!(d.dir.join("Pasted Image 1.png").is_file(), "the event payload was written, not an empty clipboard");
+}
+
+/// The saved PNG stores straight alpha. `Color32` is premultiplied internally, so a
+/// semi-transparent clipboard pixel must keep its colour through the paste.
+#[test]
+fn paste_image_event_writes_straight_alpha_rgba() {
+    let mut d = Driver::demo("paste-image-alpha");
+    d.ok("ui.set", json!({"focused": "Timeline"}));
+    let before = d.clips();
+    // Four half-transparent red pixels; premultiplied storage would be (128, 0, 0, 128).
+    let rgba = [255, 0, 0, 128, 255, 0, 0, 128, 255, 0, 0, 128, 255, 0, 0, 128];
+    let image = egui::ColorImage::from_rgba_unmultiplied([2, 2], &rgba);
+    d.harness.input_mut().events.extend([egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), egui::Event::PasteImage(Arc::new(image))]);
+    d.frames(1);
+    d.harness.input_mut().events.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    d.frames(2);
+    let new: Vec<_> = d.clips().into_iter().filter(|c| !before.contains(c)).collect();
+    assert_eq!(new.iter().map(|c| c.3.as_str()).collect::<Vec<_>>(), ["Pasted Image 1.png"]);
+    let png = std::fs::read(d.dir.join("Pasted Image 1.png")).expect("the pasted PNG");
+    let decoded = image::load_from_memory(&png).expect("decode the pasted PNG").to_rgba8();
+    assert_eq!(decoded.get_pixel(0, 0).0, [255, 0, 0, 128], "straight alpha, not the premultiplied colour");
+    assert_eq!(decoded.get_pixel(1, 1).0, [255, 0, 0, 128]);
+}
+
 /// Files copied in the file manager paste the same way, even when the clipboard also holds text
 /// (Ctrl+V then arrives as a paste event); Ctrl+Shift+V inserts them on the targeted track.
 #[test]
@@ -228,6 +271,60 @@ fn ctrl_v_pastes_a_cut_clip_even_when_old_files_linger_on_the_clipboard() {
     assert!(!d.clips().iter().any(|c| c.3.contains("stale")), "lingering OS files are not pasted");
 }
 
+/// Lift and Extract put the range on the clipboard like Cut, so Ctrl+V pastes it rather than files
+/// left on the OS clipboard (#3019).
+#[test]
+fn ctrl_v_pastes_a_lifted_or_extracted_range_even_when_old_files_linger_on_the_clipboard() {
+    for cmd in ["sequence.lift", "sequence.extract"] {
+        let mut d = Driver::demo("lift-linger");
+        d.ok("ui.set", json!({"focused": "Timeline"}));
+        let png = d.dir.join("stale.png");
+        image::RgbaImage::from_pixel(8, 8, image::Rgba([200, 0, 200, 255])).save(&png).unwrap();
+        let path = png.to_string_lossy().into_owned();
+        d.app().hooks.clipboard_media = Some(Box::new(move || Some(ClipboardMedia::Files(vec![path.clone()]))));
+        let first = d.clips().into_iter().find(|c| c.0 == 'V' && c.1 == 0).unwrap();
+        d.ok("engine.execute", json!({"command": "markers.markIn", "params": {"frame": 6}}));
+        d.ok("engine.execute", json!({"command": "markers.markOut", "params": {"frame": 17}}));
+        d.ok("ui.menu.invoke", json!({"id": cmd}));
+        d.ok("engine.execute", json!({"command": "playhead.end", "params": {}}));
+        let named = |d: &mut Driver| d.clips().iter().filter(|c| c.0 == 'V' && c.3 == first.3).count();
+        let before = named(&mut d);
+        d.ctrl_v_with_text();
+        assert_eq!(named(&mut d), before + 1, "{cmd}: the range is pasted");
+        assert!(!d.clips().iter().any(|c| c.3.contains("stale")), "{cmd}: lingering OS files are not pasted");
+    }
+}
+
+/// A Lift or Extract over a range with no clips on the targeted tracks leaves both clipboards
+/// alone: an image copied afterwards in another app is not taken for stale, and Ctrl+V pastes it
+/// rather than the clip copied before (#3019).
+#[test]
+fn lift_or_extract_over_no_clips_keeps_a_newer_os_image_pasteable() {
+    for cmd in ["sequence.lift", "sequence.extract"] {
+        let mut d = Driver::demo("lift-empty");
+        d.ok("ui.set", json!({"focused": "Timeline"}));
+        let first = d.clips().into_iter().find(|c| c.0 == 'V' && c.1 == 0).unwrap();
+        d.ok("engine.execute", json!({"command": "timeline.select", "params": {"clips": [first.2]}}));
+        d.ok("ui.menu.invoke", json!({"id": "edit.copy"}));
+        d.clipboard(Some(red_image));
+        let tracks: Vec<u64> = d.app().session.active_sequence().unwrap().all_tracks().map(|t| t.id.0).collect();
+        let target = |d: &mut Driver, on: bool| {
+            for t in &tracks {
+                d.ok("engine.execute", json!({"command": "timeline.setTargeting", "params": {"track": t, "targeted": on}}));
+            }
+        };
+        target(&mut d, false);
+        d.ok("engine.execute", json!({"command": "markers.markIn", "params": {"frame": 6}}));
+        d.ok("engine.execute", json!({"command": "markers.markOut", "params": {"frame": 17}}));
+        d.ok("ui.menu.invoke", json!({"id": cmd}));
+        target(&mut d, true);
+        let before = d.clips();
+        d.ctrl_v_without_text(egui::Modifiers::COMMAND);
+        let new: Vec<_> = d.clips().into_iter().filter(|c| !before.contains(c)).map(|c| c.3).collect();
+        assert_eq!(new, ["Pasted Image 1.png"], "{cmd}");
+    }
+}
+
 /// Copy from the keyboard (Ctrl+C as `Event::Copy`) also snapshots lingering OS media, so Ctrl+V
 /// pastes the clips rather than those files.
 #[test]
diff --git a/crates/ui-egui/tests/color_ui.rs b/crates/ui-egui/tests/it/color_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/color_ui.rs
rename to crates/ui-egui/tests/it/color_ui.rs
diff --git a/crates/ui-egui/tests/delete_caption_tracks_ui.rs b/crates/ui-egui/tests/it/delete_caption_tracks_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/delete_caption_tracks_ui.rs
rename to crates/ui-egui/tests/it/delete_caption_tracks_ui.rs
diff --git a/crates/ui-egui/tests/deselect_ui.rs b/crates/ui-egui/tests/it/deselect_ui.rs
similarity index 99%
rename from crates/ui-egui/tests/deselect_ui.rs
rename to crates/ui-egui/tests/it/deselect_ui.rs
index 66095e652..4c4de2a24 100644
--- a/crates/ui-egui/tests/deselect_ui.rs
+++ b/crates/ui-egui/tests/it/deselect_ui.rs
@@ -103,7 +103,7 @@ fn clicking_another_panel_ends_text_editing() {
     let clip = d.exec("graphics.newText", json!({"text": "Title", "time": at}))["clip"].as_u64().unwrap();
     d.ok("ui.panel.show", json!({"panel": "Properties"}));
     let edit = |d: &mut Driver| {
-        d.app().ui.gfx_edit = Some(GfxEdit { clip, layer: 0, caret: 0, anchor: 0 });
+        d.app().ui.gfx_edit = Some(GfxEdit { clip, layer: 0, caret: 0, anchor: 0, ..Default::default() });
         d.app().ui.focused = filmcraft_ui_egui::dock::PanelKind::Program;
         d.frames(3);
     };
diff --git a/crates/ui-egui/tests/dialog_buttons_ui.rs b/crates/ui-egui/tests/it/dialog_buttons_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/dialog_buttons_ui.rs
rename to crates/ui-egui/tests/it/dialog_buttons_ui.rs
diff --git a/crates/ui-egui/tests/edit_point_menu_ui.rs b/crates/ui-egui/tests/it/edit_point_menu_ui.rs
similarity index 79%
rename from crates/ui-egui/tests/edit_point_menu_ui.rs
rename to crates/ui-egui/tests/it/edit_point_menu_ui.rs
index d4e259b50..7632e6acf 100644
--- a/crates/ui-egui/tests/edit_point_menu_ui.rs
+++ b/crates/ui-egui/tests/it/edit_point_menu_ui.rs
@@ -18,11 +18,15 @@ struct Driver {
 
 impl Driver {
     fn new() -> Self {
+        Self::with_height(980.0)
+    }
+
+    fn with_height(height: f32) -> Self {
         let mut s = Session::default();
         s.execute("file.openDemoProject", json!({})).unwrap();
         let (tx, rx) = channel();
         let app = FilmcraftApp::new(s).with_control(rx);
-        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, height)).with_max_steps(10_000).build_eframe(move |_cc| app);
         let mut d = Driver { harness, tx };
         d.frames(4);
         d
@@ -66,6 +70,14 @@ impl Driver {
         v.as_array().unwrap().iter().any(|e| e["id"] == json!(id))
     }
 
+    /// [x, y, width, height]
+    fn rect(&mut self, id: &str) -> [f64; 4] {
+        let v = self.ok("ui.elements", json!({"prefix": id}));
+        let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no element {id}"));
+        let r: Vec<f64> = e["rect"].as_array().unwrap().iter().map(|x| x.as_f64().unwrap()).collect();
+        [r[0], r[1], r[2], r[3]]
+    }
+
     fn seq(&mut self) -> Sequence {
         self.harness.state_mut().session.active_sequence().unwrap().clone()
     }
@@ -100,14 +112,21 @@ fn right_clicking_a_cut_opens_the_edit_point_menu() {
     }
     assert!(!d.has("timeline.clipMenu.edit.cut"), "not the clip menu");
     let eps = d.harness.state_mut().session.state.edit_points.clone();
-    assert_eq!(eps.len(), 1, "the cut is selected as an edit point");
+    assert_eq!(eps.len(), 2, "the picture cut and its linked sound are selected");
     assert!((eps[0].clip == a && eps[0].out) || (eps[0].clip == b && !eps[0].out), "{eps:?}");
+    let seq = d.seq();
+    let picture = seq.find_item(eps[0].clip).unwrap().1;
+    let (track, sound) = seq.find_item(eps[1].clip).unwrap();
+    assert!(seq.audio_tracks.iter().any(|t| t.id == track));
+    assert!(picture.link.is_some());
+    assert_eq!(sound.link, picture.link);
 
     // Trim In: the incoming clip's In edge, as a regular trim
     d.click("timeline.editPointMenu.trimIn");
     let ep = d.harness.state_mut().session.state.edit_points.clone();
-    assert_eq!(ep.len(), 1);
+    assert_eq!(ep.len(), 2);
     assert_eq!((ep[0].clip, ep[0].out, serde_json::to_value(ep[0].kind).unwrap()), (b, false, json!("trim")));
+    assert_eq!((ep[1].out, ep[1].kind), (ep[0].out, ep[0].kind), "sound has the same trim edge and kind");
 
     // Apply Default Transitions puts a transition on the cut
     d.right_click(b, 0.0);
@@ -158,3 +177,18 @@ fn join_through_edits_joins_only_the_right_clicked_cut() {
     d.click("timeline.editPointMenu.joinThroughEdits");
     assert_eq!(d.seq().video_tracks[0].items.len(), before, "disabled: nothing joined");
 }
+
+/// #2852: on a short screen the clip menu scrolls, so the items past its bottom can be reached.
+#[test]
+fn the_clip_menu_scrolls_on_a_short_screen() {
+    let height = 600.0;
+    let mut d = Driver::with_height(height as f32);
+    let (_, b) = d.cut_on_v1();
+    d.right_click(b, 0.5);
+    let last = "timeline.clipMenu.sequence.joinThroughEdits";
+    assert!(d.rect(last)[1] > height, "the menu is taller than the screen");
+    d.ok("ui.scroll", json!({"id": "timeline.clipMenu.edit.cut", "dy": -2000.0}));
+    d.frames(10);
+    let r = d.rect(last);
+    assert!(r[1] >= 0.0 && r[1] + r[3] <= height, "Join Through Edits scrolled into view: {r:?}");
+}
diff --git a/crates/ui-egui/tests/escape_drag_ui.rs b/crates/ui-egui/tests/it/escape_drag_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/escape_drag_ui.rs
rename to crates/ui-egui/tests/it/escape_drag_ui.rs
diff --git a/crates/ui-egui/tests/essential_sound_ui.rs b/crates/ui-egui/tests/it/essential_sound_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/essential_sound_ui.rs
rename to crates/ui-egui/tests/it/essential_sound_ui.rs
diff --git a/crates/ui-egui/tests/export_menu_ui.rs b/crates/ui-egui/tests/it/export_menu_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/export_menu_ui.rs
rename to crates/ui-egui/tests/it/export_menu_ui.rs
diff --git a/crates/ui-egui/tests/export_ui.rs b/crates/ui-egui/tests/it/export_ui.rs
similarity index 96%
rename from crates/ui-egui/tests/export_ui.rs
rename to crates/ui-egui/tests/it/export_ui.rs
index 6a3375259..573a36ee3 100644
--- a/crates/ui-egui/tests/export_ui.rs
+++ b/crates/ui-egui/tests/it/export_ui.rs
@@ -248,6 +248,16 @@ fn h265_shows_the_h264_family_controls_without_the_h264_only_ones() {
     }
     let sum = d.ok("ui.elements", json!({"prefix": "export.summary"}))[0]["label"].as_str().unwrap().to_string();
     assert!(sum.contains("HEVC Main") && sum.contains("Target 20.00 Mbps"), "{sum}");
+    // headless there is no hardware encoder: H.265 says so where the format is chosen (a preset
+    // can still name it), and its entry in the Format list is greyed out with the same reason
+    assert!(!filmcraft_engine::export::available(Format::Hevc), "no NVENC / VideoToolbox probe is registered here");
+    let why = d.ok("ui.elements", json!({"prefix": "export.format.unavailable"}))[0]["label"].as_str().unwrap().to_string();
+    assert!(why.contains("hardware encoder") && why.contains("H.265") && why.contains("H.264 or ProRes"), "{why}");
+    d.click("export.format");
+    let hevc = Format::ALL.iter().position(|f| *f == Format::Hevc).unwrap();
+    let entries = d.ok("ui.elements", json!({"prefix": format!("export.format.option.{hevc}")}));
+    assert_eq!(entries[0]["label"], "H.265 (HEVC)", "{entries}");
+    d.ok("ui.key", json!({"key": "Escape"}));
     d.snapshot("export-h265");
 }
 
diff --git a/crates/ui-egui/tests/frame_export_ui.rs b/crates/ui-egui/tests/it/frame_export_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/frame_export_ui.rs
rename to crates/ui-egui/tests/it/frame_export_ui.rs
diff --git a/crates/ui-egui/tests/it/graphics_handles_ui.rs b/crates/ui-egui/tests/it/graphics_handles_ui.rs
new file mode 100644
index 000000000..ab7203343
--- /dev/null
+++ b/crates/ui-egui/tests/it/graphics_handles_ui.rs
@@ -0,0 +1,1989 @@
+//! Headless UI tests of the handles of graphic layers in the Program monitor: point text scales
+//! about its anchor point, a paragraph-text box is resized, a shape's Size follows the handle
+//! while its opposite side and anchor point stay (docs/graphics.md).
+//!
+//! With `FILMCRAFT_UI_SHOTS=<dir>` the tests also render the UI with wgpu and save PNGs there.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+    shots: Option<std::path::PathBuf>,
+    // Real Context output tokens, retained across later idle/control-channel frames.
+    reset_requests: Vec<egui::ImeResetId>,
+}
+
+impl Driver {
+    fn new() -> Self {
+        Self::new_with(|_| {})
+    }
+
+    fn new_with(configure: impl FnOnce(&mut FilmcraftApp)) -> Self {
+        let mut s = Session::default();
+        s.execute("file.openDemoProject", json!({})).unwrap();
+        let (tx, rx) = channel();
+        let mut app = FilmcraftApp::new(s).with_control(rx);
+        configure(&mut app);
+        let shots = std::env::var_os("FILMCRAFT_UI_SHOTS").map(std::path::PathBuf::from);
+        let mut b = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000);
+        if shots.is_some() {
+            b = b.wgpu().with_pixels_per_point(1.0);
+        }
+        let harness = b.build_eframe(move |cc| {
+            filmcraft_ui_egui::install_ime_reset_callbacks(&cc.egui_ctx);
+            app
+        });
+        let mut d = Driver { harness, tx, shots, reset_requests: Vec::new() };
+        d.frames(4);
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            // the control channel's clicks and keys enter through the input hook
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+            if let Some(request) = self.harness.output().platform_output.ime.as_ref().and_then(|ime| ime.reset_request) {
+                self.reset_requests.push(request);
+            }
+        }
+    }
+
+    fn reset_completed(&self) -> egui::Event {
+        egui::Event::ImeResetCompleted { request_id: *self.reset_requests.last().expect("a real Context reset request was published") }
+    }
+
+    fn call(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                return v;
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let v = self.call(method, params.clone());
+        assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+        v["result"].clone()
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    fn shot(&mut self, name: &str) {
+        let Some(dir) = self.shots.clone() else { return };
+        self.frames(8);
+        let img = self.harness.render().expect("wgpu render");
+        std::fs::create_dir_all(&dir).unwrap();
+        img.save(dir.join(format!("{name}.png"))).unwrap();
+    }
+
+    fn ime(&self) -> Option<egui::output::IMEOutput> {
+        self.harness.output().platform_output.ime.clone()
+    }
+
+    /// Start point-text editing on the Program picture and return its clip id.
+    fn start_point_text(&mut self) -> u64 {
+        self.ok("ui.set", json!({"tool": "Type"}));
+        self.frames(3);
+        let pic = self.rect("program.picture");
+        self.ok("ui.click", json!({"x": pic[0] + pic[2] * 0.3, "y": pic[1] + pic[3] * 0.2}));
+        self.frames(3);
+        self.exec("graphics.list", json!({}))["clip"].as_u64().unwrap()
+    }
+}
+
+/// The text editor's caret and anchor.
+fn caret(d: &Driver) -> (usize, usize) {
+    d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.caret, e.anchor)).expect("a text layer is being edited")
+}
+
+impl Driver {
+    fn rect(&mut self, id: &str) -> [f64; 4] {
+        let v = self.ok("ui.elements", json!({"prefix": id}));
+        let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no element {id}")).clone();
+        let r = &e["rect"];
+        [r[0].as_f64().unwrap(), r[1].as_f64().unwrap(), r[2].as_f64().unwrap(), r[3].as_f64().unwrap()]
+    }
+}
+
+impl Driver {
+    fn select(&mut self, clip: u64) -> String {
+        self.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
+        self.ok("ui.set", json!({"tool": "Selection"}));
+        self.frames(4);
+        format!("program.layer.{clip}.0.")
+    }
+
+    /// A selected layer of each kind; returns the clip and the id prefix of the layer's handles
+    /// (`handle.0`–`3` corners TL, TR, BR, BL; `handle.4`–`7` the top, right, bottom and left
+    /// edges) and anchor point (`anchor`).
+    fn point_text(&mut self) -> (u64, String) {
+        let r = self.exec("graphics.newText", json!({"text": "Title", "position": [600, 500], "size": 120}));
+        let clip = r["clip"].as_u64().unwrap();
+        (clip, self.select(clip))
+    }
+
+    fn paragraph_text(&mut self) -> (u64, String) {
+        let r = self.exec("graphics.newText", json!({"text": FOX, "position": [500, 300], "box": [700, 500], "size": 80}));
+        let clip = r["clip"].as_u64().unwrap();
+        (clip, self.select(clip))
+    }
+
+    fn shape(&mut self) -> String {
+        let r = self.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [500, 300]}));
+        let clip = r["clip"].as_u64().unwrap();
+        self.select(clip)
+    }
+
+    /// Centre of element `pre` + `what` ("handle.2", "anchor").
+    fn at(&mut self, pre: &str, what: &str) -> (f64, f64) {
+        let r = self.rect(&format!("{pre}{what}"));
+        (r[0] + r[2] / 2.0, r[1] + r[3] / 2.0)
+    }
+
+    fn handle(&mut self, pre: &str, n: usize) -> (f64, f64) {
+        self.at(pre, &format!("handle.{n}"))
+    }
+
+    fn drag(&mut self, from: (f64, f64), by: (f64, f64)) {
+        // Control gestures use explicit modifiers and isolate ambient native keyboard state.
+        let m = self.harness.ctx.input(|input| input.modifiers);
+        self.ok(
+            "ui.drag",
+            json!({"from": {"x": from.0, "y": from.1}, "to": {"x": from.0 + by.0, "y": from.1 + by.1}, "steps": 6,
+            "modifiers": {"shift":m.shift,"alt":m.alt,"ctrl":m.ctrl,"command":m.command}}),
+        );
+        self.frames(4);
+    }
+
+    fn hover(&mut self, at: (f64, f64)) {
+        self.harness.input_mut().events.push(egui::Event::PointerMoved(egui::pos2(at.0 as f32, at.1 as f32)));
+        self.frames(2);
+    }
+
+    fn cursor(&self) -> egui::CursorIcon {
+        self.harness.output().platform_output.cursor_icon
+    }
+
+    /// Press or let go of Shift as a keyboard reports it. The drag fixture then explicitly
+    /// forwards the held modifiers to the control gesture.
+    fn hold_shift(&mut self, on: bool) {
+        let m = if on { egui::Modifiers::SHIFT } else { egui::Modifiers::NONE };
+        self.harness.input_mut().events.push(egui::Event::ModifiersChanged(m));
+        self.frames(1);
+    }
+
+    fn drag_handle(&mut self, pre: &str, n: usize, dx: f64, dy: f64) {
+        let h = self.handle(pre, n);
+        self.drag(h, (dx, dy));
+    }
+
+    fn layer(&mut self, clip: u64) -> Value {
+        self.exec("graphics.list", json!({"clip": clip}))["layers"][0].clone()
+    }
+}
+
+const FOX: &str = "The quick brown fox jumps over the lazy dog";
+
+fn near(a: (f64, f64), b: (f64, f64)) -> bool {
+    (a.0 - b.0).abs() < 1.5 && (a.1 - b.1).abs() < 1.5
+}
+
+fn num(v: &Value) -> f64 {
+    v.as_f64().unwrap_or_else(|| panic!("not a number: {v}"))
+}
+
+#[test]
+fn point_text_handles_scale_it_about_its_anchor() {
+    let mut d = Driver::new();
+    let (clip, pre) = d.point_text();
+    let before = d.layer(clip);
+    assert_eq!(before["textType"], "point");
+    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
+    assert!(
+        (anchor.0 - tl.0).abs() < 1.5 && anchor.1 > tl.1 && anchor.1 < br.1,
+        "the anchor is on the first baseline's left end: {anchor:?} in {tl:?}..{br:?}"
+    );
+
+    // a corner dragged down: the text grows, both axes alike, and the anchor does not move
+    d.drag_handle(&pre, 2, 0.0, 40.0);
+    let after = d.layer(clip);
+    let f = num(&after["scale"]) / 100.0;
+    assert!(f > 1.2, "bigger: {f}");
+    assert_eq!(after["scale"], after["scaleWidth"], "uniform");
+    assert_eq!(after["position"], before["position"]);
+    assert_eq!(after["anchor"], before["anchor"]);
+    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor stays put");
+    d.shot("point-text-scaled");
+    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    for (was, now) in [(tl, tl2), (br, br2)] {
+        let want = (anchor.0 + (was.0 - anchor.0) * f, anchor.1 + (was.1 - anchor.1) * f);
+        assert!(near(now, want), "every corner moves away from the anchor by the scale: {was:?} -> {now:?}, expected {want:?}");
+    }
+    // the handle is nearer than 60 points to the anchor, so it scales as if 60 points further away
+    let reach = (br.1 - anchor.1) + 60.0;
+    assert!((f - (1.0 + 40.0 / reach)).abs() < 0.02, "scale {f} for 40 points with the handle {} from the anchor", br.1 - anchor.1);
+
+    // sideways travel of a corner does nothing
+    d.drag_handle(&pre, 2, 80.0, 0.0);
+    assert!((num(&d.layer(clip)["scale"]) / 100.0 - f).abs() < 0.01);
+
+    // an edge handle scales the whole text too: the right edge follows the pointer, since it is
+    // further than 60 points from the anchor
+    let (right, top) = (d.handle(&pre, 5), d.handle(&pre, 4));
+    d.drag_handle(&pre, 5, 50.0, 0.0);
+    let l = d.layer(clip);
+    assert_eq!(l["scale"], l["scaleWidth"], "still uniform");
+    let (right2, top2) = (d.handle(&pre, 5), d.handle(&pre, 4));
+    assert!((right2.0 - right.0 - 50.0).abs() < 2.0, "right edge follows the pointer: {right:?} -> {right2:?}");
+    assert!(top2.1 < top.1 - 2.0, "and the text got taller with it: {top:?} -> {top2:?}");
+    assert!(near(d.at(&pre, "anchor"), anchor));
+
+    // towards the anchor shrinks; one undo step per drag
+    let s = num(&l["scale"]);
+    d.drag_handle(&pre, 4, 0.0, 30.0);
+    assert!(num(&d.layer(clip)["scale"]) < s - 5.0);
+    d.exec("edit.undo", json!({}));
+    assert_eq!(num(&d.layer(clip)["scale"]), s);
+}
+
+#[test]
+fn the_anchor_point_can_be_dragged_without_moving_the_layer() {
+    let mut d = Driver::new();
+    let (clip, pre) = d.point_text();
+    d.exec("graphics.set", json!({"clip": clip, "props": {"scale": 200, "scale_width": 200}}));
+    d.frames(4);
+    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
+    let before = d.layer(clip);
+    d.drag(anchor, (90.0, -40.0));
+    let after = d.layer(clip);
+    assert!(near(d.at(&pre, "anchor"), (anchor.0 + 90.0, anchor.1 - 40.0)), "the anchor follows the pointer");
+    assert!(near(d.handle(&pre, 0), tl) && near(d.handle(&pre, 2), br), "the layer stays where it is");
+    // the position moves with the anchor; the anchor moves half as far in the layer's own pixels (scale 200)
+    let (dp, da) = (num(&after["position"][0]) - num(&before["position"][0]), num(&after["anchor"][0]) - num(&before["anchor"][0]));
+    assert!(dp > 10.0 && (da - dp / 2.0).abs() < 0.01, "position {dp}, anchor {da}");
+    assert_eq!(after["scale"], before["scale"]);
+
+    // now a handle scales about the moved anchor
+    d.drag_handle(&pre, 2, 0.0, 30.0);
+    assert!(near(d.at(&pre, "anchor"), (anchor.0 + 90.0, anchor.1 - 40.0)));
+    assert!(num(&d.layer(clip)["scale"]) > 201.0);
+}
+
+#[test]
+fn paragraph_text_handles_resize_the_box_and_the_text_reflows() {
+    let mut d = Driver::new();
+    let (clip, pre) = d.paragraph_text();
+    let before = d.layer(clip);
+    assert_eq!(before["textType"], "paragraph");
+    assert_eq!(before["overflow"], false, "{before}");
+    let (anchor, tl, br) = (d.at(&pre, "anchor"), d.handle(&pre, 0), d.handle(&pre, 2));
+    assert!(near(anchor, tl), "the anchor is on the box's top-left corner: {anchor:?} vs {tl:?}");
+    let k = (br.0 - tl.0) / 700.0; // screen points per canvas pixel
+
+    // bottom-right corner: it follows the pointer on both axes, the top-left stays, nothing scales
+    let (dx, dy) = (-70.0 * k, 50.0 * k);
+    d.drag_handle(&pre, 2, dx, dy);
+    let after = d.layer(clip);
+    assert!(near(d.handle(&pre, 0), tl));
+    assert!(near(d.handle(&pre, 2), (br.0 + dx, br.1 + dy)), "the corner follows the pointer");
+    assert!((num(&after["box"][0]) - 630.0).abs() < 1.0 && (num(&after["box"][1]) - 550.0).abs() < 1.0, "{}", after["box"]);
+    assert_eq!(after["overflow"], false);
+    assert_eq!(after["scale"], 100.0);
+    assert_eq!(after["position"], before["position"]);
+    assert_eq!(after["anchor"], before["anchor"]);
+
+    // a box too low for its text hides the rest (and says so); the font size is untouched
+    d.drag_handle(&pre, 6, 0.0, -400.0 * k);
+    let low = d.layer(clip);
+    assert_eq!(low["overflow"], true, "{low}");
+    d.shot("paragraph-text-overflow");
+    assert_eq!(low["scale"], 100.0);
+    d.exec("edit.undo", json!({}));
+    assert_eq!(d.layer(clip)["overflow"], false);
+
+    // the left edge: it follows the pointer, the right edge stays; the anchor stays on its spot
+    // of the picture (now outside the box) and the position is untouched
+    let (right, left) = (d.handle(&pre, 5), d.handle(&pre, 7));
+    d.drag_handle(&pre, 7, 60.0 * k, 0.0);
+    let moved = d.layer(clip);
+    assert!(near(d.handle(&pre, 5), right));
+    assert!(near(d.handle(&pre, 7), (left.0 + 60.0 * k, left.1)));
+    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor stays put");
+    assert_eq!(moved["position"], before["position"]);
+    assert!((num(&moved["anchor"][0]) + 60.0).abs() < 1.0 && num(&moved["anchor"][1]).abs() < 1e-6, "{}", moved["anchor"]);
+    assert!((num(&moved["box"][0]) - 570.0).abs() < 1.0, "{}", moved["box"]);
+    d.shot("paragraph-text-left-edge-moved");
+
+    // a side dragged past its opposite stops at a small box instead of flipping
+    d.drag_handle(&pre, 5, -900.0, 0.0);
+    let w = num(&d.layer(clip)["box"][0]);
+    assert!((w - 40.0).abs() < 0.5, "half the font size: {w}");
+}
+
+#[test]
+fn type_tool_drag_makes_paragraph_text_and_a_click_point_text() {
+    let mut d = Driver::new();
+    d.ok("ui.set", json!({"tool": "Type"}));
+    d.frames(3);
+    let pic = d.rect("program.picture");
+    let at = |fx: f64, fy: f64| (pic[0] + pic[2] * fx, pic[1] + pic[3] * fy);
+    let (a, b) = (at(0.2, 0.5), at(0.6, 0.8));
+    d.drag(a, (b.0 - a.0, b.1 - a.1));
+    d.ok("ui.type", json!({"text": FOX}));
+    let list = d.exec("graphics.list", json!({}));
+    let clip = list["clip"].as_u64().unwrap();
+    let l = &list["layers"][0];
+    assert_eq!(l["text"], FOX);
+    assert_eq!(l["textType"], "paragraph");
+    let canvas = (num(&list["canvas"][0]), num(&list["canvas"][1]));
+    assert!(
+        (num(&l["box"][0]) - canvas.0 * 0.4).abs() < 2.0 && (num(&l["box"][1]) - canvas.1 * 0.3).abs() < 2.0,
+        "the box is the dragged rectangle: {}",
+        l["box"]
+    );
+    assert!((num(&l["quad"][0][0]) - canvas.0 * 0.2).abs() < 2.0 && (num(&l["quad"][0][1]) - canvas.1 * 0.5).abs() < 2.0, "{}", l["quad"]);
+    assert_eq!(l["scale"], 100.0);
+    // the text being typed is the box
+    d.shot("paragraph-text-typing");
+    let edit = d.rect("program.textEdit");
+    assert!((edit[2] - (b.0 - a.0)).abs() < 3.0, "{edit:?}");
+
+    // a click makes point text, in the same graphic
+    d.ok("ui.key", json!({"key": "Escape"}));
+    let c = at(0.3, 0.2);
+    d.ok("ui.click", json!({"x": c.0, "y": c.1}));
+    d.ok("ui.type", json!({"text": "Title"}));
+    let list = d.exec("graphics.list", json!({"clip": clip}));
+    assert_eq!(list["layers"][1]["textType"], "point");
+    assert_eq!(list["layers"][1]["box"], json!(null));
+}
+
+/// Chinese, Japanese and Korean input methods hand over the finished text as `Ime(Commit)`, not
+/// `Text`; it is typed into the text being edited on the monitor (#1083).
+#[test]
+fn text_committed_by_an_input_method_is_typed_on_the_monitor() {
+    let mut d = Driver::new();
+    d.ok("ui.set", json!({"tool": "Type"}));
+    d.frames(3);
+    let pic = d.rect("program.picture");
+    d.ok("ui.click", json!({"x": pic[0] + pic[2] * 0.3, "y": pic[1] + pic[3] * 0.2}));
+    d.ok("ui.type", json!({"text": "A"}));
+    // the events Microsoft Pinyin sends for "ni hao" picked as 你好
+    let preedit = |text: &str| egui::Event::Ime(egui::ImeEvent::Preedit { text: text.into(), active_range_chars: None });
+    d.harness.input_mut().events.extend([preedit("ni hao"), preedit(""), egui::Event::Ime(egui::ImeEvent::Commit("你好".into()))]);
+    d.frames(4);
+    let list = d.exec("graphics.list", json!({}));
+    assert_eq!(list["layers"][0]["text"], "A你好");
+}
+
+/// The labels of the drawn marked text and of its active clause, if drawn.
+fn drawn_preedit(d: &mut Driver) -> (Option<String>, Option<String>) {
+    let elements = d.ok("ui.elements", json!({"prefix": "program.textEdit.preedit"}));
+    let label = |id: &str| elements.as_array()?.iter().find(|e| e["id"] == json!(id))?["label"].as_str().map(str::to_string);
+    (label("program.textEdit.preedit"), label("program.textEdit.preedit.clause"))
+}
+
+/// The marked text is drawn on the video with the clause being converted until the commit, which
+/// types the converted text instead.
+#[test]
+fn ime_preedit_and_its_active_clause_are_drawn_until_the_commit() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "A"}));
+    d.frames(2);
+    d.harness.input_mut().events.push(egui::Event::Ime(egui::ImeEvent::Preedit { text: "にほんご".into(), active_range_chars: Some(2..4) }));
+    d.frames(3);
+    assert_eq!(drawn_preedit(&mut d), (Some("にほんご".into()), Some("んご".into())));
+    assert_eq!(layer_texts(&mut d, clip), vec!["A".to_string()], "the marked text is not in the layer's text");
+    assert_eq!(drawn_preedit(&mut d).0.as_deref(), Some("にほんご"), "it stays drawn while composing");
+    d.harness.input_mut().events.extend([ime_preedit(""), ime_commit("日本語")]);
+    d.frames(2);
+    assert_eq!(drawn_preedit(&mut d), (None, None));
+    assert_eq!(layer_texts(&mut d, clip), vec!["A日本語".to_string()]);
+}
+
+/// #2445: Korean commits a syllable only when the next one starts. The syllable being composed
+/// shows at the caret, and the one still being composed when the edit ends goes into the text,
+/// once.
+#[test]
+fn korean_being_composed_shows_and_is_kept_when_the_edit_ends() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "A"}));
+    d.frames(2);
+    // 한 composed from ㅎ, 하, 한, then 국 started: 한 is committed, 구 shows
+    d.harness.input_mut().events.extend([ime_preedit("ㅎ"), ime_preedit("하"), ime_preedit("한")]);
+    d.frames(3);
+    assert_eq!(drawn_preedit(&mut d).0.as_deref(), Some("한"), "the syllable being composed shows");
+    d.harness.input_mut().events.extend([ime_commit("한"), ime_preedit("구")]);
+    d.frames(3);
+    assert_eq!(layer_texts(&mut d, clip), vec!["A한".to_string()]);
+    assert_eq!(drawn_preedit(&mut d).0.as_deref(), Some("구"));
+    // moving to the Timeline ends the edit: the syllable still being composed is kept
+    d.ok("ui.panel.show", json!({"panel": "Timeline"}));
+    d.frames(3);
+    assert!(d.harness.state().ui.gfx_edit.is_none());
+    assert_eq!(layer_texts(&mut d, clip), vec!["A한구".to_string()]);
+    // the input method's own late commit of it is not typed a second time
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 7, "anchor": 7}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_commit("구"));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["A한구".to_string()]);
+}
+
+/// A commit, the next syllable and the release of a click that ends the edit, in one pass, keep
+/// both syllables: the commit's text is written before the edit's end types the marked text.
+#[test]
+fn a_commit_and_a_preedit_with_the_click_that_ends_the_edit_keep_both() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "A"}));
+    d.frames(2);
+    let pic = d.rect("program.picture");
+    let at = egui::pos2((pic[0] + pic[2] * 0.7) as f32, (pic[1] + pic[3] * 0.8) as f32);
+    let button = |pressed| egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    d.harness.input_mut().events.extend([egui::Event::PointerMoved(at), button(true)]);
+    d.frames(1);
+    d.harness.input_mut().events.extend([ime_commit("한"), ime_preedit("구"), button(false)]);
+    d.frames(3);
+    assert_eq!(layer_texts(&mut d, clip).first().map(String::as_str), Some("A한구"));
+}
+
+/// The Program monitor's IME context keeps its owner and generation through a reversed UTF-8
+/// selection, a preedit, a commit that replaces the selection, an empty commit and typing.
+#[test]
+fn ime_context_survives_selection_preedit_commit_and_typing() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "café😀"}));
+    d.frames(3);
+    let first = d.ime().expect("the focused text layer publishes an IME context");
+    let (owner, generation) = (first.owner, first.context_generation);
+
+    // Primary caret 5 (after é), anchor 2: a reversed selection of "fé".
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 2}}));
+    d.frames(3);
+    let selected = d.ime().expect("selection keeps the context");
+    assert_eq!((selected.owner, selected.context_generation), (owner, generation), "caret and selection moves keep the context");
+    assert_eq!(caret(&d), (5, 2), "direction is preserved");
+
+    // The marked text is not committed text.
+    d.harness.input_mut().events.push(egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: Some(0..1) }));
+    d.frames(2);
+    assert!(d.ime().is_some(), "preedit does not remove the context");
+    assert_eq!(layer_texts(&mut d, clip), vec!["café😀".to_string()]);
+    assert_eq!(caret(&d), (5, 2));
+
+    // The commit replaces the selected "fé".
+    d.harness.input_mut().events.push(egui::Event::Ime(egui::ImeEvent::Commit("語".into())));
+    d.frames(1);
+    let committed = d.ime().expect("the commit keeps the context");
+    assert_eq!((committed.owner, committed.context_generation), (owner, generation));
+    assert_eq!(layer_texts(&mut d, clip), vec!["ca語😀".to_string()]);
+    assert_eq!(caret(&d), (5, 5));
+
+    // An empty commit with no selection changes nothing.
+    d.harness.input_mut().events.push(egui::Event::Ime(egui::ImeEvent::Commit(String::new())));
+    d.frames(2);
+    let repeated = d.ime().expect("the committed editor still publishes");
+    assert_eq!((repeated.owner, repeated.context_generation), (owner, generation));
+    assert_eq!(layer_texts(&mut d, clip), vec!["ca語😀".to_string()]);
+
+    d.ok("ui.type", json!({"text": "X"}));
+    d.frames(2);
+    let typed = d.ime().expect("typing keeps the context");
+    assert_eq!(typed.context_generation, generation);
+    assert_eq!(layer_texts(&mut d, clip), vec!["ca語X😀".to_string()], "typing inserts at the retained caret before the emoji");
+    assert_eq!(caret(&d), (6, 6));
+}
+
+/// Delete-surrounding excludes the selection, rounds partial UTF-8 ranges inward, and keeps a
+/// reversed selection's direction while the queued edit is accepted.
+#[test]
+fn ime_delete_surrounding_keeps_selection_direction_and_unicode() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "aé😀z"}));
+    d.frames(3);
+    // Select é (bytes 1..3), primary caret at its end (reversed).
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 1}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 4 }));
+    d.frames(1);
+    assert!(d.ime().is_some(), "delete-surrounding keeps the context");
+    assert_eq!(layer_texts(&mut d, clip), vec!["éz".to_string()], "one byte before and the four-byte emoji after are deleted; é is kept");
+    assert_eq!(caret(&d), (2, 0), "primary caret stays after the anchor");
+}
+
+/// Losing focus ends the output; reopening the same layer keeps the stable owner but resets the
+/// generation exactly once. A plain caret move does not reset it.
+#[test]
+fn ime_owner_is_stable_across_edits_and_resets_on_refocus() {
+    let mut d = Driver::new();
+    d.start_point_text();
+    d.ok("ui.type", json!({"text": "Title"}));
+    d.frames(3);
+    let first = d.ime().expect("text editing has an IME context");
+    let (owner, generation) = (first.owner, first.context_generation);
+
+    d.ok("ui.key", json!({"key": "ArrowLeft"}));
+    d.frames(2);
+    let moved = d.ime().expect("caret movement keeps the context");
+    assert_eq!(moved.owner, owner);
+    assert_eq!(moved.context_generation, generation, "ordinary caret movement does not reset");
+
+    d.ok("ui.key", json!({"key": "Escape"}));
+    d.frames(2);
+    assert!(d.ime().is_none(), "an unfocused, closed editor publishes no descriptor");
+
+    let pic = d.rect("program.picture");
+    d.ok("ui.click", json!({"x": pic[0] + pic[2] * 0.3, "y": pic[1] + pic[3] * 0.2}));
+    d.frames(3);
+    let reopened = d.ime().expect("the reopened editor publishes again");
+    assert_eq!(reopened.owner, owner, "the sequence/clip/component owner is stable");
+    assert_ne!(reopened.context_generation, generation, "a replacement session resets the generation once");
+}
+
+/// Typing and a commit in one pass apply in the order they came, in the same IME context.
+#[test]
+fn ime_typing_and_commit_in_one_pass_apply_in_order() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.frames(2);
+    let before = d.ime().expect("the empty editor is focused");
+    d.harness.input_mut().events.extend([egui::Event::Text("A".into()), egui::Event::Ime(egui::ImeEvent::Commit("B".into()))]);
+    d.frames(1);
+    let mixed = d.ime().expect("the mixed edit keeps the context");
+    assert_eq!(mixed.context_generation, before.context_generation);
+    assert_eq!(layer_texts(&mut d, clip), vec!["AB".to_string()]);
+}
+
+/// An Arrow key later in a raw batch uses the layout of the text from the start of that batch.
+/// Text typed earlier in the same batch can move the caret onto a byte inside a multi-byte
+/// character; the following Text/Paste/Cut must clamp it to a boundary instead of panicking.
+#[test]
+fn arrow_from_the_old_layout_does_not_split_text_inserted_in_the_same_batch() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.exec("graphics.setText", json!({"clip": clip, "layer": 0, "text": "ab\ncd"}));
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 0, "anchor": 0}}));
+    d.frames(2);
+
+    // After "éé" the caret is at byte 4, on the old layout's second line. ArrowUp maps its x to
+    // byte 1 of that old line, which is inside the first "é" in the current text; "x" then inserts
+    // there. Before the fix this panicked on the non-boundary insert.
+    d.harness.input_mut().events.extend([egui::Event::Text("éé".into()), key_press(egui::Key::ArrowUp), egui::Event::Text("x".into())]);
+    d.frames(2);
+    assert_eq!(d.exec("graphics.list", json!({"clip": clip}))["layers"][0]["text"], json!("xééab\ncd"));
+}
+
+fn ime_preedit(text: &str) -> egui::Event {
+    egui::Event::Ime(egui::ImeEvent::Preedit { text: text.into(), active_range_chars: None })
+}
+
+fn ime_commit(text: &str) -> egui::Event {
+    egui::Event::Ime(egui::ImeEvent::Commit(text.into()))
+}
+
+fn key_press(key: egui::Key) -> egui::Event {
+    egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE }
+}
+
+fn layer_texts(d: &mut Driver, clip: u64) -> Vec<String> {
+    d.exec("graphics.list", json!({"clip": clip}))["layers"]
+        .as_array()
+        .map(|layers| layers.iter().map(|layer| layer["text"].as_str().unwrap_or("").to_string()).collect())
+        .unwrap_or_default()
+}
+
+fn new_text_layer(d: &mut Driver, clip: Option<u64>, text: &str, x: f64) -> u64 {
+    let mut p = json!({"text": text, "position": [x, 400], "size": 100});
+    if let Some(clip) = clip {
+        p["clip"] = json!(clip);
+    }
+    d.exec("graphics.newText", p)["clip"].as_u64().unwrap()
+}
+
+/// A commit from a composition whose target was replaced (`ui.set.gfxEdit`) must be dropped: the
+/// text belongs to the old layer, not to whatever layer the new edit target names.
+#[test]
+fn ime_commit_after_target_replacement_is_dropped() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    // The edit target moves to the other layer while the IME is still composing.
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_commit("x"));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "beta".to_string()]);
+}
+
+/// A composition whose target was replaced can emit another non-empty pre-edit before its final
+/// commit. That late pre-edit must not revive the old composition on the replacement layer, while
+/// a genuinely new composition in a later raw batch must still work.
+#[test]
+fn ime_late_preedit_after_target_replacement_cannot_retarget() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    // The edit target moves to the other layer while the old composition is still live.
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    // A late pre-edit from the replaced composition. The input method commits it in a later raw
+    // batch, so the tombstone must survive the pre-edit batch.
+    d.harness.input_mut().events.push(ime_preedit("にに"));
+    d.frames(1);
+    d.harness.input_mut().events.push(ime_commit("x"));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "beta".to_string()], "the late pre-edit and paired commit stayed on the old target");
+
+    // Only the matching reset completion releases the old composition guard.
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([fence, ime_preedit("よ"), ime_commit("y")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "betay".to_string()], "a new composition on the current target still works");
+}
+
+/// An empty pre-edit clears the visible composition but not ownership of its pending terminal
+/// commit. Switching targets before that commit arrives must still reject it.
+#[test]
+fn ime_empty_preedit_keeps_pending_commit_from_retargeting() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    // The empty pre-edit dismisses the visible composition. Its commit is a separate event.
+    d.harness.input_mut().events.push(ime_preedit(""));
+    d.frames(1);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_commit("x"));
+    d.frames(2);
+    assert_eq!(
+        layer_texts(&mut d, clip),
+        vec!["alpha".to_string(), "beta".to_string()],
+        "the pending commit of the dismissed composition stayed on the old target"
+    );
+
+    // An old terminal is not acknowledgement; the exact fence admits a fresh direct commit.
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([fence, ime_commit("y")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "betay".to_string()], "a direct commit after the terminal boundary is accepted");
+}
+
+/// A matching opaque fence is an ordered boundary; the fresh preedit after it survives to its
+/// later commit, while the old terminal before it remains rejected.
+#[test]
+fn ime_preedit_after_reset_completion_in_one_batch_is_accepted() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    // Preserve original raw order: old terminal, actual completion, then fresh preedit.
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([ime_preedit(""), ime_commit("x"), fence, ime_preedit("よ")]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "beta".to_string()], "the old commit was still rejected");
+    d.harness.input_mut().events.push(ime_commit("y"));
+    d.frames(2);
+    assert_eq!(
+        layer_texts(&mut d, clip),
+        vec!["alpha".to_string(), "betay".to_string()],
+        "the pre-edit after the old terminal commit started a new composition"
+    );
+}
+
+/// A same-pass control text mutation replaces the text the composition belonged to. The old
+/// descriptor must not be published (existing behaviour) and the composition's next commit must
+/// not be inserted into the replacement text.
+#[test]
+fn ime_same_pass_control_text_mutation_invalidates_composition() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "one"}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    // `ui.menu.invoke` is drained after the overlay drew and changes the committed text.
+    d.ok("ui.menu.invoke", json!({"id": "graphics.setText", "params": {"clip": clip, "layer": 0, "text": "changed"}}));
+    assert!(d.ime().is_none(), "the old cursor rectangle must not be published for the changed text");
+
+    d.harness.input_mut().events.push(ime_commit("x"));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["changed".to_string()], "the old composition's commit must not edit the replacement text");
+    // The control replacement keeps the editor's existing numeric byte offsets (the editor only
+    // clamps them into the new text, as it did before this migration), so place the caret at the
+    // end explicitly: this regression tests that the rejected composition's tombstone retires,
+    // not the unrelated caret policy.
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 7, "anchor": 7}}));
+    d.frames(1);
+
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([fence, ime_preedit("よ"), ime_commit("z")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["changedz".to_string()], "a new composition still starts after the text mutation");
+}
+
+/// A same-pass control request can change layout (font size, style, alignment, spacing, box,
+/// transform) without changing the committed text or the layer identity. The pass must not
+/// publish the cursor rectangle of the previous layout.
+#[test]
+fn ime_control_layout_change_does_not_publish_stale_cursor_rect() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "one"}));
+    d.frames(3);
+    let before = d.ime().expect("the editor is observed before the layout change");
+    d.ok("ui.menu.invoke", json!({"id": "graphics.set", "params": {"clip": clip, "layer": 0, "props": {"tracking": 200.0}}}));
+    assert!(d.ime().is_none(), "the old cursor rectangle must not be published with the new layout");
+    d.frames(1);
+    let after = d.ime().expect("the next pass observes the new layout");
+    assert_ne!(after.cursor_rect, before.cursor_rect, "the candidate rectangle moved with the wider tracking");
+}
+
+/// An explicit `ui.set.gfxEdit` names the layer at that numeric index now. A uid belonging to a
+/// layer that a reorder moved elsewhere must not silently retarget the request.
+#[test]
+fn explicit_gfx_edit_index_selects_the_current_layer_not_a_stale_uid() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "one", 400.0);
+    new_text_layer(&mut d, Some(clip), "two", 900.0);
+    let uids: Vec<u64> = d.exec("graphics.list", json!({"clip": clip}))["layers"].as_array().unwrap().iter().map(|l| l["uid"].as_u64().unwrap()).collect();
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 3}}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((0, uids[0])));
+
+    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 0, "to": "front"}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((1, uids[0])), "the edit follows the reordered layer");
+
+    // Index 0 now holds "two", but the request still carries the old "one" uid. The explicit
+    // index wins: the current layer at index 0 is selected.
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 3, "uid": uids[0]}}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((0, uids[1])), "the stale uid must not retarget the request");
+    d.ok("ui.type", json!({"text": "X"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["twoX".to_string(), "one".to_string()]);
+}
+
+/// The fork sends `DeleteSurroundingBytes` immediately before the `Commit` it belongs to. A stale
+/// delete must not lift the tombstone, or the paired commit would be inserted into the replacement
+/// layer. The request-bound guard survives the input batch; its exact completion admits a later
+/// direct commit (no pre-edit) on the new target.
+#[test]
+fn stale_delete_and_commit_pair_cannot_retarget_the_replacement_layer() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    d.harness.input_mut().events.extend([egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 0, after_bytes: 0 }), ime_commit("x")]);
+    d.frames(2);
+    assert_eq!(
+        layer_texts(&mut d, clip),
+        vec!["alpha".to_string(), "beta".to_string()],
+        "neither the delete nor its paired commit touched the replacement layer"
+    );
+
+    // The old pair does not release admission; the exact native fence does.
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([fence, ime_commit("y")]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "betay".to_string()]);
+}
+
+/// An empty pre-edit is the input method dismissing its composition. When it arrives after the
+/// target was replaced it must not clear the tombstone before the paired commit, but it also must
+/// not poison the next legitimate commit-only composition.
+#[test]
+fn stale_empty_preedit_and_commit_pair_cannot_retarget_the_replacement_layer() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+    d.frames(2);
+    d.harness.input_mut().events.extend([ime_preedit(""), ime_commit("x")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "beta".to_string()]);
+
+    let fence = d.reset_completed();
+    d.harness.input_mut().events.extend([fence, ime_commit("y")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "betay".to_string()], "later commit-only input still works");
+}
+
+/// A composition belongs to its layer's uid, not to the numeric index it was started at: a real
+/// reorder moves the editor (and the commit) with the same layer.
+#[test]
+fn composition_follows_a_reordered_layer_by_uid() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "one", 400.0);
+    new_text_layer(&mut d, Some(clip), "two", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 3}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 0, "to": "front"}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| e.layer), Some(1));
+    d.harness.input_mut().events.push(ime_commit("x"));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["two".to_string(), "onex".to_string()], "the composition stayed on the layer it began on");
+}
+
+/// `DeleteSurroundingBytes { 0, 0 }` followed by an empty commit is the IME's way of replacing a
+/// selection with nothing. The selection must be deleted.
+#[test]
+fn empty_ime_commit_replaces_the_selection() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "abc"}));
+    d.frames(2);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 0, "anchor": 3}}));
+    d.frames(2);
+    d.harness.input_mut().events.extend([egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 0, after_bytes: 0 }), ime_commit("")]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec![String::new()], "the selected text is replaced by the empty commit");
+    assert_eq!(caret(&d), (0, 0));
+}
+
+/// Escape in the same raw batch as a commit cancels the edit; the later commit must not be typed.
+#[test]
+fn escape_before_a_commit_in_the_same_batch_cancels_it() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "a"}));
+    d.frames(2);
+    d.harness.input_mut().events.extend([key_press(egui::Key::Escape), ime_commit("x")]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["a".to_string()]);
+    assert!(d.harness.state().ui.gfx_edit.is_none(), "Escape ended the edit");
+    assert!(d.ime().is_none(), "the closed editor publishes no descriptor");
+}
+
+/// A pointer press later in the batch is handled after `text_edit`; a commit after that press
+/// belongs to the new target and must not be inserted into the old one.
+#[test]
+fn pointer_press_before_a_commit_does_not_edit_the_old_layer() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    new_text_layer(&mut d, Some(clip), "beta", 900.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    let rect = d.rect(&format!("program.layer.{clip}.1"));
+    d.harness.input_mut().events.extend([
+        egui::Event::PointerButton {
+            pos: egui::pos2((rect[0] + rect[2] / 2.0) as f32, (rect[1] + rect[3] / 2.0) as f32),
+            button: egui::PointerButton::Primary,
+            pressed: true,
+            modifiers: egui::Modifiers::NONE,
+        },
+        ime_commit("x"),
+    ]);
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string(), "beta".to_string()]);
+}
+
+/// Moving within the same layer keeps its owner, but a known composition belongs to the old
+/// caret. Real press/release input moves it; the late replacement arrives in a separate batch.
+#[test]
+fn ime_pointer_caret_move_rejects_next_batch_old_composition() {
+    for terminal_pending in [false, true] {
+        for bytes in [false, true] {
+            let mut d = Driver::new();
+            let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+            d.ok("ui.set", json!({"tool": "Type", "gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+            d.frames(3);
+            let rect = d.rect(&format!("program.layer.{clip}.0"));
+            let pos = egui::pos2((rect[0] + 1.0) as f32, (rect[1] + rect[3] / 2.0) as f32);
+            d.harness.input_mut().events.push(ime_preedit("に"));
+            d.frames(1);
+            if terminal_pending {
+                d.harness.input_mut().events.push(ime_preedit(""));
+                d.frames(1);
+            }
+            let before = d.ime().expect("a live graphics owner");
+            // A click while composing keeps the marked text as typed.
+            let typed = if terminal_pending { "alpha" } else { "alphaに" };
+            d.harness.input_mut().events.extend([
+                egui::Event::PointerMoved(pos),
+                egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE },
+            ]);
+            d.frames(1);
+            // A focus loss already disables the platform context; otherwise record its
+            // one-shot interruption even when the release frame no longer repeats it.
+            let press_interrupted = d.ime().is_none_or(|ime| ime.should_interrupt_composition);
+            d.harness.input_mut().events.push(egui::Event::PointerButton {
+                pos,
+                button: egui::PointerButton::Primary,
+                pressed: false,
+                modifiers: egui::Modifiers::NONE,
+            });
+            d.frames(1);
+            let edit = d.harness.state().ui.gfx_edit.as_ref().expect("same-layer edit remains active");
+            let caret = edit.caret;
+            assert!(caret < 5 && edit.anchor == caret, "the real click must actually move the caret");
+            let moved = d.ime().expect("same owner after pointer movement");
+            assert_eq!(moved.owner, before.owner, "moving the caret does not replace the layer owner");
+            assert!(press_interrupted || moved.should_interrupt_composition, "the platform cancels the known old composition");
+            let undo = d.harness.state().session.history.undo.len();
+            let delete = if bytes {
+                egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 0, after_bytes: 1 })
+            } else {
+                egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 0, after_chars: 1 })
+            };
+            d.harness.input_mut().events.extend([delete, ime_commit("stale")]);
+            d.frames(1);
+            assert_eq!(layer_texts(&mut d, clip), vec![typed.to_string()], "old composition cannot edit the clicked caret");
+            assert_eq!(d.harness.state().session.history.undo.len(), undo, "rejection creates no Undo transaction");
+            // Rejected terminals do not release the guard. The actual reset fence does.
+            let fence = d.reset_completed();
+            d.harness.input_mut().events.extend([fence, ime_preedit("fresh"), ime_commit("X")]);
+            d.frames(1);
+            assert_eq!(layer_texts(&mut d, clip), vec![format!("{}X{}", &typed[..caret], &typed[caret..])]);
+        }
+    }
+}
+
+/// Control and keyboard caret moves are application-origin too, without changing stable owner
+/// identity. A direct commit remains valid when no old composition was interrupted.
+#[test]
+fn ime_same_owner_selection_move_rejects_only_a_known_composition() {
+    for control_move in [false, true] {
+        for composing in [false, true] {
+            let mut d = Driver::new();
+            let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+            d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+            d.frames(3);
+            let before = d.ime().expect("initial owner");
+            if composing {
+                d.harness.input_mut().events.push(ime_preedit("に"));
+                d.frames(1);
+            }
+            if control_move {
+                d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 0, "anchor": 0}}));
+            } else {
+                d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+                d.frames(1);
+            }
+            assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.caret, e.anchor)), Some((0, 0)));
+            let moved = d.ime().expect("same owner after caret movement");
+            assert_eq!((moved.owner, moved.context_generation), (before.owner, before.context_generation));
+            assert_eq!(moved.should_interrupt_composition, composing);
+            let undo = d.harness.state().session.history.undo.len();
+            d.harness.input_mut().events.push(ime_commit("X"));
+            d.frames(1);
+            assert_eq!(layer_texts(&mut d, clip), vec![if composing { "alpha" } else { "Xalpha" }.to_string()]);
+            if composing {
+                assert_eq!(d.harness.state().session.history.undo.len(), undo);
+            }
+        }
+    }
+}
+
+/// A focused custom text widget consumes raw Ctrl/Cmd+A itself, rather than the menu helper.
+/// Its new selection must not receive the terminal event of an older composition next batch.
+#[test]
+fn ime_raw_select_all_rejects_old_terminal_input_and_preserves_direct_and_fresh_commits() {
+    for phase in ["none", "active", "terminal_pending"] {
+        for bytes in [false, true] {
+            let mut d = Driver::new();
+            let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+            d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+            d.frames(3);
+            if phase != "none" {
+                d.harness.input_mut().events.push(ime_preedit("に"));
+                d.frames(1);
+                if phase == "terminal_pending" {
+                    d.harness.input_mut().events.push(ime_preedit(""));
+                    d.frames(1);
+                }
+            }
+            let before = d.ime().expect("the custom graphics editor is focused");
+            assert_eq!(d.harness.ctx.memory(|m| m.focused()), Some(egui::Id::unique("gfx-text-edit")));
+            assert!(d.harness.ctx.egui_wants_keyboard_input(), "raw Select All must reach the focused-widget path");
+            let command = egui::Modifiers { ctrl: !cfg!(target_os = "macos"), mac_cmd: cfg!(target_os = "macos"), command: true, ..egui::Modifiers::NONE };
+            // Keys are the input method's while it composes: its marked text empties first.
+            d.harness.input_mut().events.extend([
+                ime_preedit(""),
+                egui::Event::ModifiersChanged(command),
+                egui::Event::Key { key: egui::Key::A, physical_key: Some(egui::Key::A), pressed: true, repeat: false, modifiers: command },
+            ]);
+            d.frames(1);
+            assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.anchor, e.caret)), Some((0, 5)), "the raw key really selects all text");
+            let selected = d.ime().expect("the same custom owner reports its selection");
+            assert_eq!((selected.owner, selected.context_generation), (before.owner, before.context_generation));
+            assert_eq!(selected.should_interrupt_composition, phase != "none", "only the known old composition is interrupted");
+            let undo = d.harness.state().session.history.undo.len();
+            let deletion = if bytes {
+                egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 })
+            } else {
+                egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 })
+            };
+            // Surrounding deletion excludes the selected range; the terminal commit would replace
+            // the whole selection if the old composition were not rejected. Release is in this
+            // later batch too, so no control/menu invocation can stand in for the actual key.
+            d.harness.input_mut().events.extend([
+                egui::Event::Key { key: egui::Key::A, physical_key: Some(egui::Key::A), pressed: false, repeat: false, modifiers: command },
+                egui::Event::ModifiersChanged(egui::Modifiers::NONE),
+                deletion,
+                ime_commit("X"),
+            ]);
+            d.frames(1);
+            if phase == "none" {
+                assert_eq!(layer_texts(&mut d, clip), vec!["X".to_string()], "without old preedit a direct commit replaces the selection");
+                assert_eq!(d.harness.state().session.history.undo.len(), undo + 1);
+            } else {
+                assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_string()], "old terminal input cannot replace the new selection");
+                assert_eq!(d.harness.state().session.history.undo.len(), undo, "rejected input creates no Undo transaction");
+                assert!(!d.ime().expect("the unchanged selected editor remains focused").should_interrupt_composition, "the interruption is one-shot");
+                let fence = d.reset_completed();
+                d.harness.input_mut().events.extend([fence, ime_preedit("fresh"), ime_commit("Y")]);
+                d.frames(1);
+                assert_eq!(layer_texts(&mut d, clip), vec!["Y".to_string()], "a fresh composition replaces the selection normally");
+                assert_eq!(d.harness.state().session.history.undo.len(), undo + 1);
+            }
+        }
+    }
+}
+
+/// A surrounding replacement at the original composing caret is still accepted; the
+/// interruption guard is not a blanket commit filter.
+#[test]
+fn ime_uninterrupted_same_owner_replacement_still_applies() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.harness.input_mut().events.extend([egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }), ime_commit("X")]);
+    d.frames(1);
+    let ime = d.ime().expect("the replacement keeps the context");
+    assert!(!ime.should_interrupt_composition);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alphX".to_string()]);
+}
+
+/// Adapter acceptance with real Context output IDs; these injected controls are not an OS test.
+#[test]
+fn ime_reset_fence_admits_the_first_fresh_composition_without_an_old_terminal() {
+    for terminal_pending in [false, true] {
+        for split in [false, true] {
+            let mut d = Driver::new();
+            let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+            new_text_layer(&mut d, Some(clip), "beta", 900.0);
+            d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+            d.frames(2);
+            d.harness.input_mut().events.push(ime_preedit("に"));
+            d.frames(1);
+            if terminal_pending {
+                d.harness.input_mut().events.push(ime_preedit(""));
+                d.frames(1);
+            }
+            d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 4, "anchor": 4}}));
+            d.frames(2);
+            let fence = d.reset_completed();
+            let requests = d.reset_requests.len();
+            let undo = d.harness.state().session.history.undo.len();
+            // A nonterminal stale update/deletion and arbitrary idle time cannot release it.
+            d.harness
+                .input_mut()
+                .events
+                .extend([ime_preedit("old"), egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 })]);
+            d.frames(5);
+            assert_eq!(d.reset_requests.len(), requests, "unchanged waiting passes must not issue new requests");
+            assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned(), "beta".to_owned()]);
+            assert_eq!(d.harness.state().session.history.undo.len(), undo);
+            d.harness.input_mut().events.push(fence);
+            if split {
+                d.frames(1); // F alone, with no fabricated old commit before it.
+            }
+            d.harness.input_mut().events.extend([ime_preedit("が"), ime_commit("が")]);
+            d.frames(1);
+            assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned(), "betaが".to_owned()], "terminal_pending={terminal_pending}, split={split}");
+            assert_eq!(d.harness.state().session.history.undo.len(), undo + 1);
+            d.exec("edit.undo", json!({}));
+            assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned(), "beta".to_owned()]);
+        }
+    }
+}
+
+#[test]
+fn ime_reset_local_caret_changes_supersede_a_completed_fence_before_the_next_event() {
+    for two_moves in [false, true] {
+        let mut d = Driver::new();
+        let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+        d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+        d.frames(2);
+        d.harness.input_mut().events.push(ime_preedit("に"));
+        d.frames(1);
+        d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+        d.frames(1);
+        let first = d.reset_completed();
+        let first_id = *d.reset_requests.last().unwrap();
+        let undo = d.harness.state().session.history.undo.len();
+        let mut events = vec![first.clone(), key_press(egui::Key::End)];
+        if two_moves {
+            events.push(key_press(egui::Key::Home));
+        }
+        events.extend([first, egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 1 }), ime_commit("stale")]);
+        d.harness.input_mut().events.extend(events);
+        d.frames(1);
+        let final_id = *d.reset_requests.last().unwrap();
+        assert_ne!(first_id, final_id, "the locally staged caret superseded the already completed request");
+        let caret = if two_moves { 0 } else { 5 };
+        assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.caret, e.anchor)), Some((caret, caret)));
+        assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned()]);
+        assert_eq!(d.harness.state().session.history.undo.len(), undo);
+        let foreign = egui::Context::default().request_ime_reset(egui::ViewportId::from_hash_of("foreign-film-window")).unwrap();
+        d.harness.input_mut().events.extend([
+            egui::Event::ImeResetCompleted { request_id: first_id },
+            egui::Event::ImeResetCompleted { request_id: foreign },
+            ime_commit("still stale"),
+            egui::Event::ImeResetCompleted { request_id: final_id },
+            ime_preedit("が"),
+            egui::Event::ImeResetCompleted { request_id: final_id }, // duplicate during fresh Active
+            ime_commit("が"),
+        ]);
+        d.frames(1);
+        assert_eq!(layer_texts(&mut d, clip), vec![if two_moves { "がalpha" } else { "alphaが" }.to_owned()]);
+        assert_eq!(d.harness.state().session.history.undo.len(), undo + 1);
+    }
+}
+
+#[test]
+fn ime_reset_hidden_logic_or_missing_geometry_rearms_the_same_model_caret_once() {
+    for hidden_logic in [false, true] {
+        let mut d = Driver::new();
+        let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+        d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+        d.frames(2);
+        d.harness.input_mut().events.push(ime_preedit("に"));
+        d.frames(1);
+        d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+        d.frames(1);
+        let first = *d.reset_requests.last().unwrap();
+        let request_count = d.reset_requests.len();
+        let edit = d.harness.state().ui.gfx_edit.clone();
+        d.frames(4);
+        assert_eq!(d.reset_requests.len(), request_count, "logic before normal UI cannot suspend/rearm every frame");
+        if hidden_logic {
+            let ctx = d.harness.ctx.clone();
+            for _ in 0..3 {
+                let output = ctx.run_logic(&egui::RawInput::default(), |ctx| {
+                    d.harness.state_mut().logic_inner(ctx);
+                    d.harness.state_mut().finish_ime_reset_logic(ctx);
+                });
+                assert!(output.platform_output.ime.is_none());
+            }
+        } else {
+            d.harness.state_mut().ui.mode = filmcraft_ui_egui::state::Mode::Import;
+            d.frames(3);
+            assert!(d.ime().is_none());
+            d.harness.state_mut().ui.mode = filmcraft_ui_egui::state::Mode::Edit;
+        }
+        assert_eq!(d.harness.state().ui.gfx_edit, edit, "the model target/caret stayed the same");
+        d.frames(1);
+        let current = *d.reset_requests.last().unwrap();
+        assert_ne!(current, first, "reactivation must publish a NEW token even for the unchanged caret");
+        let after_activation = d.reset_requests.len();
+        d.frames(4);
+        assert_eq!(d.reset_requests.len(), after_activation);
+        d.harness.input_mut().events.extend([egui::Event::ImeResetCompleted { request_id: first }, ime_commit("old")]);
+        d.frames(1);
+        assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned()]);
+        d.harness.input_mut().events.push(egui::Event::ImeResetCompleted { request_id: current });
+        d.frames(1);
+        d.harness.input_mut().events.extend([ime_preedit("が"), ime_commit("が")]);
+        d.frames(1);
+        assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+    }
+}
+
+#[test]
+fn ime_reset_discarded_request_then_no_descriptor_rearms_on_return() {
+    use std::sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    };
+    struct OutputWitness(Arc<Mutex<Vec<egui::ImeResetId>>>);
+    impl egui::Plugin for OutputWitness {
+        fn debug_name(&self) -> &'static str {
+            "Film reset output witness"
+        }
+        fn output_hook(&mut self, _ctx: &egui::Context, output: &mut egui::FullOutput) {
+            if let Some(id) = output.platform_output.ime.as_ref().and_then(|ime| ime.reset_request) {
+                self.0.lock().unwrap().push(id);
+            }
+        }
+    }
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    let observed = Arc::new(Mutex::new(Vec::new()));
+    d.harness.ctx.add_plugin(OutputWitness(Arc::clone(&observed)));
+    let phase = Arc::new(AtomicUsize::new(0));
+    let begin_phase = Arc::clone(&phase);
+    let stock = egui::Id::unique("film-reset-missing-custom-geometry");
+    d.harness.ctx.on_begin_pass(
+        "Film reset discarded second-pass absence",
+        Arc::new(move |ui| {
+            if begin_phase.load(Ordering::Relaxed) == 1 {
+                ui.memory_mut(|memory| memory.request_focus(stock));
+                begin_phase.store(2, Ordering::Relaxed);
+            }
+        }),
+    );
+    d.harness.ctx.on_end_pass(
+        "Film reset discard first request output",
+        Arc::new(move |ui| {
+            if phase.compare_exchange(0, 1, Ordering::Relaxed, Ordering::Relaxed).is_ok() {
+                ui.ctx().request_discard("exercise actual request consumption followed by final None");
+            }
+        }),
+    );
+    d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+    d.frames(1);
+    assert!(d.harness.output().platform_output.num_completed_passes >= 2);
+    assert!(d.ime().is_none(), "the final discarded rerun published no custom descriptor");
+    let first = *observed.lock().unwrap().last().expect("the first discarded pass carried an actual request");
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.caret, e.anchor)), Some((0, 0)));
+    d.harness.ctx.memory_mut(|memory| memory.surrender_focus(stock));
+    d.frames(1);
+    let current = *d.reset_requests.last().expect("returning custom output rearms");
+    assert_ne!(first, current);
+    d.harness.input_mut().events.extend([
+        egui::Event::ImeResetCompleted { request_id: first },
+        ime_commit("old"),
+        egui::Event::ImeResetCompleted { request_id: current },
+        ime_preedit("が"),
+        ime_commit("が"),
+    ]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+}
+
+/// The ordinary multipass case: the first pass's request is discarded, but the final rerun
+/// publishes the same custom editor. Core must carry R1 (not a newly allocated token or an
+/// untokened interrupt), and that exact fence then admits a fresh suffix without an old terminal.
+#[test]
+fn ime_reset_discarded_pass_keeps_the_same_custom_request_and_admits_a_fresh_suffix() {
+    use std::sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    };
+    struct OutputWitness(Arc<Mutex<Vec<(egui::ImeResetId, bool)>>>);
+    impl egui::Plugin for OutputWitness {
+        fn debug_name(&self) -> &'static str {
+            "Film reset carried-request witness"
+        }
+        fn output_hook(&mut self, _ctx: &egui::Context, output: &mut egui::FullOutput) {
+            if let Some(ime) = output.platform_output.ime.as_ref()
+                && let Some(id) = ime.reset_request
+            {
+                self.0.lock().unwrap().push((id, ime.should_interrupt_composition));
+            }
+        }
+    }
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    let owner = d.ime().expect("the custom editor published its descriptor").owner;
+    let observed = Arc::new(Mutex::new(Vec::new()));
+    d.harness.ctx.add_plugin(OutputWitness(Arc::clone(&observed)));
+    let phase = Arc::new(AtomicUsize::new(0));
+    let end_phase = Arc::clone(&phase);
+    d.harness.ctx.on_end_pass(
+        "Film reset discard one same-custom pass",
+        Arc::new(move |ui| {
+            if end_phase.compare_exchange(0, 1, Ordering::Relaxed, Ordering::Relaxed).is_ok() {
+                ui.ctx().request_discard("exercise request carry into a same-custom final pass");
+            }
+        }),
+    );
+    d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+    d.frames(1);
+    assert!(d.harness.output().platform_output.num_completed_passes >= 2);
+    let ime = d.ime().expect("the final custom descriptor was published");
+    assert_eq!(ime.owner, owner, "the final descriptor is the same custom editor");
+    let id = ime.reset_request.expect("the final custom descriptor carries R1");
+    assert!(ime.should_interrupt_composition);
+    let seen = observed.lock().unwrap();
+    // `output_hook` runs per pass, before core applies the discarded-pass carry in
+    // `FullOutput::append`. Only the discarded pass publishes R1 here; the final rerun's own
+    // pass output has no request, and the combined output above proves the carry.
+    assert_eq!(seen.as_slice(), &[(id, true)], "exactly the discarded pass emitted R1 as a real interruption");
+    drop(seen);
+    // No fabricated old terminal: only the exact completion boundary and a fresh composition.
+    d.harness.input_mut().events.extend([egui::Event::ImeResetCompleted { request_id: id }, ime_preedit("が"), ime_commit("が")]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+}
+
+/// A host picker and an in-app modal own input. Entering either must retire/suspend the guard
+/// without allocating a NEW request; leaving it rearms exactly one fresh boundary.
+#[test]
+fn ime_reset_native_picker_and_in_app_modal_do_not_allocate_a_new_request() {
+    use filmcraft_ui_egui::Dialog;
+    use filmcraft_ui_egui::native_dialogs::FileDialog;
+    use std::sync::{Arc, Mutex};
+    let senders: Arc<Mutex<Vec<Sender<Vec<String>>>>> = Arc::new(Mutex::new(Vec::new()));
+    let picker_senders = Arc::clone(&senders);
+    let mut d = Driver::new_with(move |app| {
+        app.hooks.run_dialog = Some(Box::new(move |_dialog| {
+            let (tx, rx) = channel();
+            picker_senders.lock().unwrap().push(tx);
+            rx
+        }));
+    });
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(2);
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+    d.frames(1);
+    let first = *d.reset_requests.last().expect("the interruption published a fence");
+
+    let opened = d.harness.state_mut().pick(FileDialog::OpenProject, |_, _| Ok(Value::Null)).unwrap();
+    assert_eq!(opened["dialog"], json!("open"));
+    d.frames(3);
+    assert!(d.harness.state().native_dialog_open());
+    let requests = d.reset_requests.len();
+    assert!(d.ime().is_none_or(|ime| ime.reset_request.is_none()), "an open picker cannot publish a NEW reset");
+    assert_eq!(d.reset_requests.len(), requests, "an open picker cannot allocate a NEW reset");
+    d.harness.input_mut().events.extend([ime_preedit("old"), ime_commit("old")]);
+    d.frames(2);
+    assert_eq!(d.reset_requests.len(), requests);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned()], "picker-owned input cannot edit the editor");
+    if let Some(tx) = senders.lock().unwrap().pop() {
+        tx.send(Vec::new()).unwrap();
+    }
+    d.frames(2);
+    assert!(!d.harness.state().native_dialog_open());
+    let after_picker = *d.reset_requests.last().expect("returning from the picker rearms");
+    assert_ne!(after_picker, first);
+    let request_count = d.reset_requests.len();
+    d.frames(3);
+    assert_eq!(d.reset_requests.len(), request_count, "waiting after rearm must not churn IDs");
+
+    d.harness.state_mut().dialog = Some(Dialog::About);
+    d.frames(3);
+    assert_eq!(d.reset_requests.len(), request_count, "an in-app modal cannot allocate a NEW reset");
+    d.harness.state_mut().dialog = None;
+    d.frames(2);
+    let latest = *d.reset_requests.last().expect("leaving the in-app modal rearms");
+    assert_ne!(latest, after_picker);
+    d.harness.input_mut().events.extend([
+        egui::Event::ImeResetCompleted { request_id: after_picker },
+        ime_commit("old"),
+        egui::Event::ImeResetCompleted { request_id: latest },
+        ime_preedit("が"),
+        ime_commit("が"),
+    ]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+}
+
+#[test]
+fn ime_reset_pointer_and_escape_suffix_controls_cannot_edit_the_abandoned_target() {
+    for escape in [false, true] {
+        let mut d = Driver::new();
+        let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+        d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+        d.frames(2);
+        d.harness.input_mut().events.push(ime_preedit("に"));
+        d.frames(1);
+        d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+        d.frames(1);
+        let old = *d.reset_requests.last().unwrap();
+        // An Escape right after a composition ends is the input method's; this one is the user's.
+        d.frames(4);
+        let boundary = if escape {
+            key_press(egui::Key::Escape)
+        } else {
+            egui::Event::PointerButton { pos: egui::pos2(-20.0, -20.0), button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE }
+        };
+        let undo = d.harness.state().session.history.undo.len();
+        d.harness.input_mut().events.extend([
+            ime_commit("old prefix"),
+            egui::Event::ImeResetCompleted { request_id: old },
+            boundary,
+            egui::Event::Text("wrong caret".into()),
+            egui::Event::Paste("wrong paste".into()),
+            egui::Event::Cut,
+            egui::Event::ImeResetCompleted { request_id: old },
+            ime_preedit("が"),
+            ime_commit("が"),
+        ]);
+        d.frames(1);
+        assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned()]);
+        assert_eq!(d.harness.state().session.history.undo.len(), undo);
+        if escape {
+            assert!(d.harness.state().ui.gfx_edit.is_none());
+            d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 0, "anchor": 0}}));
+        } else {
+            d.harness.input_mut().events.push(egui::Event::PointerButton {
+                pos: egui::pos2(-20.0, -20.0),
+                button: egui::PointerButton::Primary,
+                pressed: false,
+                modifiers: egui::Modifiers::NONE,
+            });
+        }
+        d.frames(2);
+        let current = *d.reset_requests.last().unwrap();
+        assert_ne!(old, current);
+        d.harness.input_mut().events.extend([
+            egui::Event::ImeResetCompleted { request_id: old },
+            ime_commit("old suffix"),
+            egui::Event::ImeResetCompleted { request_id: current },
+            ime_preedit("が"),
+            ime_commit("が"),
+        ]);
+        d.frames(1);
+        assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+    }
+}
+
+#[test]
+fn ime_reset_stock_text_edit_keeps_its_output_and_custom_return_gets_a_new_fence() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+    struct StockField {
+        enabled: Arc<AtomicBool>,
+        text: String,
+        id: egui::Id,
+    }
+    impl egui::Plugin for StockField {
+        fn debug_name(&self) -> &'static str {
+            "Film reset stock-field control"
+        }
+        fn on_begin_pass(&mut self, ui: &mut egui::Ui) {
+            if self.enabled.load(Ordering::Relaxed) {
+                ui.memory_mut(|memory| memory.request_focus(self.id));
+                ui.add(egui::TextEdit::singleline(&mut self.text).id(self.id));
+            }
+        }
+    }
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "alpha", 500.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(2);
+    let owner = d.ime().unwrap().owner;
+    d.harness.input_mut().events.push(ime_preedit("に"));
+    d.frames(1);
+    d.harness.input_mut().events.extend([ime_preedit(""), key_press(egui::Key::Home)]);
+    d.frames(1);
+    let first = *d.reset_requests.last().unwrap();
+    let edit = d.harness.state().ui.gfx_edit.clone();
+    let enabled = Arc::new(AtomicBool::new(true));
+    let id = egui::Id::unique("film-reset-stock-text-field");
+    d.harness.ctx.add_plugin(StockField { enabled: Arc::clone(&enabled), text: String::new(), id });
+    d.harness.input_mut().events.extend([egui::Event::ImeResetCompleted { request_id: first }, egui::Event::Text("stock".into())]);
+    d.frames(1);
+    let stock = d.ime().expect("the actual stock TextEdit retains its descriptor");
+    assert_ne!(stock.owner, owner);
+    assert!(stock.reset_request.is_none(), "a previously dispatched custom request cannot cause a NEW stock request");
+    assert_eq!(stock.surrounding_text.available().map(|p| p.text.as_str()), Some("stock"), "the stock field's own descriptor");
+    assert_eq!(d.harness.state().ui.gfx_edit, edit);
+    assert_eq!(layer_texts(&mut d, clip), vec!["alpha".to_owned()]);
+    enabled.store(false, Ordering::Relaxed);
+    d.harness.ctx.memory_mut(|memory| memory.surrender_focus(id));
+    d.frames(2);
+    let current = *d.reset_requests.last().unwrap();
+    assert_ne!(current, first);
+    assert_eq!(d.ime().unwrap().owner, owner);
+    d.harness.input_mut().events.extend([
+        egui::Event::ImeResetCompleted { request_id: first },
+        ime_commit("old"),
+        egui::Event::ImeResetCompleted { request_id: current },
+        ime_preedit("が"),
+        ime_commit("が"),
+    ]);
+    d.frames(1);
+    assert_eq!(layer_texts(&mut d, clip), vec!["がalpha".to_owned()]);
+}
+
+/// The concrete collision the uid-less fingerprint missed: two layers with identical static
+/// geometry (position, size, no name) but different text. Reordering, deleting and undoing must
+/// keep typing in the layer the user started editing, not in whatever now occupies its index.
+#[test]
+fn identical_layers_with_different_text_keep_the_edit_on_the_started_layer() {
+    let mut d = Driver::new();
+    let clip = d.exec("graphics.newText", json!({"text": "one", "position": [960, 540], "size": 100}))["clip"].as_u64().unwrap();
+    d.exec("graphics.newText", json!({"text": "two", "position": [960, 540], "size": 100, "clip": clip}));
+    let uids: Vec<u64> = d.exec("graphics.list", json!({"clip": clip}))["layers"].as_array().unwrap().iter().map(|l| l["uid"].as_u64().unwrap()).collect();
+    assert_eq!(uids.len(), 2);
+    assert!(uids.iter().all(|uid| *uid != 0));
+    assert_ne!(uids[0], uids[1], "identical geometry and different text get distinct identities");
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 3}}));
+    d.frames(3);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((0, uids[0])));
+
+    // Move the edited layer to the front. The other layer now sits at index 0 (same fingerprint).
+    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 0, "to": "front"}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((1, uids[0])));
+    d.ok("ui.type", json!({"text": "X"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["two".to_string(), "oneX".to_string()], "typing followed the uid, not index 0");
+
+    // Delete the layer below it; the edit stays on "oneX" and keeps typing there.
+    d.exec("graphics.deleteLayer", json!({"clip": clip, "layer": 0}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((0, uids[0])));
+    d.ok("ui.type", json!({"text": "Y"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["oneXY".to_string()]);
+
+    // Undo the typing and then the deletion: the same uid is edited at its restored index.
+    d.exec("edit.undo", json!({}));
+    d.frames(2);
+    d.exec("edit.undo", json!({}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.layer, e.uid)), Some((1, uids[0])));
+    d.ok("ui.type", json!({"text": "Z"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["two".to_string(), "oneXZ".to_string()]);
+}
+
+/// Every graphic layer created by `graphics.newText` has a stable uid. The edit target follows
+/// that uid through a real reorder, a real deletion below it, and undo/redo.
+#[test]
+fn edit_target_follows_reorder_delete_and_undo() {
+    let mut d = Driver::new();
+    let clip = new_text_layer(&mut d, None, "one", 400.0);
+    new_text_layer(&mut d, Some(clip), "two", 800.0);
+    new_text_layer(&mut d, Some(clip), "three", 1200.0);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 3, "anchor": 3}}));
+    d.frames(3);
+    let uid = d.harness.state().ui.gfx_edit.as_ref().map(|e| e.uid).unwrap_or(0);
+    assert_ne!(uid, 0, "the created layer has a stable uid");
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| e.layer), Some(0));
+
+    // Reorder layer 0 (the edited "one") to the front, then type: the text must follow it.
+    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 0, "to": "front"}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| e.layer), Some(2), "the edit follows the reordered layer");
+    d.ok("ui.type", json!({"text": "A"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["two".to_string(), "three".to_string(), "oneA".to_string()]);
+
+    // Undo the typing and then the arrange: the edit follows the same layer back to index 0.
+    d.exec("edit.undo", json!({}));
+    d.frames(2);
+    d.exec("edit.undo", json!({}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| e.layer), Some(0));
+    d.ok("ui.type", json!({"text": "B"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["oneB".to_string(), "two".to_string(), "three".to_string()]);
+
+    // Edit "two" (index 1), delete the layer below it, and keep typing into "two".
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 1, "caret": 3, "anchor": 3}}));
+    d.frames(2);
+    d.exec("graphics.deleteLayer", json!({"clip": clip, "layer": 0}));
+    d.frames(2);
+    assert_eq!(d.harness.state().ui.gfx_edit.as_ref().map(|e| e.layer), Some(0));
+    d.ok("ui.type", json!({"text": "D"}));
+    d.frames(2);
+    assert_eq!(layer_texts(&mut d, clip), vec!["twoD".to_string(), "three".to_string()]);
+}
+
+/// Replacing the project clears the edit and the IME owner even though `file.newProject` emits
+/// only `ProjectChanged`, and a project with no sequence has no editor to observe.
+#[test]
+fn new_project_without_a_sequence_clears_the_ime_edit() {
+    let mut d = Driver::new();
+    d.start_point_text();
+    d.ok("ui.type", json!({"text": "x"}));
+    d.frames(2);
+    assert!(d.ime().is_some(), "the text editor owns the IME before the replacement");
+    d.exec("file.newProject", json!({"name": "Fresh"}));
+    d.frames(3);
+    assert!(d.harness.state().ui.gfx_edit.is_none(), "the replaced document has no edit target");
+    assert!(d.ime().is_none(), "no sequence means no visible editor and no descriptor");
+}
+
+/// `engine.execute`/`ui.menu.invoke` run after the UI pass. A same-pass text change leaves the
+/// drawn caret stale, so that pass publishes no descriptor; the next pass draws and publishes
+/// the caret of the new text.
+#[test]
+fn ime_descriptor_follows_control_text_mutations_in_the_same_pass() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "one"}));
+    d.frames(3);
+    let before = d.ime().expect("the editor publishes");
+    // `ui.menu.invoke` is one of the requests drained after the frame, unlike `engine.execute`.
+    d.ok("ui.menu.invoke", json!({"id": "graphics.setText", "params": {"clip": clip, "layer": 0, "text": "a much longer line"}}));
+    assert!(d.ime().is_none(), "the old caret must not be published with the changed text");
+    d.frames(1);
+    let after = d.ime().expect("the next pass publishes the new layout");
+    assert_ne!(after.cursor_rect, before.cursor_rect, "the candidate window moved with the longer line");
+    d.frames(1);
+    let stable = d.ime().expect("a settled pass publishes again");
+    assert_eq!(stable.cursor_rect, after.cursor_rect, "the published geometry matches the next pass");
+}
+
+/// A hostile `ui.set.gfxEdit` offset inside a code point is clamped by the editor's next pass,
+/// which keeps publishing and leaves the text whole.
+#[test]
+fn invalid_gfx_edit_offsets_are_clamped() {
+    let mut d = Driver::new();
+    let clip = d.start_point_text();
+    d.ok("ui.type", json!({"text": "é😀"}));
+    d.frames(3);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 1, "anchor": 2}}));
+    d.frames(1);
+    assert!(d.ime().is_some(), "the clamped editor publishes");
+    assert_eq!(caret(&d), (0, 2));
+    assert_eq!(layer_texts(&mut d, clip), vec!["é😀".to_string()]);
+}
+
+/// #2430: a click (no drag) in the text being edited on the monitor puts the caret there; before,
+/// only a press that moved a little did, and typing went on at the end.
+#[test]
+fn a_click_in_the_edited_text_moves_the_caret() {
+    let mut d = Driver::new();
+    d.ok("ui.set", json!({"tool": "Type"}));
+    d.frames(3);
+    let pic = d.rect("program.picture");
+    d.ok("ui.click", json!({"x": pic[0] + pic[2] * 0.3, "y": pic[1] + pic[3] * 0.2}));
+    d.ok("ui.type", json!({"text": "Title"}));
+    d.frames(2);
+    let text = d.rect("program.textEdit");
+    // just inside the first letter: the caret goes before it
+    d.ok("ui.click", json!({"x": text[0] + 1.0, "y": text[1] + text[3] / 2.0}));
+    d.frames(2);
+    d.ok("ui.type", json!({"text": "X"}));
+    d.frames(2);
+    assert_eq!(d.exec("graphics.list", json!({}))["layers"][0]["text"], "XTitle");
+}
+
+#[test]
+fn text_properties_switches_between_point_and_paragraph_text() {
+    let mut d = Driver::new();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let (clip, pre) = d.paragraph_text();
+    let tl = d.handle(&pre, 0);
+    d.ok("ui.click", json!({"id": "graphics.textProperties"}));
+    d.frames(3);
+    d.ok("ui.click", json!({"id": "graphics.textProperties.type"}));
+    d.frames(3);
+    d.shot("text-properties-type-list");
+    d.ok("ui.click", json!({"id": "graphics.textProperties.type.point"}));
+    d.frames(3);
+    assert_eq!(d.layer(clip)["textType"], "paragraph", "nothing happens before OK");
+    d.shot("text-properties-dialog");
+    d.ok("ui.click", json!({"id": "graphics.textProperties.ok"}));
+    d.frames(4);
+    let l = d.layer(clip);
+    assert_eq!(l["textType"], "point");
+    assert!(l["text"].as_str().unwrap().contains('\n'), "the wrapped lines are real lines now: {}", l["text"]);
+    assert!(near(d.at(&pre, "anchor"), tl), "the anchor stays where the box's corner was");
+    assert!(d.ok("ui.elements", json!({"prefix": "graphics.textProperties.ok"})).as_array().unwrap().is_empty(), "the dialog closed");
+    // its handles scale it now
+    d.drag_handle(&pre, 2, 0.0, 40.0);
+    assert!(num(&d.layer(clip)["scale"]) > 101.0);
+
+    // Cancel changes nothing
+    d.ok("ui.click", json!({"id": "graphics.textProperties"}));
+    d.frames(3);
+    d.ok("ui.click", json!({"id": "graphics.textProperties.type"}));
+    d.frames(3);
+    d.ok("ui.click", json!({"id": "graphics.textProperties.type.paragraph"}));
+    d.frames(3);
+    d.ok("ui.click", json!({"id": "graphics.textProperties.cancel"}));
+    d.frames(3);
+    assert_eq!(d.layer(clip)["textType"], "point");
+}
+
+#[test]
+fn shape_corner_handles_scale_away_from_the_opposite_corner() {
+    let mut d = Driver::new();
+    let pre = d.shape();
+    // bottom-right: grows down and to the right, the top-left stays
+    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    d.drag_handle(&pre, 2, 60.0, 30.0);
+    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    assert!(near(tl, tl2), "top-left stays put: {tl:?} -> {tl2:?}");
+    assert!(br2.0 > br.0 + 20.0 && br2.1 > br.1 + 5.0, "bottom-right follows the pointer: {br:?} -> {br2:?}");
+    // bottom-left: grows down and to the left, the top-right stays
+    let (tr, bl) = (d.handle(&pre, 1), d.handle(&pre, 3));
+    d.drag_handle(&pre, 3, -60.0, 30.0);
+    let (tr2, bl2) = (d.handle(&pre, 1), d.handle(&pre, 3));
+    assert!(near(tr, tr2), "top-right stays put: {tr:?} -> {tr2:?}");
+    assert!(bl2.0 < bl.0 - 20.0 && bl2.1 > bl.1 + 5.0, "bottom-left follows the pointer: {bl:?} -> {bl2:?}");
+}
+
+#[test]
+fn graphic_resize_handles_show_their_screen_space_direction() {
+    let mut d = Driver::new();
+    let r = d.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [500, 300]}));
+    let clip = r["clip"].as_u64().unwrap();
+    let pre = d.select(clip);
+
+    for (handle, expected) in [
+        (0, egui::CursorIcon::ResizeNwSe),
+        (1, egui::CursorIcon::ResizeNeSw),
+        (2, egui::CursorIcon::ResizeNwSe),
+        (3, egui::CursorIcon::ResizeNeSw),
+        (4, egui::CursorIcon::ResizeVertical),
+        (5, egui::CursorIcon::ResizeHorizontal),
+        (6, egui::CursorIcon::ResizeVertical),
+        (7, egui::CursorIcon::ResizeHorizontal),
+    ] {
+        let at = d.handle(&pre, handle);
+        d.hover(at);
+        assert_eq!(d.cursor(), expected, "handle {handle}");
+    }
+
+    d.exec("graphics.set", json!({"clip": clip, "props": {"rotation": 45}}));
+    d.frames(4);
+    let at = d.handle(&pre, 4);
+    d.hover(at);
+    assert!(
+        matches!(d.cursor(), egui::CursorIcon::ResizeNeSw | egui::CursorIcon::ResizeNwSe),
+        "rotated edge handle should use a diagonal cursor, got {:?}",
+        d.cursor()
+    );
+}
+
+/// Width and height of a layer's box in its own pixels.
+fn box_size(l: &Value) -> (f64, f64) {
+    let b = &l["localBounds"];
+    (num(&b[2]) - num(&b[0]), num(&b[3]) - num(&b[1]))
+}
+
+#[test]
+fn shape_handles_change_its_size_and_shift_keeps_the_ratio() {
+    let mut d = Driver::new();
+    let pre = d.shape();
+    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
+    // a corner straight right: only wider, as in Premiere; the Size changes, not the Scale
+    let (tl, br, anchor) = (d.handle(&pre, 0), d.handle(&pre, 2), d.at(&pre, "anchor"));
+    let before = d.layer(clip);
+    d.drag_handle(&pre, 2, 60.0, 0.0);
+    let l = d.layer(clip);
+    assert_eq!((num(&l["scale"]), num(&l["scaleWidth"])), (100.0, 100.0), "{l}");
+    let (w, h) = box_size(&l);
+    assert!(w > 510.0 && (h - 300.0).abs() < 1e-3, "wider, as tall: {w} x {h}");
+    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    assert!(near(tl, tl2), "top-left stays put: {tl:?} -> {tl2:?}");
+    assert!(near(br2, (br.0 + 60.0, br.1)), "bottom-right follows the pointer: {br:?} -> {br2:?}");
+    assert!(near(d.at(&pre, "anchor"), anchor), "the anchor point stays put");
+    assert_eq!(l["position"], before["position"]);
+
+    // with Shift both sides grow alike from the opposite corner
+    d.hold_shift(true);
+    d.drag_handle(&pre, 2, 40.0, 0.0);
+    d.hold_shift(false);
+    let l2 = d.layer(clip);
+    let (w2, h2) = box_size(&l2);
+    assert!(h2 > 310.0, "taller too: {w2} x {h2}");
+    assert!((w2 / h2 - w / h).abs() < 1e-3, "same proportions: {w}x{h} -> {w2}x{h2}");
+    assert!(near(d.handle(&pre, 0), tl), "top-left still stays put");
+    assert_eq!(num(&l2["scale"]), 100.0);
+    // one undo step per drag
+    d.exec("edit.undo", json!({}));
+    assert_eq!(box_size(&d.layer(clip)), (w, h));
+}
+
+#[test]
+fn polygon_handles_keep_the_opposite_corner() {
+    let mut d = Driver::new();
+    let r = d.exec("graphics.newPolygon", json!({"sides": 5, "position": [800, 500], "size": [300, 300]}));
+    let pre = d.select(r["clip"].as_u64().unwrap());
+    // a pentagon's box is not centred on the shape's origin; the top-left corner stays anyway
+    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    d.drag_handle(&pre, 2, 50.0, 40.0);
+    assert!(near(d.handle(&pre, 0), tl), "top-left stays put");
+    assert!(near(d.handle(&pre, 2), (br.0 + 50.0, br.1 + 40.0)), "bottom-right follows the pointer");
+}
+
+/// The Corner Radius of the shape layer of graphic clip `clip`.
+fn corner_radius(d: &mut Driver, clip: u64) -> f64 {
+    let s = &d.harness.state().session;
+    let (_, it) = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap();
+    let e = it.effects.iter().find(|e| e.effect == "graphic_shape").unwrap();
+    e.param("corner_radius").unwrap().value_at(filmcraft_time::Tick::ZERO).as_f64().unwrap()
+}
+
+#[test]
+fn a_rectangles_corner_circles_round_all_its_corners() {
+    let mut d = Driver::new();
+    let pre = d.shape();
+    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
+    let (tl, br) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    let k = (br.0 - tl.0) / 500.0; // screen points per layer pixel
+    let corners: Vec<(f64, f64)> = (0..4).map(|n| d.at(&pre, &format!("corner.{n}"))).collect();
+    // just inside each corner, on its diagonal
+    assert!(corners[0].0 > tl.0 + 5.0 && corners[0].1 > tl.1 + 5.0 && corners[2].0 < br.0 - 5.0 && corners[2].1 < br.1 - 5.0, "{corners:?}");
+
+    // the top-left circle dragged 40 points down and right: a radius of 40 points' travel
+    d.drag(corners[0], (40.0, 40.0));
+    let r = corner_radius(&mut d, clip);
+    assert!((r - 40.0 / k).abs() < 2.0, "radius {r}, expected {}", 40.0 / k);
+    // the circles moved in to the radius, all four alike
+    let (tl2, br2) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    assert!(near(tl, tl2) && near(br, br2), "the box stays");
+    let c0 = d.at(&pre, "corner.0");
+    let c2 = d.at(&pre, "corner.2");
+    assert!(near(c0, (tl.0 + r * k, tl.1 + r * k)) && near(c2, (br.0 - r * k, br.1 - r * k)), "{c0:?} {c2:?}");
+
+    // any circle drags all four; past the middle it stops at half the shorter side
+    d.drag(c2, (-300.0, -300.0));
+    assert_eq!(corner_radius(&mut d, clip), 150.0);
+    // back out squares them; one undo step per drag
+    let c1 = d.at(&pre, "corner.1");
+    d.drag(c1, (200.0, -200.0));
+    assert_eq!(corner_radius(&mut d, clip), 0.0);
+    d.exec("edit.undo", json!({}));
+    assert_eq!(corner_radius(&mut d, clip), 150.0);
+}
+
+#[test]
+fn only_rectangles_big_enough_get_corner_circles() {
+    let mut d = Driver::new();
+    let r = d.exec("graphics.newShape", json!({"shape": "ellipse", "position": [800, 500], "size": [500, 300]}));
+    let pre = d.select(r["clip"].as_u64().unwrap());
+    assert!(d.ok("ui.elements", json!({"prefix": format!("{pre}corner")})).as_array().unwrap().is_empty(), "an ellipse has none");
+    let r = d.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [20, 20]}));
+    let pre = d.select(r["clip"].as_u64().unwrap());
+    assert!(d.ok("ui.elements", json!({"prefix": format!("{pre}corner")})).as_array().unwrap().is_empty(), "a tiny rectangle has none");
+}
+
+#[test]
+fn shape_edge_handles_stretch_one_axis() {
+    let mut d = Driver::new();
+    let pre = d.shape();
+    // bottom edge: taller downwards, the top edge and the width stay
+    let (tl, tr, bottom) = (d.handle(&pre, 0), d.handle(&pre, 1), d.handle(&pre, 6));
+    d.drag_handle(&pre, 6, 0.0, 40.0);
+    let (tl2, tr2, bottom2) = (d.handle(&pre, 0), d.handle(&pre, 1), d.handle(&pre, 6));
+    assert!(near(tl, tl2) && near(tr, tr2), "top edge stays put: {tl:?} {tr:?} -> {tl2:?} {tr2:?}");
+    assert!((bottom2.1 - bottom.1 - 40.0).abs() < 2.0 && (bottom2.0 - bottom.0).abs() < 1.5, "bottom follows the pointer: {bottom:?} -> {bottom2:?}");
+    // right edge: wider to the right, the left edge and the height stay
+    let (tl, bl, right) = (d.handle(&pre, 0), d.handle(&pre, 3), d.handle(&pre, 5));
+    d.drag_handle(&pre, 5, 50.0, 0.0);
+    let (tl2, bl2, right2) = (d.handle(&pre, 0), d.handle(&pre, 3), d.handle(&pre, 5));
+    assert!(near(tl, tl2) && near(bl, bl2), "left edge stays put: {tl:?} {bl:?} -> {tl2:?} {bl2:?}");
+    assert!((right2.0 - right.0 - 50.0).abs() < 2.0 && (right2.1 - right.1).abs() < 1.5, "right follows the pointer: {right:?} -> {right2:?}");
+    // top edge: taller upwards, the bottom edge stays
+    let (bl, top) = (d.handle(&pre, 3), d.handle(&pre, 4));
+    d.drag_handle(&pre, 4, 0.0, -30.0);
+    let (bl2, top2) = (d.handle(&pre, 3), d.handle(&pre, 4));
+    assert!(near(bl, bl2), "bottom edge stays put: {bl:?} -> {bl2:?}");
+    assert!((top2.1 - top.1 + 30.0).abs() < 2.0, "top follows the pointer: {top:?} -> {top2:?}");
+}
+
+#[test]
+fn a_hidden_layer_has_no_box_and_cannot_be_clicked() {
+    let mut d = Driver::new();
+    let pre = d.shape();
+    let clip: u64 = pre.split('.').nth(2).unwrap().parse().unwrap();
+    let layer = format!("program.layer.{clip}.0");
+    let ids = |d: &mut Driver| -> Vec<String> {
+        let v = d.ok("ui.elements", json!({"prefix": layer}));
+        v.as_array().unwrap().iter().map(|e| e["id"].as_str().unwrap().to_string()).collect()
+    };
+    assert_eq!(ids(&mut d).len(), 14, "the layer, its eight handles, four corner circles and its anchor: {:?}", ids(&mut d));
+    let r = d.rect(&layer);
+    let inside = (r[0] + r[2] / 4.0, r[1] + r[3] / 2.0);
+
+    // visibility off: still selected in the panel, but nothing of it is on the monitor
+    d.exec("graphics.set", json!({"clip": clip, "props": {"enabled": false}}));
+    d.frames(4);
+    assert_eq!(ids(&mut d), Vec::<String>::new());
+    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": []}));
+    d.ok("ui.click", json!({"x": inside.0, "y": inside.1}));
+    d.frames(4);
+
+    // visibility on: the click where it was selected nothing, so it has no handles; now it can be clicked
+    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"enabled": true}}));
+    d.frames(4);
+    assert_eq!(ids(&mut d), vec![layer.clone()], "not selected: no handles");
+    // (elsewhere on it, so that the two clicks are not a double click)
+    d.ok("ui.click", json!({"x": r[0] + r[2] * 0.75, "y": inside.1}));
+    d.frames(4);
+    assert_eq!(ids(&mut d).len(), 14);
+}
+
+/// A double-click on a text layer edits it with all its text selected, so typing replaces it; while
+/// it is edited, Select All selects the text again, not the timeline clips, as in Premiere (#1102).
+#[test]
+fn double_click_and_select_all_select_the_text_being_edited() {
+    let mut d = Driver::new();
+    let (clip, pre) = d.point_text();
+    let (a, b) = (d.handle(&pre, 0), d.handle(&pre, 2));
+    d.ok("ui.click", json!({"x": (a.0 + b.0) / 2.0, "y": (a.1 + b.1) / 2.0, "count": 2}));
+    d.frames(4);
+    let edit = |d: &Driver| d.harness.state().ui.gfx_edit.as_ref().map(|e| (e.clip, e.layer, e.anchor, e.caret));
+    assert_eq!(edit(&d), Some((clip, 0, 0, "Title".len())), "the double-click selects the whole text");
+
+    // caret at the end, then Select All as the native macOS menu sends it (it takes Cmd+A first)
+    if let Some(e) = d.harness.state_mut().ui.gfx_edit.as_mut() {
+        (e.anchor, e.caret) = (5, 5);
+    }
+    let selection = d.harness.state().session.state.selection.clone();
+    let (tx, rx) = channel();
+    d.harness.state_mut().command_inbox = Some(rx);
+    tx.send("edit.selectAll".to_string()).unwrap();
+    d.frames(2);
+    assert_eq!(edit(&d), Some((clip, 0, 0, 5)), "Select All selects the text being edited");
+    assert_eq!(d.harness.state().session.state.selection, selection, "and leaves the timeline selection alone");
+}
diff --git a/crates/ui-egui/tests/graphics_notice_ui.rs b/crates/ui-egui/tests/it/graphics_notice_ui.rs
similarity index 93%
rename from crates/ui-egui/tests/graphics_notice_ui.rs
rename to crates/ui-egui/tests/it/graphics_notice_ui.rs
index bd743ef17..e8805dc58 100644
--- a/crates/ui-egui/tests/graphics_notice_ui.rs
+++ b/crates/ui-egui/tests/it/graphics_notice_ui.rs
@@ -115,9 +115,11 @@ fn a_reset_that_cannot_be_saved_says_why_and_keeps_the_button() {
 fn the_notice_follows_the_interface_language() {
     let notice = GraphicsNotice::new("software rendering", Box::new(|| Ok(())));
     let mut d = Driver::new(Some(notice));
-    d.app().ui.language = filmcraft_ui_egui::i18n::Language::Es;
+    let es = filmcraft_ui_egui::i18n::Language::Es;
+    d.app().ui.language = es;
     d.frames(3);
-    assert_eq!(d.label("graphics.notice"), "Modo gráfico seguro: procesamiento por software");
-    assert_eq!(d.label("graphics.notice.reset"), "Usar gráficos predeterminados");
+    let title = filmcraft_ui_egui::i18n::fmt(es.tr("Safe graphics mode: {mode}"), &[("mode", es.tr("software rendering"))]);
+    assert_eq!(d.label("graphics.notice"), title);
+    assert_eq!(d.label("graphics.notice.reset"), es.tr("Use Default Graphics"));
     filmcraft_ui_egui::i18n::set_current(filmcraft_ui_egui::i18n::Language::En);
 }
diff --git a/crates/ui-egui/tests/graphics_templates_ui.rs b/crates/ui-egui/tests/it/graphics_templates_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/graphics_templates_ui.rs
rename to crates/ui-egui/tests/it/graphics_templates_ui.rs
diff --git a/crates/ui-egui/tests/it/graphics_ui.rs b/crates/ui-egui/tests/it/graphics_ui.rs
new file mode 100644
index 000000000..fe3c3e2d0
--- /dev/null
+++ b/crates/ui-egui/tests/it/graphics_ui.rs
@@ -0,0 +1,489 @@
+//! Graphics UI, driven headless through the control channel (like `scripted.rs`): the Type tool
+//! creates a text layer on the Program monitor, typing and keys edit it, the Properties panel's
+//! controls style it, the Selection tool moves it.
+//!
+//! With `FILMCRAFT_UI_SHOTS=<dir>` the test also renders the UI with wgpu (works without a
+//! window or an unlocked screen) and writes PNGs there for review.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+    shots: Option<std::path::PathBuf>,
+}
+
+impl Driver {
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let shots = std::env::var_os("FILMCRAFT_UI_SHOTS").map(std::path::PathBuf::from);
+        let mut b = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000);
+        if shots.is_some() {
+            b = b.wgpu().with_pixels_per_point(1.0);
+        }
+        let harness = b.build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx, shots };
+        d.frames(4);
+        d
+    }
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+    fn call(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                return v;
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let r = self.call(method, params.clone());
+        assert_eq!(r["ok"], true, "{method} {params}: {r}");
+        r["result"].clone()
+    }
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+    fn rect(&mut self, id: &str) -> [f64; 4] {
+        let v = self.ok("ui.elements", json!({"prefix": id}));
+        let e = v.as_array().unwrap().iter().find(|e| e["id"] == id).unwrap_or_else(|| panic!("no element {id}: {v}")).clone();
+        let r: Vec<f64> = e["rect"].as_array().unwrap().iter().map(|x| x.as_f64().unwrap()).collect();
+        [r[0], r[1], r[2], r[3]]
+    }
+    fn shot(&mut self, name: &str) {
+        let Some(dir) = self.shots.clone() else { return };
+        self.frames(8);
+        let img = self.harness.render().expect("wgpu render");
+        std::fs::create_dir_all(&dir).unwrap();
+        img.save(dir.join(format!("{name}.png"))).unwrap();
+    }
+}
+
+#[test]
+fn type_tool_edit_style_and_move() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    d.exec("playhead.set", json!({"seconds": 2}));
+    d.ok("ui.set", json!({"tool": "Type"}));
+    d.frames(3);
+    let pic = d.rect("program.picture");
+    let (px, py) = (pic[0] + pic[2] * 0.2, pic[1] + pic[3] * 0.35);
+    d.ok("ui.click", json!({"x": px, "y": py}));
+    d.ok("ui.type", json!({"text": "Night Drive"}));
+    d.ok("ui.key", json!({"key": "Enter"}));
+    d.ok("ui.type", json!({"text": "through the city"}));
+    let list = d.exec("graphics.list", json!({}));
+    assert_eq!(list["layers"][0]["text"], "Night Drive\nthrough the city", "{list}");
+    // caret editing: Backspace ×4, select the word "Drive" with Shift+arrows… then retype
+    for _ in 0..4 {
+        d.ok("ui.key", json!({"key": "Backspace"}));
+    }
+    d.ok("ui.type", json!({"text": "town"}));
+    d.ok("ui.key", json!({"key": "ArrowUp"}));
+    d.ok("ui.key", json!({"key": "End"}));
+    for _ in 0..5 {
+        d.ok("ui.key", json!({"key": "Shift+ArrowLeft"}));
+    }
+    d.ok("ui.type", json!({"text": "Ride"}));
+    let list = d.exec("graphics.list", json!({}));
+    assert_eq!(list["layers"][0]["text"], "Night Ride\nthrough the town", "{list}");
+    // one undo step for the whole typing session (after "New Graphic")
+    let hist = d.exec("history.list", json!({}));
+    let undo: Vec<&str> = hist["undo"].as_array().unwrap().iter().filter_map(Value::as_str).collect();
+    assert_eq!(&undo[undo.len() - 2..], ["New Graphic", "Edit Text"], "{undo:?}");
+    d.shot("type-tool-editing");
+
+    // style through the Properties panel controls
+    d.ok("ui.key", json!({"key": "Escape"}));
+    d.ok("ui.set", json!({"tool": "Selection"}));
+    d.ok("ui.click", json!({"id": "graphics.prop.faux_bold"}));
+    d.ok("ui.click", json!({"id": "graphics.prop.align.1"}));
+    d.ok("ui.click", json!({"id": "graphics.prop.stroke"}));
+    d.ok("ui.click", json!({"id": "graphics.prop.shadow"}));
+    let clip = list["clip"].as_u64().unwrap();
+    d.exec("graphics.set", json!({"clip": clip, "props": {"font_style": "Bold", "fill_color": "#ffd23f", "size": 120}}));
+    let seq = d.exec("sequence.inspect", json!({}));
+    let s = seq.to_string();
+    assert!(s.contains("graphic_text"), "graphic layer in the sequence");
+    let list2 = d.exec("graphics.list", json!({"clip": clip}));
+    let q0 = list2["layers"][0]["quad"][0][0].as_f64().unwrap();
+    // selection-tool drag moves the layer
+    let lr = d.rect(&format!("program.layer.{clip}.0"));
+    let pic = d.rect("program.picture");
+    // a point on the layer that is inside the picture
+    let x0 = lr[0].max(pic[0]);
+    let x1 = (lr[0] + lr[2]).min(pic[0] + pic[2]);
+    let (cx, cy) = ((x0 + x1) / 2.0, lr[1] + lr[3] * 0.3);
+    let from = json!({"x": cx, "y": cy});
+    let to = json!({"x": cx + 60.0, "y": cy + 20.0});
+    d.ok("ui.drag", json!({"from": from, "to": to, "steps": 6}));
+    let list3 = d.exec("graphics.list", json!({"clip": clip}));
+    let q1 = list3["layers"][0]["quad"][0][0].as_f64().unwrap();
+    assert!(q1 > q0 + 20.0, "moved right: {q0} → {q1}");
+    d.shot("properties-styled");
+
+    // shapes: rectangle tool drag
+    d.ok("ui.set", json!({"tool": "Rectangle"}));
+    let pic = d.rect("program.picture");
+    d.ok("ui.drag", json!({"from": {"x": pic[0] + pic[2] * 0.15, "y": pic[1] + pic[3] * 0.75}, "to": {"x": pic[0] + pic[2] * 0.85, "y": pic[1] + pic[3] * 0.9}, "steps": 5}));
+    let list4 = d.exec("graphics.list", json!({"clip": clip}));
+    assert_eq!(list4["layers"].as_array().unwrap().len(), 2, "{list4}");
+    assert_eq!(list4["layers"][1]["kind"], "Rectangle");
+    d.exec("graphics.arrangeLayer", json!({"clip": clip, "layer": 1, "to": "back"}));
+    d.ok("ui.set", json!({"tool": "Selection"}));
+    d.shot("shape-layer");
+}
+
+/// Properties-panel choice and stroke-width accessible names follow the interface language, while
+/// the automation ids and the values shown stay those of the property.
+#[test]
+fn choice_and_stroke_width_accessible_names_follow_language() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let clip = d.exec("graphics.newShape", json!({"shape": "rectangle", "position": [800, 500], "size": [500, 300]}))["clip"].as_u64().unwrap();
+    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
+    d.frames(4);
+
+    assert_eq!(d.harness.get_by_role_and_label(Role::ComboBox, "Shape").value().as_deref(), Some("Rectangle"));
+
+    d.exec("prefs.set", json!({"key": "general.interfaceLanguage", "value": "es"}));
+    d.frames(4);
+    let es = filmcraft_ui_egui::i18n::Language::Es;
+    for (label, value) in [("Shape", "Rectangle"), ("Fill Type", "Solid"), ("Stroke Type", "Outer"), ("Stroke 2 Type", "Outer")] {
+        assert_eq!(
+            d.harness.get_by_role_and_label(Role::ComboBox, es.tr(label)).value().as_deref(),
+            Some(es.tr(value)),
+            "{label} keeps its translated name and selected value"
+        );
+    }
+
+    // The widget still writes the property it names, and its automation id does not change.
+    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"shape": "ellipse", "stroke2_type": "center"}}));
+    d.frames(4);
+    assert_eq!(d.harness.get_by_role_and_label(Role::ComboBox, es.tr("Shape")).value().as_deref(), Some(es.tr("Ellipse")));
+    assert_eq!(d.harness.get_by_role_and_label(Role::ComboBox, es.tr("Stroke 2 Type")).value().as_deref(), Some(es.tr("Center")));
+    let ids: Vec<String> =
+        d.ok("ui.elements", json!({"prefix": "graphics.prop."})).as_array().unwrap().iter().filter_map(|e| e["id"].as_str().map(str::to_string)).collect();
+    for id in ["graphics.prop.shape", "graphics.prop.fill_kind", "graphics.prop.stroke_type", "graphics.prop.stroke2_type"] {
+        assert!(ids.iter().any(|i| i == id), "{id} is still registered: {ids:?}");
+    }
+
+    // Each stroke width opens its editor under the complete translated catalog entry, not an
+    // English " width" suffix appended to a translated label.
+    for _ in 0..20 {
+        if d.rect("graphics.prop.stroke_width")[1] < 900.0 {
+            break;
+        }
+        d.ok("ui.scroll", json!({"id": "graphics.prop.shape", "dy": -200.0}));
+        d.frames(2);
+    }
+    d.ok("ui.click", json!({"id": "graphics.prop.stroke_width"}));
+    d.frames(3);
+    assert_eq!(
+        d.harness.get_by_role_and_label(Role::TextInput, es.tr("Stroke Width")).value().as_deref(),
+        Some("4.0"),
+        "the first stroke width editor has the translated label"
+    );
+    d.ok("ui.click", json!({"id": "graphics.prop.stroke2_width"}));
+    d.frames(3);
+    assert_eq!(
+        d.harness.get_by_role_and_label(Role::TextInput, es.tr("Stroke 2 Width")).value().as_deref(),
+        Some("10.0"),
+        "the second stroke width editor has its own translated label"
+    );
+    filmcraft_ui_egui::i18n::set_current(filmcraft_ui_egui::i18n::Language::En);
+}
+
+/// Effect Controls' Text parameter (graphic layers' Source Text / name / font fields) names its
+/// text editor with the translated parameter label, like the boolean and choice arms.
+#[test]
+fn effect_controls_text_accessible_name_follows_language() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let clip = d.exec("graphics.newText", json!({"text": "Night Drive"}))["clip"].as_u64().unwrap();
+    d.exec("timeline.select", json!({"clips": [clip]}));
+    d.ok("ui.panel.show", json!({"panel": "Effect Controls"}));
+    d.frames(4);
+
+    d.exec("prefs.set", json!({"key": "general.interfaceLanguage", "value": "es"}));
+    d.frames(4);
+    let es = filmcraft_ui_egui::i18n::Language::Es;
+    assert_eq!(
+        d.harness.get_by_role_and_label(Role::TextInput, es.tr("Source Text")).value().as_deref(),
+        Some("Night Drive"),
+        "the translated accessible name and the same value"
+    );
+    let elements = d.ok("ui.elements", json!({"prefix": "effectControls.text."}));
+    assert!(
+        elements.as_array().unwrap().iter().any(|e| e["id"].as_str().is_some_and(|id| id.ends_with(".text"))),
+        "the Source Text automation id is unchanged: {elements}"
+    );
+    filmcraft_ui_egui::i18n::set_current(filmcraft_ui_egui::i18n::Language::En);
+}
+
+/// The value of `param` on the text layer of graphic clip `clip`, at its first frame.
+fn text_param(d: &mut Driver, clip: u64, param: &str) -> Option<filmcraft_project::ParamValue> {
+    let s = &d.harness.state().session;
+    let (_, it) = s.active_sequence()?.find_item(filmcraft_project::ClipId(clip))?;
+    let e = it.effects.iter().find(|e| e.effect == "graphic_text")?;
+    Some(e.param(param)?.value_at(filmcraft_time::Tick::ZERO))
+}
+
+/// A drag of a property in the Properties panel is one undo step, so one Cmd+Z restores the
+/// original value (a drag was committing one undo step per frame, so undo only stepped back one
+/// frame's worth; the shadow color picker showed it as "sometimes undo works, sometimes not").
+#[test]
+fn a_property_drag_is_one_undo_step() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let r = d.exec("graphics.newText", json!({"text": "Title"}));
+    let clip = r["clip"].as_u64().unwrap();
+    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
+    d.frames(4);
+    // the layer's Opacity number (visible in the Align and Transform section)
+    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"opacity": 50}}));
+    d.frames(2);
+    let opacity = |d: &mut Driver| -> f64 { text_param(d, clip, "opacity").and_then(|v| v.as_f64()).unwrap() };
+    let before = opacity(&mut d);
+    let undo0 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    // drag the Opacity number to the left: several move frames, one undo step
+    let n = d.rect("graphics.prop.opacity");
+    let (cx, cy) = (n[0] + n[2] / 2.0, n[1] + n[3] / 2.0);
+    d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx - 60.0, "y": cy}, "steps": 6}));
+    d.frames(4);
+    let after = opacity(&mut d);
+    assert!(after < before - 5.0, "the drag changed the opacity: {before} -> {after}");
+    let undo1 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    assert_eq!(undo1, undo0 + 1, "a property drag is one undo step");
+    d.exec("edit.undo", json!({}));
+    assert_eq!(opacity(&mut d), before, "one undo restores the original value");
+}
+
+/// The shadow color picker popup: a drag in the 2D picker is one undo step, so one Cmd+Z
+/// restores the original color (a drag was committing one undo step per frame, so undo only
+/// stepped back one frame's worth — the reported "sometimes undo works, sometimes not").
+#[test]
+fn shadow_color_drag_is_one_undo_step() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let r = d.exec("graphics.newText", json!({"text": "Title"}));
+    let clip = r["clip"].as_u64().unwrap();
+    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
+    d.frames(4);
+    let color = |d: &mut Driver| text_param(d, clip, "shadow_color").and_then(|v| v.as_color());
+    // scroll the properties panel so the shadow row is visible, then open the picker
+    d.ok("ui.scroll", json!({"x": 1400.0, "y": 500.0, "dx": 0.0, "dy": -400.0}));
+    d.frames(3);
+    let sw = d.rect("graphics.prop.shadow_color");
+    d.ok("ui.click", json!({"x": sw[0] + sw[2] / 2.0, "y": sw[1] + sw[3] / 2.0}));
+    d.frames(3);
+    // the popup flips above the swatch (it does not fit below); find a point in its 2D picker
+    let undo0 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    let mut hit = None;
+    for (dx, dy) in [(30.0, 30.0), (150.0, 30.0), (30.0, 150.0), (150.0, 150.0)] {
+        let (px, py) = (sw[0] + dx, sw[1] - dy);
+        let before = color(&mut d);
+        d.ok("ui.drag", json!({"from": {"x": px, "y": py}, "to": {"x": px + 60.0, "y": py + 40.0}, "steps": 4}));
+        d.frames(3);
+        let after = color(&mut d);
+        if after != before {
+            hit = Some((before, after));
+            break;
+        }
+    }
+    let (before, after) = hit.expect("no drag point hit the color picker");
+    assert_ne!(after, before, "the drag changed the shadow color");
+    let undo1 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    assert_eq!(undo1, undo0 + 1, "a color drag is one undo step");
+    d.exec("edit.undo", json!({}));
+    assert_eq!(color(&mut d), before, "one undo restores the original color");
+}
+
+/// Character ranges use setCharStyle, but must share the same one-gesture undo rule as a layer.
+#[test]
+fn selected_character_size_drag_is_one_undo_step() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace":"Captions and Graphics","tool":"Type"}));
+    d.exec("playhead.set", json!({"seconds":2}));
+    d.frames(3);
+    let p = d.rect("program.picture");
+    d.ok("ui.click", json!({"x":p[0]+p[2]*0.2,"y":p[1]+p[3]*0.35}));
+    d.ok("ui.type", json!({"text":"Undo drag test"}));
+    d.ok("ui.key", json!({"key":"Cmd+A"}));
+    d.frames(3);
+    let before = d.harness.state().session.project.clone();
+    let n = d.harness.state().session.history.undo.len();
+    let r = d.rect("graphics.prop.size");
+    d.ok("ui.drag", json!({"from":{"x":r[0]+r[2]/2.0,"y":r[1]+r[3]/2.0},"to":{"x":r[0]+r[2]/2.0+80.0,"y":r[1]+r[3]/2.0},"steps":8}));
+    d.frames(3);
+    assert_eq!(d.harness.state().session.history.undo.len(), n + 1);
+    let after = d.harness.state().session.project.clone();
+    assert_ne!(*after, *before);
+    d.exec("edit.undo", json!({}));
+    assert_eq!(*d.harness.state().session.project, *before);
+    d.exec("edit.redo", json!({}));
+    assert_eq!(*d.harness.state().session.project, *after);
+}
+
+/// The Properties panel's stopwatches animate a layer property (#2358): Tracking (letter
+/// spacing) gets keyframes from the Essential Graphics panel itself, a change at another time
+/// adds a keyframe there instead of changing the value everywhere, and the stopwatch turns
+/// keyframing off again.
+#[test]
+fn the_tracking_stopwatch_animates_letter_spacing() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    d.exec("playhead.set", json!({"seconds": 0.0}));
+    let r = d.exec("graphics.newText", json!({"text": "Title", "seconds": 4}));
+    let clip = r["clip"].as_u64().unwrap();
+    d.exec("graphics.selectLayer", json!({"clip": clip, "layers": [0]}));
+    d.frames(4);
+    for _ in 0..20 {
+        if d.rect("graphics.prop.tracking")[1] < 800.0 {
+            break;
+        }
+        d.ok("ui.scroll", json!({"id": "graphics.prop.scale", "dy": -200.0}));
+        d.frames(2);
+    }
+    let keys = |d: &mut Driver| -> Vec<(i64, f64)> {
+        let s = &d.harness.state().session;
+        let (_, it) = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap();
+        let e = it.effects.iter().find(|e| e.effect == "graphic_text").unwrap();
+        e.params.get("tracking").map(|p| p.keyframes.iter().map(|k| (k.time.0, k.value.as_f64().unwrap())).collect()).unwrap_or_default()
+    };
+    assert!(keys(&mut d).is_empty());
+    d.ok("ui.click", json!({"id": "graphics.prop.tracking.stopwatch"}));
+    d.frames(2);
+    assert_eq!(keys(&mut d).len(), 1, "the stopwatch sets a keyframe at the playhead");
+    // two seconds later, drag the Tracking number: a second keyframe, the first stays
+    d.exec("playhead.set", json!({"seconds": 2.0}));
+    d.frames(2);
+    let n = d.rect("graphics.prop.tracking");
+    let (cx, cy) = (n[0] + n[2] / 2.0, n[1] + n[3] / 2.0);
+    d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx + 60.0, "y": cy}, "steps": 6}));
+    d.frames(4);
+    let k = keys(&mut d);
+    assert_eq!(k.len(), 2, "{k:?}");
+    // the clip starts at 0, where the first keyframe was set, so the second one sits at the playhead
+    let playhead = d.harness.state().session.playhead().0;
+    assert_eq!((k[0].0, k[1].0), (0, playhead), "the keyframes are where the playhead was: {k:?}");
+    assert_eq!(k[0].1, 0.0, "the first keyframe keeps its value: {k:?}");
+    assert!(k[1].1 > 10.0, "the new keyframe has the dragged value: {k:?}");
+    // letter spacing now animates: halfway between the keyframes the value is in between
+    let mid = {
+        let s = &d.harness.state().session;
+        let (_, it) = s.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap();
+        let e = it.effects.iter().find(|e| e.effect == "graphic_text").unwrap();
+        e.param("tracking").unwrap().value_at(filmcraft_time::Tick((k[0].0 + k[1].0) / 2)).as_f64().unwrap()
+    };
+    assert!(mid > 0.0 && mid < k[1].1, "{mid} between 0 and {}", k[1].1);
+    d.ok("ui.click", json!({"id": "graphics.prop.tracking.stopwatch"}));
+    d.frames(2);
+    assert!(keys(&mut d).is_empty(), "the stopwatch turns keyframing off");
+    d.shot("tracking-stopwatch");
+}
+
+/// Text panel ▸ Graphics (#1487): the text of every text layer in the sequence, in timeline
+/// order, searchable; the timecode goes to the clip and selects the layer, and the text edits in
+/// place as one undo step.
+#[test]
+fn the_text_panels_graphics_tab_lists_and_edits_graphic_text() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    let mut clips = Vec::new();
+    for (sec, text) in [(6.0, "Closing credits"), (1.0, "Opening title")] {
+        d.exec("playhead.set", json!({"seconds": sec}));
+        let r = d.exec("graphics.newText", json!({"text": text, "seconds": 2}));
+        clips.push(r["clip"].as_u64().unwrap());
+    }
+    let (credits, title) = (clips[0], clips[1]);
+    d.exec("playhead.set", json!({"seconds": 10.0}));
+    d.ok("ui.click", json!({"id": "text.tab.Graphics"}));
+    d.frames(3);
+    let rows = |d: &mut Driver| -> Vec<String> {
+        let v = d.ok("ui.elements", json!({"prefix": "text.graphics."}));
+        v.as_array().unwrap().iter().filter(|e| e["id"].as_str().unwrap().ends_with(".row")).map(|e| e["label"].as_str().unwrap_or("").to_string()).collect()
+    };
+    assert_eq!(rows(&mut d), ["Opening title", "Closing credits"], "in timeline order");
+    // search
+    d.ok("ui.click", json!({"id": "text.graphics.search"}));
+    d.ok("ui.type", json!({"text": "CRED"}));
+    d.frames(3);
+    assert_eq!(rows(&mut d), ["Closing credits"]);
+    d.ok("ui.key", json!({"key": "A", "command": true}));
+    d.ok("ui.key", json!({"key": "Backspace"}));
+    d.frames(3);
+    assert_eq!(rows(&mut d).len(), 2);
+    // the timecode goes to the clip and selects its layer
+    d.ok("ui.click", json!({"id": format!("text.graphics.{credits}.0.goto")}));
+    d.frames(3);
+    let start = d.harness.state().session.active_sequence().unwrap().find_item(filmcraft_project::ClipId(credits)).unwrap().1.start;
+    assert_eq!(d.harness.state().session.playhead(), start);
+    assert_eq!(d.harness.state().session.state.selection, vec![filmcraft_project::ClipId(credits)]);
+    assert_eq!(d.harness.state().session.state.graphic_layers, vec![0]);
+    // edit the title's text in place
+    let undo0 = d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    d.ok("ui.click", json!({"id": format!("text.graphics.{title}.0.text")}));
+    d.ok("ui.key", json!({"key": "A", "command": true}));
+    d.ok("ui.type", json!({"text": "Night Drive"}));
+    d.ok("ui.click", json!({"id": "text.graphics.search"}));
+    d.frames(3);
+    let text = text_param(&mut d, title, "text");
+    assert_eq!(text, Some(filmcraft_project::ParamValue::Text("Night Drive".into())));
+    assert_eq!(d.exec("history.list", json!({}))["undo"].as_array().unwrap().len(), undo0 + 1, "one undo step");
+    assert_eq!(rows(&mut d), ["Night Drive", "Closing credits"]);
+    d.shot("text-panel-graphics");
+}
+
+/// Keyframed text: the Graphics tab shows a clip's text at the clip's start when the playhead is
+/// past the clip, and an edit is written there (not at the clip's last frame), so the value shown
+/// is the one that changes.
+#[test]
+fn a_graphics_tab_edit_writes_keyframed_text_where_it_is_shown() {
+    let mut d = Driver::demo();
+    d.ok("ui.set", json!({"workspace": "Captions and Graphics"}));
+    d.exec("playhead.set", json!({"seconds": 1.0}));
+    let clip = d.exec("graphics.newText", json!({"text": "Start", "seconds": 2}))["clip"].as_u64().unwrap();
+    let it = d.harness.state().session.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap().1.clone();
+    // animate the text: "Start" at the clip's start, "End" near its end
+    d.exec("effects.toggleAnimation", json!({"clip": clip, "effect": "graphic_text", "param": "text"}));
+    let late = it.start.0 + (it.duration.0 * 9) / 10;
+    d.exec("graphics.set", json!({"clip": clip, "layer": 0, "props": {"text": "End"}, "time": late}));
+    // the playhead past the clip: the row shows the start's text
+    d.exec("playhead.set", json!({"seconds": 10.0}));
+    d.ok("ui.click", json!({"id": "text.tab.Graphics"}));
+    d.frames(3);
+    d.ok("ui.click", json!({"id": format!("text.graphics.{clip}.0.text")}));
+    d.ok("ui.key", json!({"key": "A", "command": true}));
+    d.ok("ui.type", json!({"text": "Edited"}));
+    d.ok("ui.click", json!({"id": "text.graphics.search"}));
+    d.frames(3);
+    let at = |d: &mut Driver, t: i64| {
+        let it = d.harness.state().session.active_sequence().unwrap().find_item(filmcraft_project::ClipId(clip)).unwrap().1.clone();
+        let mt = it.effect_time_at(filmcraft_time::Tick(t));
+        it.effects.iter().find(|e| e.effect == "graphic_text").unwrap().param("text").unwrap().value_at(mt)
+    };
+    assert_eq!(at(&mut d, it.start.0), filmcraft_project::ParamValue::Text("Edited".into()), "the shown (start) value changed");
+    assert_eq!(at(&mut d, late), filmcraft_project::ParamValue::Text("End".into()), "the end keeps its own");
+}
diff --git a/crates/ui-egui/tests/interchange_export_ui.rs b/crates/ui-egui/tests/it/interchange_export_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/interchange_export_ui.rs
rename to crates/ui-egui/tests/it/interchange_export_ui.rs
diff --git a/crates/ui-egui/tests/it/interface_zoom_ui.rs b/crates/ui-egui/tests/it/interface_zoom_ui.rs
new file mode 100644
index 000000000..2908a0017
--- /dev/null
+++ b/crates/ui-egui/tests/it/interface_zoom_ui.rs
@@ -0,0 +1,96 @@
+//! Headless UI tests of the interface zoom (#2253).
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn click(&mut self, id: &str) {
+        self.ok("ui.click", json!({"id": id}));
+        self.frames(2);
+    }
+
+    fn app(&mut self) -> &mut FilmcraftApp {
+        self.harness.state_mut()
+    }
+
+    /// One key press with `modifiers`, as the window reports it.
+    fn press(&mut self, key: egui::Key, modifiers: egui::Modifiers) {
+        let events = &mut self.harness.input_mut().events;
+        events.push(egui::Event::ModifiersChanged(modifiers));
+        for pressed in [true, false] {
+            events.push(egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        }
+        events.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+        self.frames(3);
+    }
+}
+
+/// #2253: with the Timeline focused, Ctrl+= and Ctrl+- are its track-height keys, but Ctrl+Plus
+/// (the `+` key, or Shift+=) fell through to egui and scaled the whole interface, which the taken
+/// Ctrl+- and Ctrl+0 could not undo. `+` now goes where `=` goes, and View ▸ Reset Interface Zoom
+/// gives the configured scale back.
+#[test]
+fn ctrl_plus_does_what_ctrl_equals_does_and_the_interface_zoom_can_be_reset() {
+    let mut d = Driver::demo();
+    let clip = d.app().session.active_sequence().unwrap().video_tracks[0].items[0].id.0;
+    d.click(&format!("timeline.clip.{clip}"));
+    assert_eq!(d.app().ui.focused, filmcraft_ui_egui::dock::PanelKind::Timeline);
+    let zoom = d.harness.ctx.zoom_factor();
+    let height = d.app().ui.timeline.video_track_h;
+    d.press(egui::Key::Plus, egui::Modifiers::COMMAND);
+    assert_eq!(d.harness.ctx.zoom_factor(), zoom, "the interface keeps its scale");
+    assert!(d.app().ui.timeline.video_track_h > height, "Ctrl+Plus makes the video tracks taller, as Ctrl+= does");
+
+    // however it got scaled, View ▸ Reset Interface Zoom brings it back
+    d.harness.ctx.set_zoom_factor(1.75);
+    d.frames(2);
+    assert_eq!(d.harness.ctx.zoom_factor(), 1.75);
+    let r = d.ok("ui.menu.invoke", json!({"id": "view.resetInterfaceZoom"}));
+    assert_eq!(r["zoom"], json!(1.0), "the reply says the zoom it set: {r}");
+    d.frames(2);
+    assert_eq!(d.harness.ctx.zoom_factor(), 1.0);
+}
diff --git a/crates/ui-egui/tests/keyboard_ui.rs b/crates/ui-egui/tests/it/keyboard_ui.rs
similarity index 68%
rename from crates/ui-egui/tests/keyboard_ui.rs
rename to crates/ui-egui/tests/it/keyboard_ui.rs
index b1ea139a2..ef242bb28 100644
--- a/crates/ui-egui/tests/keyboard_ui.rs
+++ b/crates/ui-egui/tests/it/keyboard_ui.rs
@@ -71,6 +71,32 @@ impl Driver {
     }
 }
 
+/// Rejected pointer counts must preserve the editor and allow later MCP-default and double clicks.
+#[test]
+fn rejected_pointer_counts_leave_the_ui_usable() {
+    let mut d = Driver::new();
+    let project = d.app().session.project.clone();
+    for (method, params) in [
+        ("ui.click", json!({"id": "tools.Razor", "count": u64::MAX})),
+        ("ui.drag", json!({"from": {"id": "tools.Razor"}, "to": {"id": "tools.Selection"}, "steps": u64::MAX})),
+    ] {
+        let (req, reply) = ControlRequest::new(method, params);
+        d.tx.send(req).unwrap();
+        d.frames(3);
+        let response = reply.try_recv().expect("invalid counts must be answered without queuing input");
+        assert_eq!(response["ok"], false, "{response}");
+        assert_eq!(d.app().ui.tool, filmcraft_ui_egui::state::Tool::Selection);
+        assert_eq!(*d.app().session.project, *project);
+    }
+    d.ok("ui.click", json!({"id": "tools.Razor", "count": null}));
+    d.frames(3);
+    assert_eq!(d.app().ui.tool, filmcraft_ui_egui::state::Tool::Razor);
+    d.ok("ui.click", json!({"id": "tools.Selection", "count": 2}));
+    d.frames(3);
+    assert_eq!(d.app().ui.tool, filmcraft_ui_egui::state::Tool::Selection);
+    assert_eq!(*d.app().session.project, *project);
+}
+
 /// Ids added for keyboard parity (engine + UI).
 fn new_ids() -> Vec<String> {
     let mut v: Vec<String> = filmcraft_engine::keyboard::commands().iter().map(|c| c.id.to_string()).collect();
@@ -99,7 +125,15 @@ fn premiere_table_has_no_dangling_ids_or_new_conflicts() {
         }
     }
     // the Premiere preset binds every new command that Premiere has a key for
-    for id in ["timeline.selectClipAtPlayhead", "file.exportFrame", "window.maximizeFrame", "timeline.nudgeRight", "clip.volumeUp"] {
+    for id in [
+        "timeline.selectClipAtPlayhead",
+        "file.exportFrame",
+        "window.maximizeFrame",
+        "timeline.nudgeRight",
+        "clip.volumeUp",
+        "mixer.showHideTracks",
+        "mixer.meterInputOnly",
+    ] {
         assert!(!s.shortcuts.for_command(id).is_empty(), "{id} has no key in the Premiere preset");
     }
 }
@@ -180,6 +214,98 @@ fn new_keys_work_in_the_app() {
     assert_eq!(d.app().ui.program.zoom, None);
 }
 
+/// Maximize Frame Under Cursor matches the pointer only against the panels of the window
+/// holding it: a panel floated into its own OS window has that window's coordinates, which
+/// overlap the main window's.
+#[test]
+fn maximize_under_cursor_ignores_native_window_rects() {
+    use filmcraft_ui_egui::dock::PanelKind;
+    let mut d = Driver::new();
+    // A stand-in for OS windows: each native viewport runs its own frame, with no input.
+    egui::Context::set_immediate_viewport_renderer(|ctx, mut viewport| {
+        let size = viewport.builder.inner_size.unwrap_or(egui::vec2(400.0, 300.0));
+        let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
+        let info = egui::ViewportInfo { inner_rect: Some(screen), ..Default::default() };
+        let id = viewport.ids.this;
+        let input = egui::RawInput { viewport_id: id, viewports: std::iter::once((id, info)).collect(), screen_rect: Some(screen), ..Default::default() };
+        ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui)).textures_delta.clear();
+    });
+    d.harness.ctx.set_embed_viewports(false);
+    // The main window reports its outer rect, as under X11: without a display variable craft-ui
+    // otherwise takes the session for Wayland and keeps floating windows in-window.
+    d.harness.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default().outer_rect =
+        Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1600.0, 1000.0)));
+    d.ok("ui.menu.invoke", json!({"id": "window.floatPanel", "params": {"panel": "Info", "rect": [0, 0, 700, 500]}}));
+    d.frames(4);
+    let elements = d.ok("ui.elements", json!({"prefix": "panel."}));
+    let elements = elements.as_array().unwrap();
+    let rect = |e: &Value| {
+        let r: Vec<f32> = e["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap() as f32).collect();
+        egui::Rect::from_min_size(egui::pos2(r[0], r[1]), egui::vec2(r[2], r[3]))
+    };
+    let floated = elements.iter().find(|e| e["id"] == "panel.Info").unwrap();
+    assert!(floated["window"].is_u64(), "the native window's body carries its window: {floated}");
+    let (under, pos) = elements
+        .iter()
+        .filter(|e| e["window"].is_null())
+        .find_map(|e| {
+            let panel = PanelKind::from_name(e["id"].as_str()?.strip_prefix("panel.")?)?;
+            let overlap = rect(e).intersect(rect(floated));
+            overlap.is_positive().then(|| (panel, overlap.center()))
+        })
+        .expect("a main-window panel overlaps the native window's body rect");
+    d.harness.event(egui::Event::PointerMoved(pos));
+    d.key("`");
+    assert_eq!(d.app().ui.keys.maximized, Some(under));
+}
+
+/// Select Next / Previous Panel skip the narrow Tools and Audio Meters strips.
+#[test]
+fn panel_cycling_skips_tools_and_audio_meters() {
+    use filmcraft_ui_egui::dock::{LayoutExt as _, PanelKind};
+    let mut d = Driver::new();
+    let shown = d.app().ui.dock.visible_panels();
+    assert!(shown.contains(&PanelKind::Tools) && shown.contains(&PanelKind::AudioMeters), "{shown:?}");
+    for key in ["Ctrl+Shift+.", "Ctrl+Shift+,"] {
+        let mut seen = Vec::new();
+        for _ in 0..shown.len() * 2 {
+            d.key(key);
+            seen.push(d.app().ui.focused);
+        }
+        assert!(!seen.contains(&PanelKind::Tools) && !seen.contains(&PanelKind::AudioMeters), "{key}: {seen:?}");
+        assert!(seen.len() > 1 && seen.iter().any(|p| *p != seen[0]), "{key} cycles: {seen:?}");
+    }
+}
+
+/// The Audio Track Mixer's Show/Hide Tracks (Cmd+Alt+T) and Meter Input(s) Only (Ctrl+Shift+I)
+/// keys with the mixer focused, and the two commands run from another panel.
+#[test]
+fn audio_track_mixer_keys_open_show_hide_and_toggle_meter_input_only() {
+    let mut d = Driver::new();
+    d.ok("ui.set", json!({"workspace": "Audio"}));
+    d.focus("AudioTrackMixer");
+    let dialog = |d: &mut Driver| !d.ok("ui.elements", json!({"prefix": "mixer.showHide.A1"})).as_array().unwrap().is_empty();
+    assert!(!dialog(&mut d));
+    d.key("Cmd+Alt+T");
+    assert!(dialog(&mut d), "Cmd+Alt+T opens Show/Hide Tracks");
+    d.ok("ui.click", json!({"id": "mixer.showHide.ok"}));
+    d.frames(2);
+    assert!(!dialog(&mut d), "OK closes it");
+    assert!(!d.app().ui.mixer_meter_input_only);
+    d.key("Ctrl+Shift+I");
+    assert!(d.app().ui.mixer_meter_input_only, "Ctrl+Shift+I turns Meter Input(s) Only on");
+    d.key("Ctrl+Shift+I");
+    assert!(!d.app().ui.mixer_meter_input_only, "and off again");
+    // the commands, from anywhere: Show/Hide Tracks brings the mixer forward
+    d.focus("Timeline");
+    let r = d.ok("ui.menu.invoke", json!({"id": "mixer.meterInputOnly", "params": {"on": true}}));
+    assert_eq!(r, json!({"meterInputOnly": true}));
+    d.ok("ui.menu.invoke", json!({"id": "mixer.showHideTracks"}));
+    d.frames(2);
+    assert!(dialog(&mut d), "mixer.showHideTracks opens the dialog");
+    assert_eq!(d.app().ui.focused, filmcraft_ui_egui::dock::PanelKind::AudioTrackMixer);
+}
+
 /// Off macOS the menus show `Ctrl+…`, so that is what agents send: a `Ctrl` chord through
 /// `ui.key` (and `ctrl` in `ui.click` modifiers) must act like the physical key, which egui-winit
 /// reports as `ctrl` + `command`. Bindings are written `Cmd+…`, so this failed to match (#245).
diff --git a/crates/ui-egui/tests/keyframes_ui.rs b/crates/ui-egui/tests/it/keyframes_ui.rs
similarity index 97%
rename from crates/ui-egui/tests/keyframes_ui.rs
rename to crates/ui-egui/tests/it/keyframes_ui.rs
index d0549a015..a4cb06c07 100644
--- a/crates/ui-egui/tests/keyframes_ui.rs
+++ b/crates/ui-egui/tests/it/keyframes_ui.rs
@@ -708,3 +708,22 @@ fn mask_keyframe_menus_preserve_the_effect_and_other_masks() {
         assert_eq!(effect(&d), before);
     }
 }
+
+/// #2328: a line separates the fixed effects (Motion, Opacity, Time Remapping) from the effects
+/// added from the library; without added effects there is none.
+#[test]
+fn a_line_separates_added_effects_from_the_fixed_ones() {
+    let (mut d, clip) = Driver::demo();
+    assert!(d.find("effectControls.addedEffects.video").is_none(), "only fixed effects: no line");
+    d.exec("effects.apply", json!({"clips": [clip.id], "effect": "gaussian_blur"}));
+    d.exec("effects.apply", json!({"clips": [clip.id], "effect": "tint"}));
+    let line = d.rect("effectControls.addedEffects.video");
+    let opacity = d.rect("effectControls.effect.opacity");
+    let blur = d.rect("effectControls.effect.gaussian_blur");
+    let tint = d.rect("effectControls.effect.tint");
+    assert!(
+        opacity[1] < line[1] && (line[1] + line[3] / 2.0 - blur[1]).abs() <= 0.5,
+        "on the edge between the fixed and the added effects: {opacity:?} {line:?} {blur:?}"
+    );
+    assert!(tint[1] > blur[1], "one line, above all the added effects");
+}
diff --git a/crates/ui-egui/tests/links_ui.rs b/crates/ui-egui/tests/it/links_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/links_ui.rs
rename to crates/ui-egui/tests/it/links_ui.rs
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
new file mode 100644
index 000000000..31a8ec902
--- /dev/null
+++ b/crates/ui-egui/tests/it/main.rs
@@ -0,0 +1,87 @@
+mod audio51_ui;
+mod audio_fx_editor_ui;
+mod caption_copy_paste_ui;
+mod caption_list_follow_ui;
+mod caption_option_drag_ui;
+mod caption_properties_ui;
+mod caption_razor_ui;
+mod captions_font_ui;
+mod chrome_ui;
+mod clip_audio_ui;
+mod clip_dialogs_ui;
+mod clipboard_paste_ui;
+mod color_ui;
+mod delete_caption_tracks_ui;
+mod deselect_ui;
+mod dialog_buttons_ui;
+mod edit_point_menu_ui;
+mod escape_drag_ui;
+mod essential_sound_ui;
+mod export_menu_ui;
+mod export_ui;
+mod frame_export_ui;
+mod graphics_handles_ui;
+mod graphics_notice_ui;
+mod graphics_templates_ui;
+mod graphics_ui;
+mod interchange_export_ui;
+mod interface_zoom_ui;
+mod keyboard_ui;
+mod keyframes_ui;
+mod links_ui;
+mod marked_playback_position;
+mod mask_roundness_ui;
+mod masks_ui;
+mod media_ui;
+mod menus_ui;
+mod meters_ui;
+mod mixer_ui;
+mod monitor_geometry;
+mod multicam_ui;
+mod native_dialogs_ui;
+mod native_menu_text_keys;
+mod native_windows_ui;
+mod nest_editing_ui;
+mod nest_rendering_ui;
+mod nested_ui;
+mod panels_ui;
+mod par_ui;
+mod perf_ui;
+mod playback_clock_ui;
+mod project_panel_ui;
+mod properties_scroll_ui;
+mod remix_ui;
+mod scripted;
+mod sequence_tabs_ui;
+mod sequence_ui;
+mod settings_ui;
+mod shared_docking_ui;
+mod source_drag_ui;
+mod source_playback_ui;
+mod timecode_ui;
+mod timeline_drop_ui;
+mod timeline_escape_ui;
+mod timeline_gap_ui;
+mod timeline_marquee_ui;
+mod timeline_middle_pan_ui;
+mod timeline_option_drag_ui;
+mod timeline_scroll_ui;
+mod timeline_tabs_ui;
+mod timeline_track_height_ui;
+mod timeline_transition_move_ui;
+mod timeline_trim_ui;
+mod timeline_work_area_ui;
+mod track_color_ui;
+mod track_select_drag_ui;
+mod transcript_ui;
+mod transform_handles_ui;
+mod transition_drop_ui;
+mod transitions_ui;
+mod tts_ui;
+mod ui_control_input;
+mod ui_dock_resize;
+mod ui_keyboard_focus;
+mod unlink_ui;
+mod view_ui;
+mod voiceover_ui;
+mod workspaces_ui;
diff --git a/crates/ui-egui/tests/marked_playback_position.rs b/crates/ui-egui/tests/it/marked_playback_position.rs
similarity index 100%
rename from crates/ui-egui/tests/marked_playback_position.rs
rename to crates/ui-egui/tests/it/marked_playback_position.rs
diff --git a/crates/ui-egui/tests/mask_roundness_ui.rs b/crates/ui-egui/tests/it/mask_roundness_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/mask_roundness_ui.rs
rename to crates/ui-egui/tests/it/mask_roundness_ui.rs
diff --git a/crates/ui-egui/tests/masks_ui.rs b/crates/ui-egui/tests/it/masks_ui.rs
similarity index 68%
rename from crates/ui-egui/tests/masks_ui.rs
rename to crates/ui-egui/tests/it/masks_ui.rs
index 4d90bfca3..cc61c838a 100644
--- a/crates/ui-egui/tests/masks_ui.rs
+++ b/crates/ui-egui/tests/it/masks_ui.rs
@@ -43,6 +43,14 @@ impl Driver {
             self.harness.step();
         }
     }
+    fn wait_until(&mut self, what: &str, mut done: impl FnMut(&mut Self) -> bool) {
+        let t0 = std::time::Instant::now();
+        while !done(self) {
+            assert!(t0.elapsed().as_secs() < 120, "timed out waiting for {what}");
+            self.frames(1);
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+    }
     fn call(&mut self, method: &str, params: Value) -> Value {
         let (req, reply) = ControlRequest::new(method, params.clone());
         self.tx.send(req).unwrap();
@@ -202,17 +210,10 @@ fn create_and_edit_masks_on_the_monitor() {
     d.rect("effectControls.opacity.mask0.track.fwd");
     d.rect("effectControls.opacity.mask0.trackMethod");
     d.ok("ui.click", json!({"id": "effectControls.opacity.mask0.track.fwdFrame"}));
-    let mut finished = false;
-    for _ in 0..400 {
-        d.frames(1);
+    d.wait_until("the tracking job to finish", |d| {
         let jobs = d.exec("jobs.list", json!({}));
-        if jobs.as_array().unwrap().iter().any(|j| j["label"].as_str().unwrap_or("").starts_with("Track") && j["finished"] == true) {
-            finished = true;
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(10));
-    }
-    assert!(finished, "tracking job ran");
+        jobs.as_array().unwrap().iter().any(|j| j["label"].as_str().unwrap_or("").starts_with("Track") && j["finished"] == true)
+    });
     d.frames(3);
     let m = d.masks();
     let pen = m.iter().find(|x| x["effectId"] == "opacity").unwrap();
@@ -247,6 +248,160 @@ fn mask_handles_follow_the_clip_selection() {
     assert!(d.has("program.mask.vertex.0"), "the handles come back with the clip");
 }
 
+/// A marquee dragged from outside the mask selects the vertices it encloses, Shift-click adds one
+/// more, and dragging any selected vertex moves them all in one undo step; a plain click goes back
+/// to one vertex (#3150).
+#[test]
+fn marquee_and_shift_click_select_vertices_that_move_together() {
+    let mut d = Driver::demo();
+    let seq = d.exec("sequence.inspect", json!({}));
+    let clip = &seq["video"][0]["items"][0];
+    let (id, start, dur) = (clip["clip"].as_u64().unwrap(), clip["start"].as_i64().unwrap(), clip["duration"].as_i64().unwrap());
+    d.exec("playhead.set", json!({"time": start + dur / 2}));
+    d.exec("timeline.select", json!({"clips": [id]}));
+    // corners: 0 top-left, 1 top-right, 2 bottom-right, 3 bottom-left
+    d.exec("masks.add", json!({"clip": id, "effect": "opacity", "shape": "polygon", "center": [800, 540], "size": [600, 400]}));
+    d.frames(3);
+    let pts = |d: &mut Driver| -> Vec<(f64, f64)> {
+        let m = d.masks();
+        (0..4).map(|i| v0(&m[0], i)).collect()
+    };
+    let undo_len = |d: &mut Driver| d.exec("history.list", json!({}))["undo"].as_array().unwrap().len();
+    // the marquee starts above and left of the shape and encloses the two top corners
+    let (a, b) = (d.center("program.mask.vertex.0"), d.center("program.mask.vertex.1"));
+    d.ok("ui.drag", json!({"from": {"x": a.0 - 25.0, "y": a.1 - 25.0}, "to": {"x": b.0 + 25.0, "y": b.1 + 25.0}, "steps": 6}));
+    d.frames(2);
+    let p0 = pts(&mut d);
+    let undo0 = undo_len(&mut d);
+    d.drag("program.mask.vertex.0", 0.0, -30.0);
+    let p1 = pts(&mut d);
+    for i in [0, 1] {
+        assert!(p1[i].1 < p0[i].1 - 20.0 && (p1[i].0 - p0[i].0).abs() < 1e-6, "vertex {i} moved up with the marquee selection: {p0:?} → {p1:?}");
+    }
+    for i in [2, 3] {
+        assert_eq!(p1[i], p0[i], "vertex {i} outside the marquee stays");
+    }
+    assert_eq!(undo_len(&mut d), undo0 + 1, "one undo step for the drag");
+    d.shot("mask-vertices-marquee");
+
+    // Shift-click adds the bottom-left corner; dragging a selected one moves all three
+    let (x, y) = d.center("program.mask.vertex.3");
+    d.ok("ui.click", json!({"x": x, "y": y, "modifiers": {"shift": true}}));
+    d.frames(2);
+    d.drag("program.mask.vertex.1", 20.0, 0.0);
+    let p2 = pts(&mut d);
+    for i in [0, 1, 3] {
+        assert!(p2[i].0 > p1[i].0 + 10.0, "vertex {i} moved right: {p1:?} → {p2:?}");
+    }
+    assert_eq!(p2[2], p1[2], "the unselected vertex stays");
+
+    // a plain click selects only that vertex again
+    d.ok("ui.click", json!({"id": "program.mask.vertex.0"}));
+    d.frames(2);
+    d.drag("program.mask.vertex.0", 0.0, 20.0);
+    let p3 = pts(&mut d);
+    assert!(p3[0].1 > p2[0].1 + 10.0, "{p2:?} → {p3:?}");
+    for i in [1, 2, 3] {
+        assert_eq!(p3[i], p2[i], "vertex {i} left the selection");
+    }
+
+    // a graphic layer on the picture still takes its own drag: the marquee is only for empty space
+    let at = d.exec("sequence.inspect", json!({}))["playhead"].as_i64().unwrap();
+    let title = d.exec("graphics.newText", json!({"text": "Title", "time": at}))["clip"].as_u64().unwrap();
+    d.exec("masks.translate", json!({"clip": id, "effect": "opacity", "mask": 0, "delta": [700, 0]}));
+    d.exec("timeline.select", json!({"clips": [id]}));
+    d.frames(3);
+    assert!(d.has("program.mask.marquee"), "the mask overlay is on the monitor");
+    let q0 = d.exec("graphics.list", json!({"clip": title}))["layers"][0]["quad"][0][0].as_f64().unwrap();
+    let lr = d.rect(&format!("program.layer.{title}.0"));
+    let (cx, cy) = (lr[0] + lr[2] / 2.0, lr[1] + lr[3] / 2.0);
+    d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx + 60.0, "y": cy}, "steps": 6}));
+    d.frames(2);
+    let q1 = d.exec("graphics.list", json!({"clip": title}))["layers"][0]["quad"][0][0].as_f64().unwrap();
+    assert!(q1 > q0 + 20.0, "the title moved: {q0} → {q1}");
+}
+
+/// A marquee released over a graphic layer still selects: from outside the outline's box and from
+/// inside it but outside the shape (#3150).
+#[test]
+fn a_marquee_released_over_a_graphic_layer_selects_its_vertices() {
+    let mut d = Driver::demo();
+    let seq = d.exec("sequence.inspect", json!({}));
+    let clip = &seq["video"][0]["items"][0];
+    let (id, start, dur) = (clip["clip"].as_u64().unwrap(), clip["start"].as_i64().unwrap(), clip["duration"].as_i64().unwrap());
+    d.exec("playhead.set", json!({"time": start + dur / 2}));
+    let at = d.exec("sequence.inspect", json!({}))["playhead"].as_i64().unwrap();
+    let title = d.exec("graphics.newText", json!({"text": "Title", "time": at, "position": [1000, 600]}))["clip"].as_u64().unwrap();
+    d.exec("timeline.select", json!({"clips": [id]}));
+    // vertices: 0 top, 1 right, 2 bottom, 3 left; the title sits inside the ellipse
+    d.exec("masks.add", json!({"clip": id, "effect": "opacity", "shape": "ellipse", "center": [960, 540], "size": [800, 500]}));
+    d.frames(3);
+    let pts = |d: &mut Driver| -> Vec<(f64, f64)> {
+        let m = d.masks();
+        (0..4).map(|i| v0(&m[0], i)).collect()
+    };
+    let lr = d.rect(&format!("program.layer.{title}.0"));
+    let to = (lr[0] + lr[2] / 2.0, lr[1] + lr[3] / 2.0);
+    for inset in [-20.0, 1.0] {
+        let bb = d.rect("program.mask.body");
+        let from = (bb[0] + inset, bb[1] + inset);
+        let enclosed: Vec<usize> = (0..4)
+            .filter(|i| {
+                let (x, y) = d.center(&format!("program.mask.vertex.{i}"));
+                x >= from.0 && x <= to.0 && y >= from.1 && y <= to.1
+            })
+            .collect();
+        assert!(!enclosed.is_empty() && enclosed.len() < 4, "the marquee from {from:?} to {to:?} takes some vertices: {enclosed:?}");
+        d.ok("ui.drag", json!({"from": {"x": from.0, "y": from.1}, "to": {"x": to.0, "y": to.1}, "steps": 6}));
+        d.frames(2);
+        let p0 = pts(&mut d);
+        d.drag(&format!("program.mask.vertex.{}", enclosed[0]), 0.0, -20.0);
+        let p1 = pts(&mut d);
+        let moved: Vec<usize> = (0..4).filter(|i| p1[*i] != p0[*i]).collect();
+        assert_eq!(moved, enclosed, "marquee from {from:?}: {p0:?} → {p1:?}");
+    }
+}
+
+/// The vertex selection does not outlive a change in the number of vertices: after a Cmd-click
+/// deletes one (or an edit elsewhere adds or deletes one), the old indices would name other
+/// vertices (#3150).
+#[test]
+fn deleting_a_vertex_drops_the_vertex_selection() {
+    let mut d = Driver::demo();
+    let seq = d.exec("sequence.inspect", json!({}));
+    let clip = &seq["video"][0]["items"][0];
+    let (id, start, dur) = (clip["clip"].as_u64().unwrap(), clip["start"].as_i64().unwrap(), clip["duration"].as_i64().unwrap());
+    d.exec("playhead.set", json!({"time": start + dur / 2}));
+    d.exec("timeline.select", json!({"clips": [id]}));
+    for by_command in [false, true] {
+        d.exec("masks.add", json!({"clip": id, "effect": "opacity", "shape": "polygon", "center": [800, 540], "size": [600, 400]}));
+        d.frames(3);
+        let mask = d.masks().len() - 1;
+        // select corners 1 and 2, then delete corner 0: they become indices 0 and 1
+        d.ok("ui.click", json!({"id": "program.mask.vertex.1"}));
+        d.frames(2);
+        let (x, y) = d.center("program.mask.vertex.2");
+        d.ok("ui.click", json!({"x": x, "y": y, "modifiers": {"shift": true}}));
+        d.frames(2);
+        if by_command {
+            d.exec("masks.removeVertex", json!({"clip": id, "effect": "opacity", "mask": mask, "vertex": 0}));
+        } else {
+            let (x, y) = d.center("program.mask.vertex.0");
+            d.ok("ui.click", json!({"x": x, "y": y, "modifiers": {"command": true}}));
+        }
+        d.frames(2);
+        let pts = |d: &mut Driver| -> Vec<(f64, f64)> {
+            let m = d.masks();
+            (0..3).map(|i| v0(&m[mask], i)).collect()
+        };
+        let p0 = pts(&mut d);
+        d.drag("program.mask.vertex.1", 0.0, -20.0);
+        let p1 = pts(&mut d);
+        let moved: Vec<usize> = (0..3).filter(|i| p1[*i] != p0[*i]).collect();
+        assert_eq!(moved, vec![1], "only the dragged vertex moves (by command: {by_command}): {p0:?} → {p1:?}");
+    }
+}
+
 /// Shift held while placing pen points snaps each new segment to 45° steps from the previous
 /// point; a Shift-drag also constrains the Bézier handle it pulls out (#853).
 #[test]
@@ -387,10 +542,13 @@ fn presets_bin_drag_and_save_dialog() {
         d.ok("ui.click", json!({"id": format!("effectControls.effect.{fx}.twirl")}));
         d.frames(2);
     }
+    // Effect Controls: property fields must be reachable by name as well.
+    d.harness.check_accessibility();
     d.ok("ui.click", json!({"id": "effectControls.effect.brightness_contrast", "button": "right"}));
     d.frames(2);
     d.ok("ui.click", json!({"id": "effectControls.effect.brightness_contrast.savePreset"}));
     d.frames(2);
+    d.harness.check_accessibility();
     d.rect("savePreset.name");
     d.ok("ui.click", json!({"id": "savePreset.name"}));
     d.ok("ui.key", json!({"key": "Cmd+A"}));
diff --git a/crates/ui-egui/tests/media_ui.rs b/crates/ui-egui/tests/it/media_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/media_ui.rs
rename to crates/ui-egui/tests/it/media_ui.rs
diff --git a/crates/ui-egui/tests/menus_ui.rs b/crates/ui-egui/tests/it/menus_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/menus_ui.rs
rename to crates/ui-egui/tests/it/menus_ui.rs
diff --git a/crates/ui-egui/tests/meters_ui.rs b/crates/ui-egui/tests/it/meters_ui.rs
similarity index 90%
rename from crates/ui-egui/tests/meters_ui.rs
rename to crates/ui-egui/tests/it/meters_ui.rs
index 8d835ecfb..9b3363344 100644
--- a/crates/ui-egui/tests/meters_ui.rs
+++ b/crates/ui-egui/tests/it/meters_ui.rs
@@ -5,10 +5,12 @@
 use std::sync::mpsc::{Sender, channel};
 use std::sync::{Arc, Mutex};
 
+use craft_ui::docking::Node;
+use craft_ui::layout::SplitSize;
 use egui_kittest::Harness;
 use filmcraft_engine::Session;
 use filmcraft_ui_egui::control::ControlRequest;
-use filmcraft_ui_egui::dock::{DockNode, PanelKind, SplitSize};
+use filmcraft_ui_egui::dock::PanelKind;
 use filmcraft_ui_egui::{AudioOut, FilmcraftApp};
 use serde_json::{Value, json};
 
@@ -87,20 +89,19 @@ impl Driver {
     fn label(&mut self, id: &str) -> String {
         self.element(id).and_then(|e| e["label"].as_str().map(str::to_string)).unwrap_or_default()
     }
-    /// Give the Audio Meters panel `width` points (it sits in a fixed-width split beside the
-    /// Timeline).
+    /// Give the Audio Meters panel `width` points (it sits in a split beside the Timeline).
     fn meters_width(&mut self, width: f32) {
-        fn set(n: &mut DockNode, width: f32) -> bool {
+        fn set(n: &mut Node<PanelKind>, width: f32) -> bool {
             match n {
-                DockNode::Split { size, b, .. } if matches!(&**b, DockNode::Tabs { panels, .. } if panels.as_slice() == [PanelKind::AudioMeters]) => {
-                    *size = SplitSize::FixedB(width);
+                Node::Split { size, second, .. } if matches!(&**second, Node::Tabs { panels, .. } if panels.as_slice() == [PanelKind::AudioMeters]) => {
+                    *size = SplitSize::FixedSecond(width);
                     true
                 }
-                DockNode::Split { a, b, .. } => set(a, width) || set(b, width),
-                DockNode::Tabs { .. } => false,
+                Node::Split { first, second, .. } => set(first, width) || set(second, width),
+                _ => false,
             }
         }
-        assert!(set(&mut self.harness.state_mut().ui.dock, width));
+        assert!(self.harness.state_mut().ui.dock.root.as_mut().is_some_and(|root| set(root, width)));
         self.frames(3);
     }
     /// The level the left bar shows, in dB.
diff --git a/crates/ui-egui/tests/mixer_ui.rs b/crates/ui-egui/tests/it/mixer_ui.rs
similarity index 97%
rename from crates/ui-egui/tests/mixer_ui.rs
rename to crates/ui-egui/tests/it/mixer_ui.rs
index 603578392..c42bbccf2 100644
--- a/crates/ui-egui/tests/mixer_ui.rs
+++ b/crates/ui-egui/tests/it/mixer_ui.rs
@@ -478,12 +478,19 @@ fn paused_meters_repaint_without_input_and_settle_after_release() {
         d.ok("ui.playback", json!({"action": "stop"}));
         assert!(!d.harness.state().playback.playing);
         d.snapshot(&format!("meters-{workspace}-paused-start"), None);
+        // A slow release after Stop reads as audio still playing: silent within 0.4 s.
+        for _ in 0..4 {
+            d.harness.step();
+        }
+        let (_, meters): (u64, std::collections::HashMap<u64, Vec<[f32; 2]>>) =
+            d.harness.ctx.data(|data| data.get_temp(egui::Id::unique("mixer-meters"))).unwrap();
+        assert!(meters.values().flatten().all(|meter| *meter == [-90.0; 2]), "{workspace}: still falling 0.4 s after Stop: {meters:?}");
         // Harness::run follows immediate repaint requests, adding no mouse or keyboard input.
         let steps = d.harness.run();
         // Inspect both values that drive the bars: a silent level alone must not strand its
         // slower peak hold. No new frames or pointer events are injected to read this state.
         let (_, meters): (u64, std::collections::HashMap<u64, Vec<[f32; 2]>>) =
-            d.harness.ctx.data(|data| data.get_temp(egui::Id::new("mixer-meters"))).unwrap();
+            d.harness.ctx.data(|data| data.get_temp(egui::Id::unique("mixer-meters"))).unwrap();
         assert!(!meters.is_empty());
         assert!(meters.values().flatten().all(|meter| *meter == [-90.0; 2]), "{workspace}: meters stopped after {steps} requested frames: {meters:?}");
         assert_ne!(
diff --git a/crates/ui-egui/tests/monitor_geometry.rs b/crates/ui-egui/tests/it/monitor_geometry.rs
similarity index 92%
rename from crates/ui-egui/tests/monitor_geometry.rs
rename to crates/ui-egui/tests/it/monitor_geometry.rs
index 700657e19..7435b8c7e 100644
--- a/crates/ui-egui/tests/monitor_geometry.rs
+++ b/crates/ui-egui/tests/it/monitor_geometry.rs
@@ -6,7 +6,6 @@ use egui_kittest::kittest::{NodeT, Queryable};
 use filmcraft_engine::Session;
 use filmcraft_ui_egui::{
     FilmcraftApp,
-    dock::{self, DockNode, PanelKind, SeqTabs},
     panels::monitor::{self, Which},
     theme::{self, ThemeKind},
 };
@@ -24,17 +23,14 @@ fn harness_at_scale(width: f32, kind: ThemeKind, which: Which, scale: f32) -> Ha
         move |ui, app: &mut FilmcraftApp| {
             app.set_theme(ui.ctx(), kind);
             app.auto.begin_frame();
-            let panel = if which == Which::Source { PanelKind::Source } else { PanelKind::Program };
-            let mut node = DockNode::Tabs { panels: vec![panel], active: 0 };
-            let mut groups = Vec::new();
-            dock::layout(ui, &mut node, ui.max_rect(), &app.tokens, "monitor", &mut groups, &mut app.auto);
-            for group in groups {
-                // Exercise the actual parent chrome, including its themed panel background.
-                dock::draw_group_chrome(ui, &group, panel, &SeqTabs::default(), &app.tokens, &mut app.auto);
-                monitor::show(app, ui, group.content, which);
-            }
+            // A stand-in for the docked frame: the themed panel background, with the body below
+            // a tab strip's height.
+            let frame = ui.max_rect();
+            ui.painter().rect_filled(frame, 0.0, app.tokens.panel_bg);
+            let content = egui::Rect::from_min_max(egui::pos2(frame.min.x, frame.min.y + app.tokens.tab_h), frame.max);
+            monitor::show(app, ui, content, which);
             let source = filmcraft_ui_egui::panels::dragged_source(ui);
-            ui.ctx().data_mut(|data| data.insert_temp(egui::Id::new("observed-source-drag"), source));
+            ui.ctx().data_mut(|data| data.insert_temp(egui::Id::unique("observed-source-drag"), source));
         },
         FilmcraftApp::new(session),
     );
@@ -175,6 +171,7 @@ fn transport_editor_keeps_its_own_space_and_customizes_compact_controls() {
             h.event(Event::PointerMoved(scroll.center()));
             h.event(Event::MouseWheel {
                 unit: egui::MouseWheelUnit::Point,
+                source: egui::MouseWheelSource::Wheel,
                 delta: vec2(0.0, -1200.0),
                 modifiers: Modifiers::NONE,
                 phase: egui::TouchPhase::Move,
@@ -232,7 +229,7 @@ fn source_drag_choices(width: f32) {
         h.run_steps(2);
         let source = h
             .ctx
-            .data(|data| data.get_temp::<Option<filmcraft_ui_egui::panels::source_drag::SourceDrag>>(egui::Id::new("observed-source-drag")))
+            .data(|data| data.get_temp::<Option<filmcraft_ui_egui::panels::source_drag::SourceDrag>>(egui::Id::unique("observed-source-drag")))
             .flatten()
             .expect("drag must create the production Source payload");
         assert_eq!((source.video, source.audio), (video, audio));
diff --git a/crates/ui-egui/tests/multicam_ui.rs b/crates/ui-egui/tests/it/multicam_ui.rs
similarity index 92%
rename from crates/ui-egui/tests/multicam_ui.rs
rename to crates/ui-egui/tests/it/multicam_ui.rs
index 3b84105ee..d726fb620 100644
--- a/crates/ui-egui/tests/multicam_ui.rs
+++ b/crates/ui-egui/tests/it/multicam_ui.rs
@@ -114,9 +114,11 @@ impl Driver {
         }
     }
 
-    /// Run frames (with short sleeps so frame workers finish) until `done`.
+    /// Run frames (with short sleeps so frame workers finish) until `done`, for at most two
+    /// minutes of wall-clock time.
     fn until(&mut self, what: &str, mut done: impl FnMut(&mut Self) -> bool) {
-        for _ in 0..600 {
+        let t0 = std::time::Instant::now();
+        while t0.elapsed().as_secs() < 120 {
             if done(self) {
                 return;
             }
@@ -389,3 +391,28 @@ fn multicam_view_pages_beyond_sixteen_angles_and_edit_cameras() {
     assert!(!mc.cameras[1].enabled);
     assert_eq!(d.exec("multicam.grid", json!({}))["angles"], 19);
 }
+
+/// #1362: with nothing selected in the Project panel, Create Multi-Camera Source Sequence works on
+/// the clips selected in the Timeline.
+#[test]
+fn create_multicam_from_clips_selected_in_the_timeline() {
+    let (s, items) = session();
+    let mut d = Driver::new(s);
+    for (k, item) in items.iter().enumerate() {
+        d.exec("source.open", json!({"item": item}));
+        d.exec("playhead.set", json!({"frame": k as i64 * 96}));
+        d.exec("source.overwrite", json!({}));
+    }
+    let clips: Vec<u64> = d.app().session.active_sequence().unwrap().video_tracks[0].items.iter().map(|c| c.id.0).collect();
+    assert_eq!(clips.len(), 4);
+    d.exec("project.select", json!({"items": []}));
+    d.exec("timeline.select", json!({"clips": clips}));
+    d.ok("ui.menu.invoke", json!({"id": "clip.createMulticam"}));
+    d.frames(3);
+    assert_eq!(d.app().ui.sync_dialog.as_ref().map(|x| x.items.clone()), Some(items.clone()), "the dialog takes the Timeline clips' media");
+    d.click("mcam.method.in");
+    d.click("mcam.ok");
+    assert!(d.app().ui.sync_dialog.is_none(), "dialog closed: {}", d.app().ui.status);
+    let src = d.app().session.state.project_selection[0];
+    assert_eq!(d.app().session.project.sequence(src).unwrap().multicam.clone().unwrap().cameras.len(), 4);
+}
diff --git a/crates/ui-egui/tests/native_dialogs_ui.rs b/crates/ui-egui/tests/it/native_dialogs_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/native_dialogs_ui.rs
rename to crates/ui-egui/tests/it/native_dialogs_ui.rs
diff --git a/crates/ui-egui/tests/it/native_menu_text_keys.rs b/crates/ui-egui/tests/it/native_menu_text_keys.rs
new file mode 100644
index 000000000..766ae8c00
--- /dev/null
+++ b/crates/ui-egui/tests/it/native_menu_text_keys.rs
@@ -0,0 +1,111 @@
+//! The macOS menu bar takes the Edit menu's key equivalents before the window does: with a text
+//! field focused they edit the field, and only without one do they run the project command.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use filmcraft_ui_egui::menus::{self, MenuItem};
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+    menu: Sender<String>,
+    sent: Rc<RefCell<Vec<MenuItem>>>,
+}
+
+impl Driver {
+    fn new() -> Self {
+        let mut s = Session::default();
+        s.execute("file.openDemoProject", json!({})).unwrap();
+        let (tx, rx) = channel();
+        let (menu, inbox) = channel();
+        let sent: Rc<RefCell<Vec<MenuItem>>> = Rc::default();
+        let sink = sent.clone();
+        let mut app = FilmcraftApp::new(s).with_control(rx);
+        app.command_inbox = Some(inbox);
+        app.hooks.menu_changed = Some(Box::new(move |items: &[MenuItem]| *sink.borrow_mut() = items.to_vec()));
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx, menu, sent };
+        d.frames(4);
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    /// A native menu choice, then the frames that deliver what it queued for the window.
+    fn menu(&mut self, id: &str) {
+        self.menu.send(id.into()).unwrap();
+        self.frames(4);
+    }
+
+    fn undo_steps(&mut self) -> usize {
+        self.ok("engine.execute", json!({"command": "history.list", "params": {}}))["undo"].as_array().unwrap().len()
+    }
+
+    fn enabled(&self, id: &str) -> Option<bool> {
+        self.sent.borrow().iter().find(|it| it.id == id).map(|it| it.enabled)
+    }
+
+    fn search(&mut self) -> String {
+        self.harness.state().ui.project_search.clone()
+    }
+}
+
+#[test]
+fn edit_menu_keys_edit_the_focused_text_field_and_otherwise_the_project() {
+    let mut d = Driver::new();
+    d.ok("engine.execute", json!({"command": "markers.markIn", "params": {"seconds": 1.0}}));
+    let steps = d.undo_steps();
+    assert!(steps > 0);
+    assert_eq!(d.enabled("edit.paste"), Some(false), "nothing copied in the project");
+
+    let elements = d.ok("ui.elements", json!({"prefix": "project"}));
+    let field = elements.as_array().unwrap().iter().filter_map(|e| e["id"].as_str()).find(|id| id.ends_with(".search")).unwrap().to_string();
+    d.ok("ui.click", json!({"id": field}));
+    d.ok("ui.type", json!({"text": "abc"}));
+    d.frames(3);
+    assert_eq!(d.search(), "abc");
+    assert_eq!(menus::text_field_window(&d.harness.ctx), Some(egui::ViewportId::ROOT));
+    assert_eq!(d.enabled("edit.paste"), Some(true), "Paste stays enabled for the field");
+    assert!(menus::edits_text("edit.paste") && !menus::edits_text("file.newProject"));
+
+    d.menu("edit.selectAll");
+    d.menu("edit.cut");
+    assert_eq!(d.search(), "", "Select All and Cut act on the field");
+    d.menu("edit.undo");
+    assert_eq!(d.search(), "abc", "Undo undoes the field's cut");
+    assert_eq!(d.undo_steps(), steps, "the project history is untouched");
+
+    d.harness.ctx.memory_mut(|m| m.stop_text_input());
+    d.frames(3);
+    assert_eq!(menus::text_field_window(&d.harness.ctx), None);
+    d.menu("edit.undo");
+    assert_eq!(d.undo_steps(), steps - 1, "without a focused field, Undo undoes the project");
+}
diff --git a/crates/ui-egui/tests/it/native_windows_ui.rs b/crates/ui-egui/tests/it/native_windows_ui.rs
new file mode 100644
index 000000000..592f8f1ac
--- /dev/null
+++ b/crates/ui-egui/tests/it/native_windows_ui.rs
@@ -0,0 +1,272 @@
+//! Panels floated into their own OS windows, with a stand-in for the OS: each native viewport
+//! runs its own frame at the desktop place craft-ui asks for, with the main window's content at
+//! the desktop origin.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+/// What the tests give the native windows and what the windows publish. A test drives at most
+/// one native window at a time.
+#[derive(Default)]
+struct WindowIo {
+    focused: bool,
+    events: Vec<egui::Event>,
+    ime: Option<egui::output::IMEOutput>,
+    reset_requests: Vec<egui::ImeResetId>,
+}
+
+thread_local! {
+    static WINDOW: std::cell::RefCell<WindowIo> = std::cell::RefCell::new(WindowIo::default());
+}
+
+/// Native windows at their builders' places, reporting that place as their desktop rect.
+fn native_host() {
+    WINDOW.with(|w| *w.borrow_mut() = WindowIo::default());
+    egui::Context::set_immediate_viewport_renderer(|ctx, mut viewport| {
+        let size = viewport.builder.inner_size.unwrap_or(egui::vec2(400.0, 300.0));
+        let place = egui::Rect::from_min_size(viewport.builder.position.unwrap_or_default(), size);
+        let id = viewport.ids.this;
+        let (focused, events) = WINDOW.with(|w| {
+            let mut w = w.borrow_mut();
+            (w.focused, std::mem::take(&mut w.events))
+        });
+        let info = egui::ViewportInfo { inner_rect: Some(place), outer_rect: Some(place), focused: Some(focused), ..Default::default() };
+        let input = egui::RawInput {
+            viewport_id: id,
+            viewports: std::iter::once((id, info)).collect(),
+            screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, size)),
+            time: ctx.input(|i| Some(i.time)),
+            focused,
+            events,
+            ..Default::default()
+        };
+        let mut out = ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui));
+        out.textures_delta.clear();
+        WINDOW.with(|w| {
+            let mut w = w.borrow_mut();
+            w.reset_requests.extend(out.platform_output.ime.as_ref().and_then(|ime| ime.reset_request));
+            w.ime = out.platform_output.ime;
+        });
+    });
+}
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    /// The demo project with a new sequence open and `source` in the Source Monitor.
+    fn new(source: u64) -> Self {
+        native_host();
+        let mut s = Session::default();
+        s.execute("file.openDemoProject", json!({})).unwrap();
+        s.execute("file.newSequence", json!({"name": "Native", "width": 1280, "height": 720, "fps": 24})).unwrap();
+        s.execute("source.open", json!({"item": source})).unwrap();
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(s).with_control(rx);
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000).build_eframe(move |cc| {
+            filmcraft_ui_egui::install_ime_reset_callbacks(&cc.egui_ctx);
+            app
+        });
+        let mut d = Driver { harness, tx };
+        d.harness.ctx.set_embed_viewports(false);
+        // A main window that reports its desktop place, as under X11: craft-ui otherwise keeps
+        // floating windows in-window.
+        let main = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1600.0, 980.0));
+        let info = d.harness.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default();
+        (info.inner_rect, info.outer_rect, info.focused) = (Some(main), Some(main), Some(true));
+        d.frames(4);
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            ctx.request_repaint();
+            self.harness.step();
+        }
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    /// Float `panel` into its own OS window at `rect` on the desktop.
+    fn float(&mut self, panel: &str, rect: [f32; 4]) {
+        self.ok("ui.menu.invoke", json!({"id": "window.floatPanel", "params": {"panel": panel, "rect": rect}}));
+        self.frames(4);
+    }
+
+    /// Every element whose id starts with `prefix`, as `ui.elements` reports it.
+    fn elements(&mut self, prefix: &str) -> Vec<Value> {
+        self.ok("ui.elements", json!({"prefix": prefix})).as_array().cloned().unwrap_or_default()
+    }
+
+    fn element(&mut self, id: &str) -> Value {
+        self.elements(id).into_iter().find(|e| e["id"] == id).unwrap_or_else(|| panic!("no element {id}"))
+    }
+
+    fn app(&self) -> &FilmcraftApp {
+        self.harness.state()
+    }
+
+    fn pointer(&mut self, pos: egui::Pos2, pressed: Option<bool>) {
+        self.harness.input_mut().events.push(egui::Event::PointerMoved(pos));
+        if pressed == Some(true) {
+            self.frames(1);
+        }
+        if let Some(pressed) = pressed {
+            self.harness.input_mut().events.push(egui::Event::PointerButton {
+                pos,
+                button: egui::PointerButton::Primary,
+                pressed,
+                modifiers: egui::Modifiers::NONE,
+            });
+        }
+        self.frames(1);
+    }
+}
+
+fn rect(element: &Value) -> egui::Rect {
+    let r: Vec<f32> = element["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap() as f32).collect();
+    egui::Rect::from_min_size(egui::pos2(r[0], r[1]), egui::vec2(r[2], r[3]))
+}
+
+/// The header of a panel in its own OS window (the ≡ menu, the Timeline's sequence tabs) is
+/// drawn before its body, and carries the window from the frame it is drawn in.
+#[test]
+fn a_native_windows_header_elements_carry_its_window() {
+    let mut d = Driver::new(5);
+    d.float("Timeline", [900.0, 120.0, 680.0, 420.0]);
+    let body = d.element("panel.Timeline");
+    assert!(body["window"].is_u64(), "the floated Timeline is in its own OS window: {body}");
+    let menu = d.element("panel.menu.Timeline");
+    assert_eq!(menu["window"], body["window"], "{menu}");
+    let tabs = d.elements("timeline.tab.");
+    assert!(!tabs.is_empty(), "the open sequence has a tab");
+    for tab in tabs {
+        assert_eq!(tab["window"], body["window"], "{tab}");
+    }
+}
+
+/// The Save changes? prompt of Quit blocks the panels in native windows as Settings does, so
+/// they don't take the keyboard from it.
+#[test]
+fn the_quit_prompt_blocks_native_windows() {
+    let mut d = Driver::new(5);
+    d.float("Timeline", [900.0, 120.0, 680.0, 420.0]);
+    assert_eq!(d.element("panel.menu.Timeline")["enabled"], json!(true));
+    d.ok("engine.execute", json!({"command": "sequence.addTracks", "params": {}}));
+    assert!(d.app().session.is_dirty());
+    d.harness.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+    d.frames(3);
+    assert!(d.elements("quit.").iter().any(|e| e["id"] == "quit.cancel"), "Quit asks first");
+    assert_eq!(d.element("panel.menu.Timeline")["enabled"], json!(false), "the native window is blocked");
+}
+
+/// A Source Monitor drag in the main window reaches the Timeline in its own OS window, and drops
+/// the clip there.
+#[test]
+fn a_source_drag_drops_on_a_timeline_in_its_own_window() {
+    let mut d = Driver::new(5);
+    let place = egui::pos2(900.0, 120.0);
+    d.float("Timeline", [place.x, place.y, 680.0, 420.0]);
+    let clips = |d: &Driver| d.app().session.active_sequence().map_or(0, |q| q.video_tracks.iter().map(|t| t.items.len()).sum::<usize>());
+    assert_eq!(clips(&d), 0);
+    let row = d.element("timeline.track.V1.target");
+    assert!(row["window"].is_u64(), "{row}");
+    let panel = rect(&d.element("panel.Timeline"));
+    // In the native window's coordinates, then on the desktop, where the main window's
+    // content starts at the origin.
+    let local = egui::pos2(panel.min.x + d.app().ui.timeline.header_w + 60.0, rect(&row).center().y);
+    let to = place + local.to_vec2();
+    let from = rect(&d.element("source.drag.video")).center();
+    d.pointer(from, Some(true));
+    d.pointer(from + egui::vec2(0.0, 9.0), None);
+    d.pointer(to, None);
+    d.pointer(to, None);
+    d.pointer(to, Some(false));
+    d.frames(3);
+    assert_eq!(clips(&d), 1, "status: {}", d.app().ui.status);
+}
+
+/// The window's events for its next frame, and that frame.
+fn window_frame(d: &mut Driver, events: Vec<egui::Event>) {
+    WINDOW.with(|w| w.borrow_mut().events.extend(events));
+    d.frames(1);
+}
+
+fn window_ime() -> Option<egui::output::IMEOutput> {
+    WINDOW.with(|w| w.borrow().ime.clone())
+}
+
+fn ime_preedit(text: &str) -> egui::Event {
+    egui::Event::Ime(egui::ImeEvent::Preedit { text: text.into(), active_range_chars: None })
+}
+
+fn ime_commit(text: &str) -> egui::Event {
+    egui::Event::Ime(egui::ImeEvent::Commit(text.into()))
+}
+
+/// The Program monitor's text editor in its own OS window: the window publishes the composer's
+/// descriptor every pass, so the marked text survives; a click while composing suspends the
+/// window's reset fence, the window's next pass rearms it, and its completion admits a commit.
+#[test]
+fn a_floating_program_monitor_composes_and_rearms_its_ime_fence() {
+    let mut d = Driver::new(5);
+    let clip = d.ok("engine.execute", json!({"command": "graphics.newText", "params": {"text": "alpha", "position": [640, 360], "size": 120}}))["clip"]
+        .as_u64()
+        .unwrap();
+    d.float("Program", [900.0, 120.0, 680.0, 520.0]);
+    WINDOW.with(|w| w.borrow_mut().focused = true);
+    d.ok("ui.set", json!({"gfxEdit": {"clip": clip, "layer": 0, "caret": 5, "anchor": 5}}));
+    d.frames(3);
+    let text = |d: &mut Driver| d.ok("engine.execute", json!({"command": "graphics.list", "params": {"clip": clip}}))["layers"][0]["text"].clone();
+    let first = window_ime().expect("the floating editor publishes in its own window");
+
+    window_frame(&mut d, vec![ime_preedit("に")]);
+    for _ in 0..3 {
+        d.frames(1);
+        let ime = window_ime().expect("the window keeps publishing while composing");
+        assert_eq!((ime.owner, ime.context_generation), (first.owner, first.context_generation), "the same IME context");
+        assert!(!ime.should_interrupt_composition);
+    }
+    let preedit = d.element("program.textEdit.preedit");
+    assert_eq!(preedit["label"], json!("に"), "the marked text is drawn in the window");
+    assert!(preedit["window"].is_u64(), "{preedit}");
+    window_frame(&mut d, vec![ime_preedit(""), ime_commit("日本")]);
+    assert_eq!(text(&mut d), json!("alpha日本"));
+
+    // A click in the text while composing suspends the window's fence.
+    let at = rect(&d.element("program.textEdit")).center();
+    window_frame(&mut d, vec![ime_preedit("ご")]);
+    let press = |pressed| egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    WINDOW.with(|w| w.borrow_mut().reset_requests.clear());
+    window_frame(&mut d, vec![egui::Event::PointerMoved(at), press(true)]);
+    window_frame(&mut d, vec![press(false)]);
+    d.frames(2);
+    let fence = WINDOW.with(|w| w.borrow().reset_requests.last().copied()).expect("the window's next passes rearm its fence");
+    window_frame(&mut d, vec![ime_commit("x")]);
+    assert_eq!(text(&mut d), json!("alpha日本ご"), "the fence blocks a commit until it completes");
+    window_frame(&mut d, vec![egui::Event::ImeResetCompleted { request_id: fence }, ime_preedit("が"), ime_commit("が")]);
+    let after = text(&mut d);
+    assert!(after.as_str().is_some_and(|t| t.contains('が')), "the completed fence admits the commit: {after}");
+}
diff --git a/crates/ui-egui/tests/nest_editing_ui.rs b/crates/ui-egui/tests/it/nest_editing_ui.rs
similarity index 95%
rename from crates/ui-egui/tests/nest_editing_ui.rs
rename to crates/ui-egui/tests/it/nest_editing_ui.rs
index 4ad6e6abb..33394004b 100644
--- a/crates/ui-egui/tests/nest_editing_ui.rs
+++ b/crates/ui-egui/tests/it/nest_editing_ui.rs
@@ -97,14 +97,14 @@ fn reveal_in_project_shows_the_clips_item_in_the_project_panel() {
         };
         let bin = d.app().session.project.root.parent_of(item).expect("the demo keeps its footage in a bin").0;
         // the Project panel is closed, its bins are collapsed and a search hides everything
-        d.app().ui.dock.close(PanelKind::Project);
+        d.app().ui.dock.apply(craft_ui::docking::Action::Close { panel: PanelKind::Project }).unwrap();
         d.app().ui.expanded_bins.clear();
         d.app().ui.project_search = "no such thing".into();
         d.frames(2);
         assert!(!d.has(&format!("project.item.{}", item.0)));
         d.exec("clip.revealInProject", json!({"clip": clip}));
         d.frames(3);
-        assert!(d.app().ui.dock.is_visible(PanelKind::Project), "{mode:?}");
+        assert!(filmcraft_ui_egui::dock::LayoutExt::is_visible(&d.app().ui.dock, PanelKind::Project), "{mode:?}");
         assert!(d.app().ui.project_search.is_empty());
         assert_eq!(d.app().session.state.project_selection, vec![item]);
         if mode == ViewMode::List {
diff --git a/crates/ui-egui/tests/nest_rendering_ui.rs b/crates/ui-egui/tests/it/nest_rendering_ui.rs
similarity index 95%
rename from crates/ui-egui/tests/nest_rendering_ui.rs
rename to crates/ui-egui/tests/it/nest_rendering_ui.rs
index e75837f73..7caf7df29 100644
--- a/crates/ui-egui/tests/nest_rendering_ui.rs
+++ b/crates/ui-egui/tests/it/nest_rendering_ui.rs
@@ -67,9 +67,10 @@ impl Driver {
 
 impl Driver {
     /// The cached waveform peaks of `item`, once `ready` accepts them (they are made in the
-    /// background; drawing the Timeline asks for them).
+    /// background; drawing the Timeline asks for them), for at most two minutes of wall-clock time.
     fn peaks_when(&mut self, item: u64, ready: impl Fn(&[(f32, f32)]) -> bool) -> Vec<(f32, f32)> {
-        for _ in 0..400 {
+        let t0 = std::time::Instant::now();
+        while t0.elapsed().as_secs() < 120 {
             self.frames(1);
             let got = self.app().tl.peaks.lock().unwrap().get(&(ItemId(item), 0)).cloned();
             if let Some(p) = got.filter(|p| ready(p)) {
diff --git a/crates/ui-egui/tests/nested_ui.rs b/crates/ui-egui/tests/it/nested_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/nested_ui.rs
rename to crates/ui-egui/tests/it/nested_ui.rs
diff --git a/crates/ui-egui/tests/panels_ui.rs b/crates/ui-egui/tests/it/panels_ui.rs
similarity index 80%
rename from crates/ui-egui/tests/panels_ui.rs
rename to crates/ui-egui/tests/it/panels_ui.rs
index acc672a35..316778e7b 100644
--- a/crates/ui-egui/tests/panels_ui.rs
+++ b/crates/ui-egui/tests/it/panels_ui.rs
@@ -94,9 +94,11 @@ impl Driver {
         v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).and_then(|e| e["label"].as_str().map(str::to_string)).unwrap_or_default()
     }
 
-    /// Step frames until `id` is registered (frames render on worker threads).
+    /// Step frames until `id` is registered (frames render on worker threads), for at most two
+    /// minutes of wall-clock time.
     fn wait_for(&mut self, id: &str) {
-        for _ in 0..400 {
+        let t0 = std::time::Instant::now();
+        while t0.elapsed().as_secs() < 120 {
             if self.has(id) {
                 return;
             }
@@ -183,7 +185,7 @@ fn every_panel_opens_from_the_window_menu() {
 /// and closing every panel still leaves a dock that Window ▸ can reopen panels into.
 #[test]
 fn panel_menu_maximize_restores_and_an_empty_dock_reopens() {
-    use filmcraft_ui_egui::dock::{DockNode, PanelKind};
+    use filmcraft_ui_egui::dock::PanelKind;
     let mut d = Driver::demo();
     let layout = d.app().ui.dock.clone();
     d.click("panel.menu.Program");
@@ -198,33 +200,74 @@ fn panel_menu_maximize_restores_and_an_empty_dock_reopens() {
     assert_eq!(d.app().ui.dock, layout, "the layout survives maximize / restore");
     assert!(d.has("panel.Timeline"));
 
-    let mut all = Vec::new();
-    layout.panels(&mut all);
-    for p in all {
+    for p in layout.panels() {
         d.ok("ui.panel.close", json!({"panel": p.id()}));
     }
-    assert_eq!(d.app().ui.dock, DockNode::Tabs { panels: vec![], active: 0 });
+    assert_eq!(d.app().ui.dock.root, None);
     d.ok("ui.menu.invoke", json!({"id": "window.panel.Program"}));
     d.ok("ui.menu.invoke", json!({"id": "window.panel.Timeline"}));
     d.frames(3);
     assert!(d.has("panel.tab.Program") && d.has("panel.tab.Timeline"));
 }
 
+/// The History panel menu: Delete Redoable Actions asks for OK and then forgets the dimmed steps
+/// (Backspace in the History panel asks the same), and Clear History forgets every step. The
+/// project stays as it is.
+#[test]
+fn history_panel_menu_deletes_redoable_actions_and_clears_the_history() {
+    let mut d = Driver::demo();
+    for name in ["A", "B", "C"] {
+        d.exec("file.newBin", json!({"name": name}));
+    }
+    d.exec("edit.undo", json!({}));
+    d.exec("edit.undo", json!({}));
+    d.ok("ui.menu.invoke", json!({"id": "window.panel.History"}));
+    d.frames(3);
+    let redo = |d: &mut Driver| d.exec("history.list", json!({}))["redo"].as_array().unwrap().len();
+    assert_eq!(redo(&mut d), 2);
+    let project = d.app().session.project.clone();
+
+    d.click("panel.menu.History");
+    assert_eq!(d.label("panel.menu.History.deleteRedoable"), "Delete Redoable Actions");
+    assert_eq!(d.label("panel.menu.History.clear"), "Clear History");
+    d.click("panel.menu.History.deleteRedoable");
+    assert!(d.has("history.deleteRedoable.ok"), "Delete Redoable Actions asks first");
+    assert_eq!(redo(&mut d), 2, "nothing is deleted before OK");
+    d.click("history.deleteRedoable.cancel");
+    assert!(!d.has("history.deleteRedoable.ok"));
+    assert_eq!(redo(&mut d), 2, "Cancel keeps the steps");
+
+    d.ok("ui.key", json!({"key": "Backspace"}));
+    d.frames(2);
+    assert!(d.has("history.deleteRedoable.ok"), "Backspace in the History panel asks too");
+    d.click("history.deleteRedoable.ok");
+    assert!(!d.has("history.deleteRedoable.ok"));
+    assert_eq!(redo(&mut d), 0);
+    assert_eq!(*d.app().session.project, *project, "the project does not change");
+
+    d.click("panel.menu.History");
+    d.click("panel.menu.History.clear");
+    assert_eq!(d.exec("history.list", json!({})), json!({"undo": [], "redo": []}));
+    assert_eq!(*d.app().session.project, *project, "the project does not change");
+    assert!(!d.app().session.is_enabled("history.clear"), "an empty history has nothing to clear");
+}
+
 /// The wheel over a tab strip switches that group's tab: down = next, up = previous, one tab per
 /// notch, smaller trackpad steps adding up to a notch, stopping at the ends. Over the panel's
 /// content the wheel leaves the tabs alone.
 #[test]
 fn wheel_over_a_tab_strip_switches_tabs() {
-    use filmcraft_ui_egui::dock::{DockNode, PanelKind};
+    use craft_ui::docking::Node;
+    use filmcraft_ui_egui::dock::PanelKind;
     fn shown(d: &mut Driver) -> PanelKind {
-        fn find(n: &DockNode) -> Option<PanelKind> {
+        fn find(n: &Node<PanelKind>) -> Option<PanelKind> {
             match n {
-                DockNode::Tabs { panels, active } if panels.contains(&PanelKind::Project) => panels.get(*active).copied(),
-                DockNode::Tabs { .. } => None,
-                DockNode::Split { a, b, .. } => find(a).or_else(|| find(b)),
+                Node::Tabs { panels, active } if panels.contains(&PanelKind::Project) => panels.get(*active).copied(),
+                Node::Split { first, second, .. } => find(first).or_else(|| find(second)),
+                _ => None,
             }
         }
-        find(&d.app().ui.dock).unwrap()
+        d.app().ui.dock.root.as_ref().and_then(find).unwrap()
     }
     fn wheel(d: &mut Driver, dy: f64) {
         let id = format!("panel.tab.{}", shown(d).id());
@@ -248,6 +291,7 @@ fn wheel_over_a_tab_strip_switches_tabs() {
     for step in 0..5 {
         d.harness.input_mut().events.push(egui::Event::MouseWheel {
             unit: egui::MouseWheelUnit::Point,
+            source: egui::MouseWheelSource::Wheel,
             delta: egui::vec2(0.0, -10.0),
             modifiers: egui::Modifiers::NONE,
             phase: egui::TouchPhase::Move,
@@ -744,3 +788,111 @@ fn middle_closing_an_inactive_project_tab_keeps_the_inspector_target() {
     let source = d.app().ui.panels.inspector_source;
     assert_eq!(d.label("info.item"), name, "closing a tab must not select its stale item; focused={focused:?}, source={source:?}");
 }
+
+/// #2329: in the Effects panel what a folder holds is indented under it: an effect's label starts
+/// right of its sub-folder's, a sub-folder's right of its top folder's, and the same for presets
+/// and Lumetri presets.
+#[test]
+fn effects_are_indented_under_their_folders() {
+    fn text_x(d: &mut Driver, text: &str) -> f32 {
+        fn find(shapes: &[egui::Shape], text: &str) -> Option<f32> {
+            shapes.iter().find_map(|s| match s {
+                egui::Shape::Text(t) if t.galley.text() == text => Some(t.pos.x),
+                egui::Shape::Vec(v) => find(v, text),
+                _ => None,
+            })
+        }
+        let shapes: Vec<egui::Shape> = d.harness.output().shapes.iter().map(|c| c.shape.clone()).collect();
+        find(&shapes, text).unwrap_or_else(|| panic!("`{text}` is not drawn"))
+    }
+    let mut d = Driver::demo();
+    d.ok("ui.panel.show", json!({"panel": "Effects"}));
+    d.frames(3);
+    for folder in ["Video Effects", "Video Effects/Blur & Sharpen", "Presets", "Lumetri Presets", "Lumetri Presets/Monochrome"] {
+        d.click(&format!("effects.folder.{folder}"));
+    }
+    d.frames(2);
+    let preset = d.app().session.presets.all()[0].name.clone();
+    let lumetri = filmcraft_render::lumetri_presets::presets().into_iter().find(|p| p.folder == "Monochrome").unwrap().name;
+    for (outer, inner) in [
+        ("Video Effects", "Blur & Sharpen"),
+        ("Blur & Sharpen", "Gaussian Blur"),
+        ("Presets", preset.as_str()),
+        ("Lumetri Presets", "Monochrome"),
+        ("Monochrome", lumetri),
+    ] {
+        let (a, b) = (text_x(&mut d, outer), text_x(&mut d, inner));
+        assert!(b >= a + 12.0, "`{inner}` ({b}) is not indented under `{outer}` ({a})");
+    }
+}
+
+/// The font of the first run of every text shape drawn this frame, with the text, position and colour.
+fn painted_text(d: &Driver) -> Vec<(String, egui::Pos2, egui::FontId, egui::Color32)> {
+    fn walk(s: &egui::Shape, out: &mut Vec<(String, egui::Pos2, egui::FontId, egui::Color32)>) {
+        match s {
+            egui::Shape::Text(t) => {
+                if let Some(sec) = t.galley.job.sections.first() {
+                    out.push((t.galley.text().to_string(), t.pos, sec.format.font_id.clone(), sec.format.color));
+                }
+            }
+            egui::Shape::Vec(v) => v.iter().for_each(|s| walk(s, out)),
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    d.harness.output().shapes.iter().for_each(|c| walk(&c.shape, &mut out));
+    out
+}
+
+// Regression test for #130: the big blue timecodes over the timeline and under the monitors were
+// drawn in 15 pt semibold; Premiere's are regular weight, 16 pt, in the timecode colour.
+#[test]
+fn big_timecodes_are_regular_weight_16pt_in_the_timecode_colour() {
+    let mut d = Driver::demo();
+    d.ok("ui.panel.show", json!({"panel": "Program"}));
+    d.ok("ui.panel.show", json!({"panel": "ReferenceMonitor"}));
+    d.frames(3);
+    let timecode = d.app().tokens.timecode;
+    for id in ["timeline.timecode", "program.timecode", "reference.timecode"] {
+        let rect = {
+            let v = d.ok("ui.elements", json!({"prefix": id}));
+            let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no element {id}")).clone();
+            let r = &e["rect"];
+            egui::Rect::from_min_size(
+                egui::pos2(r[0].as_f64().unwrap() as f32, r[1].as_f64().unwrap() as f32),
+                egui::vec2(r[2].as_f64().unwrap() as f32, r[3].as_f64().unwrap() as f32),
+            )
+        };
+        let shown = d.label(id);
+        let (_, _, font, color) = painted_text(&d)
+            .into_iter()
+            .find(|(text, pos, ..)| *text == shown && rect.expand(2.0).contains(*pos))
+            .unwrap_or_else(|| panic!("{id}: `{shown}` is not drawn in {rect:?}"));
+        assert_eq!(font, egui::FontId::new(16.0, egui::FontFamily::Proportional), "{id}: font");
+        assert_eq!(color, timecode, "{id}: colour");
+    }
+}
+
+// Regression test for #130: the menu bar's menus were drawn in egui's default body size; Premiere's
+// are the system's, larger (13 pt) and brighter than panel text.
+#[test]
+fn menu_bar_menus_use_the_13pt_menu_text() {
+    let mut d = Driver::demo();
+    d.click("menu.File");
+    d.frames(3);
+    for id in ["menu.File", "menu.file.open", "menu.file.save", "menu.file.saveAs"] {
+        let v = d.ok("ui.elements", json!({"prefix": id}));
+        let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no menu item {id}")).clone();
+        let label = e["label"].as_str().unwrap().to_string();
+        let r = &e["rect"];
+        let rect = egui::Rect::from_min_size(
+            egui::pos2(r[0].as_f64().unwrap() as f32, r[1].as_f64().unwrap() as f32),
+            egui::vec2(r[2].as_f64().unwrap() as f32, r[3].as_f64().unwrap() as f32),
+        );
+        let (_, _, font, _) = painted_text(&d)
+            .into_iter()
+            .find(|(text, pos, ..)| *text == label && rect.contains(*pos))
+            .unwrap_or_else(|| panic!("`{label}` is not drawn in {rect:?}"));
+        assert_eq!(font.size, 13.0, "`{label}` in the File menu");
+    }
+}
diff --git a/crates/ui-egui/tests/par_ui.rs b/crates/ui-egui/tests/it/par_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/par_ui.rs
rename to crates/ui-egui/tests/it/par_ui.rs
diff --git a/crates/ui-egui/tests/perf_ui.rs b/crates/ui-egui/tests/it/perf_ui.rs
similarity index 69%
rename from crates/ui-egui/tests/perf_ui.rs
rename to crates/ui-egui/tests/it/perf_ui.rs
index 5b9d6c845..c37349110 100644
--- a/crates/ui-egui/tests/perf_ui.rs
+++ b/crates/ui-egui/tests/it/perf_ui.rs
@@ -4,6 +4,7 @@
 //! picture follows a value that is dragged and a scrub.
 
 use std::sync::mpsc::{Sender, channel};
+use std::time::{Duration, Instant};
 
 use egui_kittest::Harness;
 use filmcraft_engine::Session;
@@ -65,27 +66,27 @@ impl Driver {
 
     /// Wait (without a UI pass) until the frame workers have `key` ready.
     fn ready(&self, key: FrameKey) {
-        for _ in 0..2000 {
-            if self.harness.state().frames.is_ready(&key) {
-                return;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        panic!("{key:?} was never rendered");
+        wait_for(&format!("{key:?} to be rendered"), Duration::from_millis(5), || self.harness.state().frames.is_ready(&key));
     }
 
     /// The Program monitor at rest: the picture of the frame due is on screen.
     fn settled(&mut self) -> FrameKey {
-        for _ in 0..2000 {
+        let mut shown = None;
+        wait_for("the Program monitor to show its frame", Duration::from_millis(5), || {
             self.frames(1);
-            if let Some(k) = self.harness.state().program_picture()
-                && k == self.due(k)
-            {
-                return k;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        panic!("the Program monitor never showed its frame");
+            shown = self.harness.state().program_picture().filter(|&k| k == self.due(k));
+            shown.is_some()
+        });
+        shown.unwrap()
+    }
+}
+
+/// Call `done` every `pause` until it holds, for at most two minutes of wall-clock time.
+fn wait_for(what: &str, pause: Duration, mut done: impl FnMut() -> bool) {
+    let t0 = Instant::now();
+    while !done() {
+        assert!(t0.elapsed().as_secs() < 120, "timed out waiting for {what}");
+        std::thread::sleep(pause);
     }
 }
 
@@ -97,6 +98,7 @@ fn perf_stats_reports_playback_frames_and_decode() {
         d.frames(1);
         std::thread::sleep(std::time::Duration::from_millis(10));
     }
+    d.settled();
     let v = d.ok("perf.stats", json!({}));
     for (section, keys) in [
         ("decode", &["cacheHitRate", "samplesDecoded", "decodeMs"][..]),
@@ -160,6 +162,33 @@ fn program_monitor_follows_a_backward_scrub() {
     assert_eq!(d.settled().frame, before.frame);
 }
 
+/// Opening a project gives the app a new media pool and a new frame server. The old server's
+/// workers end, so the first project's media pool is released.
+#[test]
+fn opening_a_project_releases_the_previous_media_pool() {
+    let dir = std::env::temp_dir().join(format!("filmcraft-perf-ui-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("reopen.fcproj").to_string_lossy().to_string();
+
+    let mut d = Driver::demo();
+    d.settled();
+    d.exec("file.saveAs", json!({"path": path}));
+    let first = std::sync::Arc::downgrade(&d.harness.state().session.media);
+    d.exec("file.open", json!({"path": path}));
+    d.frames(3);
+    let app = d.harness.state();
+    assert!(std::sync::Arc::ptr_eq(&app.frames.pool, &app.session.media), "the frame server serves the opened project's pool");
+    for _ in 0..2000 {
+        if first.strong_count() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(first.strong_count(), 0, "something still holds the first project's media pool");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// A frame being rendered is kept when the same frame is asked for at a newer revision: frames
 /// that take longer than a refresh (CPU effects) were each cancelled by the next step of a drag,
 /// so none was ever shown until the mouse rested.
@@ -167,15 +196,7 @@ fn program_monitor_follows_a_backward_scrub() {
 fn a_newer_revision_keeps_the_frame_being_rendered() {
     let d = Driver::demo();
     let app = d.harness.state();
-    let idle = || {
-        for _ in 0..200_000 {
-            if app.frames.queue_len() == 0 {
-                return;
-            }
-            std::thread::sleep(std::time::Duration::from_micros(50));
-        }
-        panic!("the frame queue never emptied");
-    };
+    let idle = || wait_for("the frame queue to empty", Duration::from_micros(50), || app.frames.queue_len() == 0);
     // the clip with Lumetri Color at full resolution: tens of milliseconds on the CPU
     let seq = app.session.state.active_sequence.unwrap();
     let rate = app.session.active_sequence().unwrap().settings.frame_rate;
@@ -190,3 +211,29 @@ fn a_newer_revision_keeps_the_frame_being_rendered() {
     d.ready(key(9002));
     d.ready(key(9001));
 }
+
+/// #1682: thumbnail textures (timeline tiles, hover scrubs) are capped instead of one being kept
+/// for every frame ever shown.
+#[test]
+fn thumbnail_textures_are_capped() {
+    let mut d = Driver::demo();
+    let ctx = d.harness.ctx.clone();
+    let item = {
+        let p = &d.harness.state().session.project;
+        p.items.values().find(|i| i.as_media().is_some_and(|m| m.info.video.is_some())).expect("a video item").id
+    };
+    let rate = d.harness.state().session.project.item(item).unwrap().frame_rate();
+    // 800 distinct frames, 100 per UI pass: request, wait until rendered, then make the textures
+    for chunk in 0..8 {
+        let frames: Vec<i64> = (chunk * 100..chunk * 100 + 100).collect();
+        for &f in &frames {
+            d.harness.state_mut().thumbnail(&ctx, item, rate.tick_of(f), 32);
+        }
+        wait_for("100 thumbnails to be rendered", Duration::from_millis(5), || {
+            frames.iter().all(|&f| d.harness.state_mut().thumbnail(&ctx, item, rate.tick_of(f), 32).is_some())
+        });
+        d.frames(1);
+    }
+    let n = d.harness.state().thumbnail_textures();
+    assert!((100..=512).contains(&n), "{n} thumbnail textures");
+}
diff --git a/crates/ui-egui/tests/playback_clock_ui.rs b/crates/ui-egui/tests/it/playback_clock_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/playback_clock_ui.rs
rename to crates/ui-egui/tests/it/playback_clock_ui.rs
diff --git a/crates/ui-egui/tests/project_panel_ui.rs b/crates/ui-egui/tests/it/project_panel_ui.rs
similarity index 89%
rename from crates/ui-egui/tests/project_panel_ui.rs
rename to crates/ui-egui/tests/it/project_panel_ui.rs
index 87874210f..1e54ce82e 100644
--- a/crates/ui-egui/tests/project_panel_ui.rs
+++ b/crates/ui-egui/tests/it/project_panel_ui.rs
@@ -104,9 +104,10 @@ impl Driver {
         v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).and_then(|e| e["label"].as_str().map(str::to_string)).unwrap_or_default()
     }
 
-    /// Step frames until `id` is registered.
+    /// Step frames until `id` is registered, for at most two minutes of wall-clock time.
     fn wait_for(&mut self, id: &str) {
-        for _ in 0..400 {
+        let t0 = std::time::Instant::now();
+        while t0.elapsed().as_secs() < 120 {
             if self.has(id) {
                 return;
             }
@@ -235,6 +236,59 @@ fn list_view_columns_sort_resize_and_rename() {
     assert_ne!(d.app().session.project.item(ItemId(items[0])).unwrap().name, "Hero shot");
 }
 
+// Regression test for #1295: in a narrow List-view column the sort arrow was painted over the end of
+// the (clipped) column name; the name must be clipped to the left of the arrow.
+#[test]
+fn sorted_column_header_name_is_clipped_clear_of_the_sort_arrow() {
+    fn collect<'a>(shapes: &'a [egui::Shape], clip: egui::Rect, out: &mut Vec<(&'a egui::Shape, egui::Rect)>) {
+        for s in shapes {
+            match s {
+                egui::Shape::Vec(v) => collect(v, clip, out),
+                other => out.push((other, clip)),
+            }
+        }
+    }
+    let mut d = project_driver();
+    d.exec("project.view.set", json!({"view": "list"}));
+    d.frames(2);
+    // the default sort is by Name; make that column narrow enough that its name is clipped
+    for c in &mut d.app().session.prefs.project_panel.view.columns {
+        if c.name == "Name" {
+            c.width = 40.0;
+        }
+    }
+    d.frames(3);
+    assert_eq!(d.app().session.prefs.project_panel.view.sort.column, "Name");
+    let [hx, hy, hw, hh] = d.rect("project.list.header.Name");
+    let header = egui::Rect::from_min_size(egui::pos2(hx, hy), egui::vec2(hw, hh));
+    let mut all = Vec::new();
+    let clipped: Vec<_> = d.harness.output().shapes.iter().map(|c| (c.shape.clone(), c.clip_rect)).collect();
+    for (shape, clip) in &clipped {
+        collect(std::slice::from_ref(shape), *clip, &mut all);
+    }
+    // the visible part of the name: the clip rect of the header's "Name" text
+    let name_clip = all
+        .iter()
+        .find_map(|(s, clip)| match s {
+            egui::Shape::Text(t) if t.galley.text() == "Name" && header.contains(t.pos) => Some(*clip),
+            _ => None,
+        })
+        .expect("the Name header text is drawn");
+    // the arrow: the 1.3 px strokes drawn inside the header
+    let arrow_x: Vec<f32> = all
+        .iter()
+        .filter_map(|(s, _)| match s {
+            egui::Shape::LineSegment { points, stroke } if (stroke.width - 1.3).abs() < 1e-3 && header.contains(points[0]) && header.contains(points[1]) => {
+                Some(points[0].x.min(points[1].x))
+            }
+            _ => None,
+        })
+        .collect();
+    assert!(!arrow_x.is_empty(), "the sort arrow is drawn in the sorted column's header");
+    let arrow_left = arrow_x.into_iter().fold(f32::MAX, f32::min);
+    assert!(name_clip.max.x <= arrow_left, "the name is visible up to x={} but the sort arrow starts at x={arrow_left}", name_clip.max.x);
+}
+
 #[test]
 fn icon_view_hover_scrub_sets_in_and_out() {
     let mut d = project_driver();
@@ -1128,3 +1182,65 @@ fn escape_takes_back_a_media_browser_drag() {
     assert_eq!(d.app().session.project.to_json(), before, "nothing was placed on the Timeline");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// A clip dragged onto the New Item button makes a sequence from it, as File ▸ New ▸ Sequence
+/// From Clip does (#2855): named after the clip, with its frame size and rate, the clip on the
+/// timeline and the sequence open. One of several selected items brings the whole selection.
+#[test]
+fn dragging_clips_onto_new_item_makes_a_matching_sequence() {
+    let mut d = Driver::demo();
+    let (bin, items) = d.footage();
+    assert!(items.len() >= 3);
+    d.ok("ui.menu.invoke", json!({"id": "projectPanel.openBin", "params": {"bin": bin, "how": "inPlace"}}));
+    let card = |i: u64| format!("project.item.{i}");
+    d.wait_for(&card(items[0]));
+    let sequences = |d: &mut Driver| d.app().session.project.items.values().filter(|i| matches!(i.kind, filmcraft_project::ItemKind::Sequence(_))).count();
+    let clips = |d: &mut Driver| d.app().session.active_sequence().map(|q| q.video_tracks.iter().map(|t| t.items.len()).sum::<usize>()).unwrap_or(0);
+    let drop = json!({"id": "project.button.new-item"});
+    // footage that differs from a new sequence's defaults, so matching it shows
+    if let Some(filmcraft_project::ItemKind::Media(m)) = std::sync::Arc::make_mut(&mut d.app().session.project).item_mut(ItemId(items[0])).map(|i| &mut i.kind)
+        && let Some(v) = m.info.video.as_mut()
+    {
+        (v.width, v.height, v.frame_rate) = (1280, 720, filmcraft_time::FrameRate::FPS_25);
+    }
+    let def = filmcraft_project::SequenceSettings::default();
+    assert_ne!((def.width, def.height, def.frame_rate), (1280, 720, filmcraft_time::FrameRate::FPS_25));
+    let n0 = sequences(&mut d);
+
+    // a drop on another footer button, or a Source Monitor drag, makes nothing
+    d.ok("ui.drag", json!({"from": {"id": card(items[0])}, "to": {"id": "project.button.file.newBin"}, "steps": 16}));
+    d.frames(4);
+    assert_eq!(sequences(&mut d), n0, "New Bin is not a drop target");
+    d.exec("source.open", json!({"item": items[0]}));
+    d.wait_for("source.drag.both");
+    d.ok("ui.drag", json!({"from": {"id": "source.drag.both"}, "to": drop, "steps": 16}));
+    d.frames(4);
+    assert_eq!(sequences(&mut d), n0, "a Source Monitor drag is not taken");
+
+    // an item that is not selected: a sequence of that clip alone
+    d.exec("project.select", json!({"items": [items[2]]}));
+    let steps = d.app().session.history.undo.len();
+    d.ok("ui.drag", json!({"from": {"id": card(items[0])}, "to": drop, "steps": 16}));
+    d.frames(4);
+    assert_eq!(sequences(&mut d), n0 + 1, "the drop makes one sequence");
+    assert!(!d.has("project.newItem.file.newSequence"), "the drop does not open the New Item menu");
+    let app = d.app();
+    let clip = app.session.project.item(ItemId(items[0])).unwrap().clone();
+    let filmcraft_project::ItemKind::Media(m) = &clip.kind else { panic!("footage is media") };
+    let v = m.info.video.clone().expect("footage has video");
+    let q = app.session.active_sequence().expect("the new sequence is active");
+    let seq = app.session.state.active_sequence.unwrap();
+    assert_eq!(app.session.project.item(seq).unwrap().name, clip.name, "named after the clip");
+    assert_eq!((q.settings.width, q.settings.height, q.settings.frame_rate), (v.width, v.height, v.frame_rate), "the clip's frame size and rate");
+    assert_eq!(q.video_tracks[0].items.first().map(|c| c.item), Some(ItemId(items[0])), "the clip is on the timeline");
+    assert_eq!(app.session.history.undo.len(), steps + 1, "one undo step");
+    assert_eq!(clips(&mut d), 1, "an unselected item goes alone");
+
+    // two of the selection: both, back to back, in one sequence
+    d.exec("project.select", json!({"items": [items[0], items[1]]}));
+    d.frames(2);
+    d.ok("ui.drag", json!({"from": {"id": card(items[1])}, "to": drop, "steps": 16}));
+    d.frames(4);
+    assert_eq!(sequences(&mut d), n0 + 2);
+    assert_eq!(clips(&mut d), 2, "the whole selection is placed");
+}
diff --git a/crates/ui-egui/tests/properties_scroll_ui.rs b/crates/ui-egui/tests/it/properties_scroll_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/properties_scroll_ui.rs
rename to crates/ui-egui/tests/it/properties_scroll_ui.rs
diff --git a/crates/ui-egui/tests/remix_ui.rs b/crates/ui-egui/tests/it/remix_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/remix_ui.rs
rename to crates/ui-egui/tests/it/remix_ui.rs
diff --git a/crates/ui-egui/tests/scripted.rs b/crates/ui-egui/tests/it/scripted.rs
similarity index 96%
rename from crates/ui-egui/tests/scripted.rs
rename to crates/ui-egui/tests/it/scripted.rs
index 0bb1dd741..8567c6afc 100644
--- a/crates/ui-egui/tests/scripted.rs
+++ b/crates/ui-egui/tests/it/scripted.rs
@@ -54,6 +54,16 @@ impl Driver {
         }
     }
 
+    /// Run frames until `done` holds, for at most two minutes of wall-clock time.
+    fn wait_until(&mut self, what: &str, mut done: impl FnMut(&mut Self) -> bool) {
+        let t0 = std::time::Instant::now();
+        while !done(self) {
+            assert!(t0.elapsed().as_secs() < 120, "timed out waiting for {what}");
+            self.frames(1);
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+    }
+
     /// Send a control request and run frames until it is answered.
     fn call(&mut self, method: &str, params: Value) -> Value {
         let (req, reply) = ControlRequest::new(method, params.clone());
@@ -191,10 +201,11 @@ fn spanish_search_finds_effects_and_presets_with_stable_automation_ids() {
     let mut d = Driver::demo();
     d.ok("ui.menu.invoke", json!({"id": "app.language.spanish"}));
     d.ok("ui.panel.show", json!({"panel": "Effects"}));
-    d.ok("ui.set", json!({"effectsSearch": "DESENFOQUE"}));
+    let es = filmcraft_ui_egui::i18n::Language::Es;
+    d.ok("ui.set", json!({"effectsSearch": es.tr("Gaussian Blur").to_uppercase()}));
     d.frames(3);
     assert!(d.element_ids("effects.item.").contains(&"effects.item.gaussian_blur".to_string()));
-    d.ok("ui.set", json!({"effectsSearch": "ENTRADA CON DESENFOQUE"}));
+    d.ok("ui.set", json!({"effectsSearch": es.tr("Blur In").to_uppercase()}));
     d.frames(3);
     assert!(d.element_ids("effects.preset.").contains(&"effects.preset.Blur In".to_string()));
     let clip = track_clips(&d.sequence(), 0)[0]["clip"].as_u64().unwrap();
@@ -401,7 +412,7 @@ impl Driver {
 }
 
 /// Renders the Trim Monitor and the Keyboard Shortcuts dialog to PNGs for visual review (needs a
-/// GPU): `cargo test -p filmcraft-ui-egui --test scripted -- --ignored screenshots`.
+/// GPU): `cargo test -p filmcraft-ui-egui --test it scripted::screenshots -- --ignored`.
 #[test]
 #[ignore]
 fn screenshots() {
@@ -532,15 +543,10 @@ fn keyboard_shortcuts_dialog_assigns_live_and_cancel_restores() {
 fn waveform_peaks_do_not_survive_opening_another_project() {
     let mut d = Driver::demo();
     let mut first = None;
-    for _ in 0..2000 {
-        d.frames(1);
-        let peaks = d.harness.state().tl.peaks.lock().unwrap().iter().map(|(k, v)| (*k, v.clone())).next();
-        if peaks.is_some() {
-            first = peaks;
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(5));
-    }
+    d.wait_until("the demo timeline's waveform peaks", |d| {
+        first = d.harness.state().tl.peaks.lock().unwrap().iter().map(|(k, v)| (*k, v.clone())).next();
+        first.is_some()
+    });
     let (item, old) = first.expect("the demo timeline computes waveform peaks");
     // Reopen the same project from disk: same item ids, new media pool.
     let path = std::env::temp_dir().join(format!("fc-peaks-{}.fcproj", std::process::id()));
@@ -597,11 +603,6 @@ fn eyedropper_picks_a_key_color_on_a_selected_clip() {
     d.ok("ui.click", json!({"id": "effectControls.color_key.color.eyedropper"}));
     d.frames(2);
     d.ok("ui.click", json!({"id": "program.picture"}));
-    for _ in 0..200 {
-        if color(&mut d) != before {
-            break;
-        }
-        d.frames(1);
-    }
+    d.wait_until("the eyedropper to fill Key Color", |d| color(d) != before);
     assert_ne!(color(&mut d), before, "the eyedropper filled Key Color from the Program picture");
 }
diff --git a/crates/ui-egui/tests/sequence_tabs_ui.rs b/crates/ui-egui/tests/it/sequence_tabs_ui.rs
similarity index 97%
rename from crates/ui-egui/tests/sequence_tabs_ui.rs
rename to crates/ui-egui/tests/it/sequence_tabs_ui.rs
index d2f73b675..a2702c2ac 100644
--- a/crates/ui-egui/tests/sequence_tabs_ui.rs
+++ b/crates/ui-egui/tests/it/sequence_tabs_ui.rs
@@ -91,7 +91,7 @@ impl Driver {
     }
 
     fn has_timeline(&mut self) -> bool {
-        self.app().ui.dock.contains(filmcraft_ui_egui::dock::PanelKind::Timeline)
+        self.app().ui.dock.contains(&filmcraft_ui_egui::dock::PanelKind::Timeline)
     }
 }
 
@@ -170,7 +170,7 @@ fn timeline_has_a_tab_per_open_sequence() {
     assert!(d.has_timeline(), "closing the last sequence keeps the Timeline panel");
     assert!(d.has("panel.tab.Timeline"));
     // reopening from the project brings it back, even if the panel itself was closed
-    d.app().ui.dock.close(filmcraft_ui_egui::dock::PanelKind::Timeline);
+    d.app().ui.dock.apply(craft_ui::docking::Action::Close { panel: filmcraft_ui_egui::dock::PanelKind::Timeline }).unwrap();
     d.frames(2);
     assert!(!d.has_timeline());
     d.exec("sequence.open", json!({"item": main}));
diff --git a/crates/ui-egui/tests/sequence_ui.rs b/crates/ui-egui/tests/it/sequence_ui.rs
similarity index 90%
rename from crates/ui-egui/tests/sequence_ui.rs
rename to crates/ui-egui/tests/it/sequence_ui.rs
index 229821d1a..3003e0431 100644
--- a/crates/ui-egui/tests/sequence_ui.rs
+++ b/crates/ui-egui/tests/it/sequence_ui.rs
@@ -1,5 +1,5 @@
 //! Headless UI tests of the Sequence / Markers menu additions: the Add Tracks and Delete Tracks dialogs, the
-//! through-edit marks on the timeline, the Markers panel colour filter and the Shift+; gap key.
+//! through-edit marks and duplicate frame markers on the timeline, the Markers panel colour filter and the Shift+; gap key.
 //! The real `FilmcraftApp` under `egui_kittest`, driven over the control channel by automation id.
 //!
 //! Set `FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` to also render the window offscreen with wgpu and write
@@ -133,6 +133,20 @@ impl Driver {
         self.frames(3);
     }
 
+    /// The ids under `prefix` once `done` holds for them: the timeline works out duplicate frame
+    /// markers on a background thread.
+    fn ids_once(&mut self, prefix: &str, mut done: impl FnMut(&[String]) -> bool) -> Vec<String> {
+        let t0 = std::time::Instant::now();
+        loop {
+            let ids = self.ids(prefix);
+            if done(&ids) || t0.elapsed().as_secs() >= 30 {
+                return ids;
+            }
+            self.frames(1);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+
     fn ids(&mut self, prefix: &str) -> Vec<String> {
         let v = self.ok("ui.elements", json!({"prefix": prefix}));
         v.as_array().unwrap().iter().filter_map(|e| e["id"].as_str().map(str::to_string)).collect()
@@ -316,6 +330,66 @@ fn through_edits_are_marked_on_the_timeline() {
     assert!(d.ids("timeline.throughEdit.").is_empty(), "joined");
 }
 
+#[test]
+fn duplicate_frame_markers_are_drawn_on_repeated_clips() {
+    let mut d = Driver::demo();
+    // the demo's first V1 clip placed again on V2 at the same time: both show the same frames
+    let (first, item, start, source_in, duration) = {
+        let c = &d.app().session.active_sequence().unwrap().video_tracks[0].items[0];
+        (c.id.0, c.item.0, c.start.0, c.source_in.0, c.duration.0)
+    };
+    let r = d.exec("timeline.place", json!({"item": item, "track": "V2", "time": start, "sourceIn": source_in, "duration": duration, "audio": false}));
+    let copy = r["clips"][0].as_u64().unwrap();
+    d.frames(3);
+    assert!(d.ids("timeline.duplicateFrames.").is_empty(), "hidden until Show Duplicate Frame Markers");
+    d.click("timeline.toggle.settings");
+    d.click("timeline.settings.showDuplicateFrameMarkers");
+    assert!(d.app().session.state.show_duplicate_frame_markers);
+    let has = |marks: &[String], clip: u64| marks.contains(&format!("timeline.duplicateFrames.{clip}.0"));
+    let marks = d.ids_once("timeline.duplicateFrames.", |m| has(m, first) && has(m, copy));
+    for clip in [first, copy] {
+        assert!(has(&marks, clip), "clip {clip}: {marks:?}");
+    }
+    // the markers follow edits: without the copy the first clip repeats nothing (the demo
+    // repeats frames of another clip elsewhere, and those markers stay)
+    let ours = |marks: &[String]| marks.iter().filter(|m| [first, copy].iter().any(|c| m.starts_with(&format!("timeline.duplicateFrames.{c}.")))).count();
+    d.exec("edit.undo", json!({}));
+    let marks = d.ids_once("timeline.duplicateFrames.", |m| ours(m) == 0);
+    assert_eq!(ours(&marks), 0, "the copy is gone: {marks:?}");
+    assert!(!marks.is_empty(), "the demo's own repeat: {marks:?}");
+    d.exec("edit.redo", json!({}));
+    assert_eq!(ours(&d.ids_once("timeline.duplicateFrames.", |m| ours(m) == 2)), 2, "the copy is back");
+    // at 200 % the copy shows every other frame of the original, so the original repeats in
+    // single frames
+    d.app()
+        .session
+        .edit_sequence("test", |q, _, _| {
+            q.find_item_mut(filmcraft_project::ClipId(copy)).unwrap().1.speed = 2.0;
+            Ok(())
+        })
+        .unwrap();
+    let listed = d.exec("sequence.duplicateFrames", json!({}));
+    let runs = listed.as_array().unwrap().iter().find(|e| e["clip"] == json!(first)).unwrap()["ranges"].as_array().unwrap().len();
+    assert!(runs > 4, "{listed}");
+    // only the stripes in view are drawn: scrolled to the middle of the clip, the first is not
+    let (scroll, pps) = (d.app().ui.timeline.scroll, d.app().ui.timeline.pps);
+    let middle = (start + duration / 2) as f64 / filmcraft_time::TICKS_PER_SECOND as f64;
+    (d.app().ui.timeline.scroll, d.app().ui.timeline.target_scroll) = (middle, middle);
+    let scrolled = |m: &[String]| !m.is_empty() && !m.contains(&format!("timeline.duplicateFrames.{first}.0"));
+    let marks = d.ids_once(&format!("timeline.duplicateFrames.{first}."), scrolled);
+    assert!(scrolled(&marks), "{marks:?}");
+    (d.app().ui.timeline.scroll, d.app().ui.timeline.target_scroll) = (scroll, scroll);
+    // zoomed far out, the single frames make one stripe
+    (d.app().ui.timeline.pps, d.app().ui.timeline.target_pps) = (1.0, 1.0);
+    d.frames(3);
+    let marks = d.ids(&format!("timeline.duplicateFrames.{first}."));
+    assert_eq!(marks.len(), 1, "{marks:?}");
+    (d.app().ui.timeline.pps, d.app().ui.timeline.target_pps) = (pps, pps);
+    d.exec("sequence.showDuplicateFrameMarkers", json!({"on": false}));
+    d.frames(3);
+    assert!(d.ids("timeline.duplicateFrames.").is_empty(), "turned off");
+}
+
 #[test]
 fn markers_panel_colour_filter() {
     let mut d = Driver::demo();
diff --git a/crates/ui-egui/tests/settings_ui.rs b/crates/ui-egui/tests/it/settings_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/settings_ui.rs
rename to crates/ui-egui/tests/it/settings_ui.rs
diff --git a/crates/ui-egui/tests/it/shared_docking_ui.rs b/crates/ui-egui/tests/it/shared_docking_ui.rs
new file mode 100644
index 000000000..1d2fa0a28
--- /dev/null
+++ b/crates/ui-egui/tests/it/shared_docking_ui.rs
@@ -0,0 +1,858 @@
+//! Shared docking preserves FilmCraft document state and legacy workspace files.
+
+use craft_ui::docking::{Action, DockArea, Hit, Node, Placement, ResizeEdge, Zone};
+use craft_ui::layout::{SplitAxis, SplitSize};
+use egui::{Event, Modifiers, PointerButton, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::{
+    FilmcraftApp,
+    dock::{self, Layout, LayoutExt, PanelKind},
+    menus,
+};
+use serde_json::json;
+
+fn tabs(panels: &[PanelKind], active: usize) -> Node<PanelKind> {
+    Node::Tabs { panels: panels.to_vec(), active }
+}
+
+fn split(vertical: bool, size: SplitSize, a: Node<PanelKind>, b: Node<PanelKind>) -> Node<PanelKind> {
+    Node::Split { axis: if vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal }, size, first: Box::new(a), second: Box::new(b) }
+}
+
+fn root(node: Node<PanelKind>) -> Layout {
+    Layout { root: Some(node), floating: vec![] }
+}
+
+/// Whether a panel is in the docked frame tree (not a floating window).
+trait Docked {
+    fn docked(&self, panel: PanelKind) -> bool;
+}
+
+impl Docked for Layout {
+    fn docked(&self, panel: PanelKind) -> bool {
+        Layout { root: self.root.clone(), floating: vec![] }.contains(&panel)
+    }
+}
+
+fn layout() -> Layout {
+    root(split(
+        false,
+        SplitSize::Ratio(0.3),
+        tabs(&[PanelKind::Project, PanelKind::Info, PanelKind::History], 1),
+        tabs(&[PanelKind::Source, PanelKind::Program], 1),
+    ))
+}
+
+#[test]
+fn shared_transactions_keep_selection_and_reject_invalid_moves_atomically() {
+    let mut layout = layout();
+    layout.apply(Action::Close { panel: PanelKind::Project }).unwrap();
+    assert!(layout.is_visible(PanelKind::Info));
+    let before = layout.clone();
+    for action in [
+        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Tools, placement: Placement::Split(Zone::Left) },
+        Action::Float { panel: PanelKind::Info, rect: [0.0, 0.0, f32::NAN, 100.0] },
+        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Program, placement: Placement::Tab { before: Some(PanelKind::Tools) } },
+    ] {
+        assert!(layout.apply(action).is_err());
+        assert_eq!(layout, before);
+    }
+    layout.apply(Action::Float { panel: PanelKind::Info, rect: [50.0, 50.0, 400.0, 300.0] }).unwrap();
+    layout.apply(Action::Move { panel: PanelKind::Info, anchor: PanelKind::Program, placement: Placement::Split(Zone::Bottom) }).unwrap();
+    assert!(layout.floating.is_empty());
+    assert!(layout.is_visible(PanelKind::Info));
+}
+
+#[test]
+fn builtin_and_legacy_workspace_shapes_roundtrip_and_save_floating() {
+    for name in dock::WORKSPACES {
+        let layout = dock::workspace(name);
+        for entry in
+            [json!({"name": name, "workspace": dock::Workspace::new(layout.clone())}), json!({"name": name, "layout": legacy(layout.root.as_ref().unwrap())})]
+        {
+            let prefs: dock::WorkspacePrefs = serde_json::from_value(json!({"saved": [entry], "current": name})).unwrap();
+            let loaded = dock::saved_docking(&prefs, name);
+            loaded.validate().unwrap();
+            assert_eq!(loaded, layout);
+            assert!(serde_json::to_value(&prefs).unwrap()["saved"][0].get("floating").is_none());
+        }
+    }
+    let dir = std::env::temp_dir().join(format!("filmcraft-shared-dock-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut session = Session::default();
+    session.prefs_path = Some(dir.join("preferences.json"));
+    let mut app = FilmcraftApp::new(session);
+    let ctx = egui::Context::default();
+    app.ui.dock = layout();
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
+    menus::invoke(&mut app, &ctx, "window.workspace.saveAs", json!({"name": "Floating test"})).unwrap();
+    let prefs = dock::WorkspacePrefs::load(&dir.join(dock::WORKSPACES_FILE));
+    let restored = dock::saved_docking(&prefs, "Floating test");
+    assert_eq!(restored, app.ui.dock);
+    // Earlier versions read `layout` and `floating`.
+    assert!(!prefs.saved[0].layout.is_null() && !prefs.saved[0].workspace.is_null());
+    assert_eq!(prefs.saved[0].floating[0]["panels"], json!(["Info"]));
+    let mut restarted_session = Session::default();
+    restarted_session.prefs_path = Some(dir.join("preferences.json"));
+    let restarted = FilmcraftApp::new(restarted_session);
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| restarted);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    assert_eq!(h.state().ui.dock, restored);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn legacy_effects_workspace_drops_only_the_known_inactive_duplicate() {
+    let expected = dock::workspace("Effects");
+    let mut legacy_tree = expected.root.clone().unwrap();
+    fn duplicate(node: &mut Node<PanelKind>) {
+        match node {
+            Node::Tabs { panels, active } if panels.as_slice() == [PanelKind::EssentialGraphics] => {
+                panels.insert(0, PanelKind::EffectControls);
+                *active = 1;
+            }
+            Node::Split { first, second, .. } => {
+                duplicate(first);
+                duplicate(second);
+            }
+            _ => {}
+        }
+    }
+    duplicate(&mut legacy_tree);
+    let prefs: dock::WorkspacePrefs =
+        serde_json::from_value(json!({"saved": [{"name": "Historical Effects", "layout": legacy(&legacy_tree)}], "current": "Historical Effects"})).unwrap();
+    assert_eq!(dock::saved_docking(&prefs, "Historical Effects"), expected);
+}
+
+/// The frame tree as FilmCraft wrote it before its workspaces were craft-ui workspaces.
+fn legacy(node: &Node<PanelKind>) -> serde_json::Value {
+    match node {
+        Node::Tabs { panels, active } => json!({"Tabs": {"panels": panels, "active": active}}),
+        Node::Split { axis, size, first, second } => json!({"Split": {
+            "vertical": *axis == SplitAxis::Vertical,
+            "size": match size {
+                SplitSize::Ratio(v) => json!({"Ratio": v}),
+                SplitSize::FixedFirst(v) => json!({"FixedA": v}),
+                SplitSize::FixedSecond(v) => json!({"FixedB": v}),
+            },
+            "a": legacy(first),
+            "b": legacy(second),
+        }}),
+        _ => unreachable!(),
+    }
+}
+
+fn step(h: &mut Harness<'_, FilmcraftApp>) {
+    let ctx = h.ctx.clone();
+    let mut input = std::mem::take(h.input_mut());
+    eframe::App::raw_input_hook(h.state_mut(), &ctx, &mut input);
+    *h.input_mut() = input;
+    h.step();
+}
+fn rect(h: &Harness<'_, FilmcraftApp>, id: &str) -> Rect {
+    let element = h.state().auto.find(id).unwrap_or_else(|| panic!("missing {id}"));
+    Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3]))
+}
+fn click(h: &mut Harness<'_, FilmcraftApp>, id: &str) {
+    let pos = rect(h, id).center();
+    h.event(Event::PointerMoved(pos));
+    step(h);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        step(h);
+    }
+    for _ in 0..3 {
+        step(h);
+    }
+}
+fn drag(h: &mut Harness<'_, FilmcraftApp>, from: egui::Pos2, to: egui::Pos2, modifiers: Modifiers) {
+    h.event(Event::ModifiersChanged(modifiers));
+    h.event(Event::PointerMoved(from));
+    step(h);
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
+    step(h);
+    for fraction in [0.05, 0.25, 0.5, 0.75, 1.0] {
+        h.event(Event::PointerMoved(from.lerp(to, fraction)));
+        step(h);
+    }
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
+    step(h);
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    for _ in 0..3 {
+        step(h);
+    }
+}
+
+#[test]
+fn real_panel_drag_merges_splits_floats_and_redocks_without_editing_documents() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    let snapshots = std::env::var_os("CRAFT_UI_DOCKING_SNAPSHOT_DIR").map(std::path::PathBuf::from);
+    let mut builder = Harness::builder().with_size(vec2(1200.0, 760.0));
+    if snapshots.is_some() {
+        builder = builder.wgpu();
+    }
+    let mut h = builder.build_eframe(move |_| app);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    h.state_mut().ui.dock = root(split(true, SplitSize::Ratio(0.62), layout().root.unwrap(), tabs(&[PanelKind::Timeline], 0)));
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    let project = h.state().session.project.clone();
+    let mut action_log = vec![action_state(&h, "start")];
+    let playheads = h.state().session.state.playheads.clone();
+    let from = rect(&h, "panel.tab.Info").center();
+    let to = rect(&h, "panel.Program").center();
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
+    assert!(same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Program));
+    action_log.push(action_state(&h, "merged"));
+    let from = rect(&h, "panel.tab.Info").center();
+    let before = rect(&h, "panel.tab.Source");
+    drag(&mut h, from, pos2(before.left() + 2.0, before.center().y), Modifiers::NONE);
+    assert_eq!(tabs_containing(&h.state().ui.dock, PanelKind::Info).first(), Some(&PanelKind::Info));
+    action_log.push(action_state(&h, "reordered"));
+
+    let from = rect(&h, "panel.tab.Info").center();
+    let left = rect(&h, "panel.History");
+    // Activate a visible sibling after the source left its original group.
+    let to = pos2(left.left() + 8.0, left.center().y);
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
+    assert!(!same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::History));
+    assert!(!same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Program));
+    action_log.push(action_state(&h, "split"));
+    click(&mut h, "panel.tab.Program");
+    assert!(h.state().auto.elements.iter().any(|element| element.id.starts_with("timeline.clip.")));
+    assert!(h.state().auto.find("program.transport.playhead.stepForward").is_some());
+    let from = rect(&h, "panel.tab.Info").center();
+    drag(&mut h, from, pos2(700.0, 400.0), Modifiers::COMMAND);
+    assert_eq!(h.state().ui.dock.floating.len(), 1);
+    assert_eq!(h.query_all_by_label("Resize panel window").next().unwrap().accesskit_node().role(), egui::accesskit::Role::Button);
+    action_log.push(action_state(&h, "floated"));
+    let original = h.state().ui.dock.floating[0].rect;
+    let grip = rect(&h, "panel.float.0.resize").center();
+    drag(&mut h, grip, grip + vec2(36.0, 24.0), Modifiers::NONE);
+    assert!(h.state().ui.dock.floating[0].rect[2] > original[2] + 25.0);
+    assert!(h.state().ui.dock.floating[0].rect[3] > original[3] + 15.0);
+    action_log.push(action_state(&h, "resized"));
+    let grip_id = DockArea::<PanelKind>::hit_id(filmcraft_ui_egui::dock_area_id(), &Hit::Resize(PanelKind::Info, ResizeEdge::BottomRight));
+    // A pointer drag leaves no focus on the grip; focused from the keyboard, it takes arrows.
+    assert_ne!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
+    h.ctx.memory_mut(|memory| memory.request_focus(grip_id));
+    step(&mut h);
+    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
+    let before_keys = h.state().ui.dock.floating[0].rect;
+    for key in [egui::Key::ArrowRight, egui::Key::ArrowDown] {
+        for pressed in [true, false] {
+            h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+            step(&mut h);
+        }
+    }
+    assert_eq!(h.state().ui.dock.floating[0].rect[2], before_keys[2] + 8.0);
+    assert_eq!(h.state().ui.dock.floating[0].rect[3], before_keys[3] + 8.0);
+    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    step(&mut h);
+    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    assert_ne!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
+    action_log.push(action_state(&h, "keyboard-resized"));
+    let resized = h.state().ui.dock.floating[0].rect;
+    let header = rect(&h, "panel.float.0.move");
+    let from = pos2(header.right() - 24.0, header.center().y);
+    drag(&mut h, from, from - vec2(24.0, 18.0), Modifiers::NONE);
+    assert!(h.state().ui.dock.floating[0].rect[0] < resized[0] - 15.0);
+    assert!(h.state().ui.dock.floating[0].rect[1] < resized[1] - 10.0);
+    action_log.push(action_state(&h, "moved"));
+    let saved_root = h.state().ui.dock.clone();
+    let saved_floating = h.state().ui.dock.floating.clone();
+    let ctx = h.ctx.clone();
+    // Maximize Frame fills the area with a docked frame
+    h.state_mut().ui.focused = PanelKind::Program;
+    menus::invoke(h.state_mut(), &ctx, "window.maximizeFrame", json!({})).unwrap();
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    assert!(rect(&h, "panel.Program").width() > 1000.0);
+    action_log.push(action_state(&h, "maximized"));
+    assert_eq!(h.state().ui.dock, saved_root);
+    assert_eq!(h.state().ui.dock.floating, saved_floating);
+    menus::invoke(h.state_mut(), &ctx, "window.maximizeFrame", json!({})).unwrap();
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    assert_eq!(h.state().ui.dock.floating, saved_floating);
+
+    if let Some(directory) = &snapshots {
+        std::fs::create_dir_all(directory).unwrap();
+        h.render().unwrap().save(directory.join("filmcraft-floating.png")).unwrap();
+    }
+    let from = rect(&h, "panel.tab.Info").center();
+    let to = rect(&h, "panel.History").center();
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(h.state().ui.dock.floating.is_empty());
+    action_log.push(action_state(&h, "redocked"));
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+    assert_eq!(playheads, h.state().session.state.playheads);
+    let playhead = h.state().session.playhead();
+    click(&mut h, "program.transport.playhead.stepForward");
+    assert!(h.state().session.playhead() > playhead);
+    assert!(h.state().auto.elements.iter().any(|element| element.id.starts_with("timeline.clip.")));
+    action_log.push(action_state(&h, "program-step-forward"));
+    if let Some(directory) = &snapshots {
+        std::fs::write(directory.join("filmcraft-actions.json"), serde_json::to_vec_pretty(&action_log).unwrap()).unwrap();
+    }
+    if let Some(directory) = &snapshots {
+        h.render().unwrap().save(directory.join("filmcraft-redocked.png")).unwrap();
+    }
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+    assert!(h.state().ui_error.is_none());
+}
+
+#[test]
+fn dropping_on_the_window_edge_docks_beside_the_whole_workspace() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    let from = rect(&h, "panel.tab.Info").center();
+    let leftmost = rect(&h, "panel.Info");
+    // The outer edge of the leftmost group: without the window-edge zone this splits only that group.
+    drag(&mut h, from, pos2(leftmost.left() + 2.0, leftmost.center().y), Modifiers::NONE);
+    assert_eq!(
+        h.state().ui.dock,
+        root(split(
+            false,
+            SplitSize::Ratio(0.25),
+            tabs(&[PanelKind::Info], 0),
+            split(false, SplitSize::Ratio(0.3), tabs(&[PanelKind::Project, PanelKind::History], 1), tabs(&[PanelKind::Source, PanelKind::Program], 1)),
+        ))
+    );
+}
+
+/// A release over no drop target (the menu bar, the gap between two groups) cancels the drag:
+/// nothing floats and nothing moves. Only Ctrl/Cmd or leaving the window floats.
+#[test]
+fn a_release_over_no_target_cancels_the_drag() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    let before = h.state().ui.dock.clone();
+    let info = rect(&h, "panel.Info");
+    for to in [pos2(600.0, 10.0), pos2(info.right() + 2.0, info.center().y)] {
+        let from = rect(&h, "panel.tab.Info").center();
+        drag(&mut h, from, to, Modifiers::NONE);
+        assert_eq!(h.state().ui.dock, before, "release at {to:?}");
+    }
+}
+
+#[test]
+fn dock_panel_without_anchor_docks_along_a_workspace_edge() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Program", "zone": "bottom"})).unwrap();
+    let Some(Node::Split { axis: SplitAxis::Vertical, size: SplitSize::Ratio(ratio), first, second }) = &app.ui.dock.root else {
+        panic!("root not split: {:?}", app.ui.dock)
+    };
+    assert_eq!(*ratio, 0.75);
+    assert_eq!(**second, tabs(&[PanelKind::Program], 0));
+    let a = root((**first).clone());
+    assert!(!a.contains(&PanelKind::Program) && a.contains(&PanelKind::Source) && a.contains(&PanelKind::Info));
+    // without an anchor or a side, a docked panel stays where it is
+    let before = app.ui.dock.clone();
+    let _ = menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Info", "zone": "center"}));
+    assert_eq!(app.ui.dock, before);
+    app.ui.dock = root(tabs(&[PanelKind::Project], 0));
+    assert!(menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Project", "zone": "left"})).is_err());
+    assert_eq!(app.ui.dock, root(tabs(&[PanelKind::Project], 0)));
+}
+
+fn same_group(layout: &Layout, first: PanelKind, second: PanelKind) -> bool {
+    tabs_containing(layout, first).contains(&second)
+}
+
+fn tabs_containing(layout: &Layout, panel: PanelKind) -> Vec<PanelKind> {
+    fn find(node: &Node<PanelKind>, panel: PanelKind) -> Vec<PanelKind> {
+        match node {
+            Node::Tabs { panels, .. } if panels.contains(&panel) => panels.clone(),
+            Node::Split { first, second, .. } => {
+                let found = find(first, panel);
+                if found.is_empty() { find(second, panel) } else { found }
+            }
+            _ => vec![],
+        }
+    }
+    layout.root.as_ref().map(|node| find(node, panel)).unwrap_or_default()
+}
+
+#[test]
+fn docking_commands_reject_bad_geometry_and_targets_without_partial_changes() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let ctx = egui::Context::default();
+    let before = app.ui.dock.clone();
+    for (id, params) in [
+        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 300]})),
+        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 300, 200, 7]})),
+        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 1e100, 200]})),
+        ("window.dockPanel", json!({"panel": "Info", "anchor": "Tools"})),
+        ("window.dockPanel", json!({"panel": "Info", "anchor": "Program", "zone": 42})),
+        ("window.dockPanel", json!({"panel": "Info", "anchor": "Program", "before": "Tools"})),
+    ] {
+        assert!(menus::invoke(&mut app, &ctx, id, params.clone()).is_err(), "{id} accepted {params}");
+        assert_eq!(app.ui.dock, before);
+        assert!(app.ui.dock.floating.is_empty());
+    }
+    app.ui.dock = root(tabs(&[PanelKind::Project], 0));
+    assert!(menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Project", "rect": [1, 2, 300, 200]})).is_err());
+}
+
+fn action_state(h: &Harness<'_, FilmcraftApp>, action: &str) -> serde_json::Value {
+    json!({"action": action, "dock": h.state().ui.dock, "floating": h.state().ui.dock.floating, "focused": h.state().ui.focused})
+}
+
+#[test]
+fn catalog_docking_action_supports_resize_reorder_and_floating_geometry() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = root(split(false, SplitSize::FixedFirst(300.0), tabs(&[PanelKind::Project, PanelKind::Info], 1), tabs(&[PanelKind::Program], 0)));
+    let ctx = egui::Context::default();
+    for action in [
+        Action::ResizeSplit { path: vec![], size: craft_ui::layout::SplitSize::FixedFirst(360.0) },
+        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Project, placement: Placement::Tab { before: Some(PanelKind::Project) } },
+        Action::Float { panel: PanelKind::Info, rect: [20.0, 40.0, 300.0, 200.0] },
+        Action::MoveFloating { panel: PanelKind::Info, rect: [45.0, 65.0, 330.0, 240.0] },
+    ] {
+        filmcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.dockAction", json!({"action": action})).unwrap();
+    }
+    assert_eq!(app.ui.dock.floating[0].rect, [45.0, 65.0, 330.0, 240.0]);
+    let Some(Node::Split { size, .. }) = &app.ui.dock.root else { panic!("split lost") };
+    assert_eq!(*size, SplitSize::FixedFirst(360.0));
+    let before = json!({"dock": app.ui.dock, "floating": app.ui.dock.floating});
+    assert!(
+        filmcraft_ui_egui::menus::invoke(
+            &mut app,
+            &ctx,
+            "window.dockAction",
+            json!({"action": {
+                "ResizeSplit": {"path": [true, true], "size": {"Ratio": 0.5}}
+            }})
+        )
+        .is_err()
+    );
+    assert_eq!(json!({"dock": app.ui.dock, "floating": app.ui.dock.floating}), before);
+}
+
+#[test]
+fn unreadable_floating_workspace_does_not_erase_valid_workspaces_or_current_name() {
+    let tree = json!({"Tabs": {"panels": ["Project"], "active": 0}});
+    let valid = json!({"name": "Valid", "layout": tree, "floating": [{
+        "panels": ["TextToSpeech", "Timeline"], "active": 0, "rect": [80, 90, 420, 320]
+    }]});
+    for (index, bad) in [
+        json!([{"panels": ["FuturePanel"], "active": 0, "rect": [80, 90, 420, 320]}]),
+        json!([{"panels": ["Info"], "active": "invalid", "rect": [80, 90, 420, 320]}]),
+        json!({"malformed": true}),
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        let path = std::env::temp_dir().join(format!("filmcraft-floating-isolation-{}-{index}.json", std::process::id()));
+        let prefs = json!({"saved": [valid.clone(), {"name": "Broken", "layout": tree, "floating": bad}], "current": "Valid"});
+        std::fs::write(&path, serde_json::to_vec(&prefs).unwrap()).unwrap();
+        let loaded = dock::WorkspacePrefs::load(&path);
+        assert_eq!(loaded.current, "Valid");
+        assert_eq!(loaded.saved.len(), 2);
+        let restored = dock::saved_docking(&loaded, "Valid");
+        restored.validate().unwrap();
+        assert_eq!(restored.root, Some(tabs(&[PanelKind::Project], 0)));
+        assert_eq!(restored.floating[0].panels().copied().collect::<Vec<_>>(), vec![PanelKind::TextToSpeech, PanelKind::Timeline]);
+        assert_eq!(dock::saved_docking(&loaded, "Broken"), dock::workspace("Broken"));
+        loaded.save(&path).unwrap();
+        assert_eq!(dock::WorkspacePrefs::load(&path), loaded, "saving preserves the unreadable entry for a future version");
+        std::fs::remove_file(path).unwrap();
+    }
+}
+
+#[test]
+fn floating_tts_and_timeline_reveal_keeps_one_owner_and_draft_without_project_edits() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let mut app = FilmcraftApp::new(session);
+    app.ui.tts.text = "Synthetic retained narration".into();
+    app.show_panel(PanelKind::TextToSpeech);
+    let project = app.session.project.clone();
+    let state = serde_json::to_value(&app.session.state).unwrap();
+    let draft = serde_json::to_value(&app.ui.tts).unwrap();
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "TextToSpeech", "rect": [80, 90, 420, 320]})).unwrap();
+    menus::invoke(
+        &mut app,
+        &ctx,
+        "window.dockAction",
+        json!({"action": Action::Move {
+            panel: PanelKind::Timeline, anchor: PanelKind::TextToSpeech, placement: Placement::Tab { before: None }
+        }}),
+    )
+    .unwrap();
+    app.show_panel(PanelKind::TextToSpeech);
+    app.show_panel(PanelKind::Timeline);
+    assert!(!app.ui.dock.docked(PanelKind::TextToSpeech));
+    assert!(!app.ui.dock.docked(PanelKind::Timeline));
+    assert_eq!(app.ui.dock.floating.iter().flat_map(|group| group.panels()).filter(|panel| **panel == PanelKind::TextToSpeech).count(), 1);
+    assert_eq!(app.ui.dock.floating.iter().flat_map(|group| group.panels()).filter(|panel| **panel == PanelKind::Timeline).count(), 1);
+    assert_eq!(serde_json::to_value(&app.ui.tts).unwrap(), draft);
+    assert!(std::sync::Arc::ptr_eq(&project, &app.session.project));
+    assert_eq!(serde_json::to_value(&app.session.state).unwrap(), state);
+}
+
+#[test]
+fn narration_selection_reveals_covered_floating_tts_once_without_editing_the_project() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let clip = session
+        .active_sequence()
+        .unwrap()
+        .audio_tracks
+        .iter()
+        .flat_map(|track| &track.items)
+        .find(|clip| {
+            session.project.item(clip.item).and_then(|item| item.as_media()).is_some_and(|media| media.info.kind == filmcraft_media::MediaKind::AudioOnly)
+        })
+        .unwrap()
+        .clone();
+    let narration = filmcraft_project::Narration {
+        text: "Synthetic narration behind an overlapping pane".into(),
+        language: "en-US".into(),
+        voice: filmcraft_tts::default_voice_id().into(),
+        pitch: filmcraft_project::VocalPitch::Default,
+        pace: 1.2,
+        speech_duration: filmcraft_time::Tick::ZERO,
+    };
+    std::sync::Arc::make_mut(&mut session.project).narrations.insert(clip.item, narration.clone());
+    let project = session.project.clone();
+    let mut app = FilmcraftApp::new(session);
+    app.show_panel(PanelKind::TextToSpeech);
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    let ctx = h.ctx.clone();
+    for panel in ["TextToSpeech", "Info"] {
+        menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": panel, "rect": [400, 220, 450, 360]})).unwrap();
+        for _ in 0..4 {
+            step(&mut h);
+        }
+    }
+    let covered = rect(&h, "panel.TextToSpeech").center();
+    assert!(rect(&h, "panel.Info").contains(covered));
+    ctx.move_to_top(window_layer(&h, PanelKind::Info));
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    assert_eq!(ctx.layer_id_at(covered), Some(window_layer(&h, PanelKind::Info)), "precondition: Info really covers TTS");
+    h.state_mut().session.state.selection = vec![clip.id];
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    let draft = h.state().ui.tts.clone();
+    assert_eq!(draft.text, narration.text);
+    assert_eq!(draft.pace, narration.pace);
+    assert_eq!(draft.loaded_from, Some((clip.id.0, clip.item.0)));
+    assert_eq!(ctx.layer_id_at(covered), Some(window_layer(&h, PanelKind::TextToSpeech)), "narration selection must bring its floating editor forward");
+    assert_eq!(h.state().ui.focused, PanelKind::TextToSpeech);
+    assert!(!h.state().ui.dock.docked(PanelKind::TextToSpeech));
+    assert_eq!(h.state().ui.dock.floating.iter().flat_map(|group| group.panels()).filter(|panel| **panel == PanelKind::TextToSpeech).count(), 1);
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+    // A reveal is one-shot: drawing the selected narration must not steal stacking
+    // from another pane that the user subsequently brings forward.
+    ctx.move_to_top(window_layer(&h, PanelKind::Info));
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    assert_eq!(ctx.layer_id_at(covered), Some(window_layer(&h, PanelKind::Info)));
+    assert_eq!(h.state().ui.tts, draft);
+    menus::invoke(h.state_mut(), &ctx, "window.panel.TextToSpeech", json!({})).unwrap();
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    assert_eq!(ctx.layer_id_at(covered), Some(window_layer(&h, PanelKind::TextToSpeech)));
+    assert_eq!(h.state().ui.tts, draft);
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+    // Replacing the workspace cancels a queued reveal before the next render,
+    // even when the destination happens to contain the same floating panel IDs.
+    ctx.move_to_top(window_layer(&h, PanelKind::Info));
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    let saved = dock::SavedWorkspace {
+        name: "Reveal cancellation".into(),
+        workspace: serde_json::to_value(dock::Workspace::new(h.state().ui.dock.clone())).unwrap(),
+        ..Default::default()
+    };
+    h.state_mut().workspaces.saved.push(saved);
+    h.state_mut().show_panel(PanelKind::TextToSpeech);
+    h.state_mut().set_workspace("Reveal cancellation");
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    assert_eq!(ctx.layer_id_at(covered), Some(window_layer(&h, PanelKind::Info)));
+    assert_eq!(h.state().ui.tts, draft);
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+}
+
+/// #1985: a panel closed while floating came back docked when opened again from the Window menu;
+/// it now floats again where it was. Closed while docked, it opens docked as before.
+#[test]
+fn a_panel_closed_while_floating_reopens_floating_where_it_was() {
+    let mut app = FilmcraftApp::new(Session::default());
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
+    let rect = app.ui.dock.floating.iter().find(|g| g.contains(&PanelKind::Info)).unwrap().rect;
+    menus::invoke(&mut app, &ctx, "window.closePanel", json!({"panel": "Info"})).unwrap();
+    assert!(!app.ui.dock.docked(PanelKind::Info) && !app.ui.dock.floating.iter().any(|g| g.contains(&PanelKind::Info)));
+    menus::invoke(&mut app, &ctx, &menus::panel_command_id(PanelKind::Info), json!({})).unwrap();
+    let back = app.ui.dock.floating.iter().find(|g| g.contains(&PanelKind::Info)).expect("Info floats again");
+    assert_eq!(back.rect, rect, "where it was");
+    assert!(!app.ui.dock.docked(PanelKind::Info));
+    // docked, then closed: it opens docked
+    menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Info", "anchor": "Project"})).unwrap();
+    menus::invoke(&mut app, &ctx, "window.closePanel", json!({"panel": "Info"})).unwrap();
+    menus::invoke(&mut app, &ctx, &menus::panel_command_id(PanelKind::Info), json!({})).unwrap();
+    assert!(app.ui.dock.docked(PanelKind::Info));
+    assert!(!app.ui.dock.floating.iter().any(|g| g.contains(&PanelKind::Info)));
+    // the Timeline too, though reopening it first puts it back in its own place in the dock
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Timeline", "rect": [60, 80, 700, 300]})).unwrap();
+    let rect = app.ui.dock.floating.iter().find(|g| g.contains(&PanelKind::Timeline)).unwrap().rect;
+    menus::invoke(&mut app, &ctx, "window.closePanel", json!({"panel": "Timeline"})).unwrap();
+    menus::invoke(&mut app, &ctx, &menus::panel_command_id(PanelKind::Timeline), json!({})).unwrap();
+    let back = app.ui.dock.floating.iter().find(|g| g.contains(&PanelKind::Timeline)).expect("the Timeline floats again");
+    assert_eq!(back.rect, rect);
+    assert!(!app.ui.dock.docked(PanelKind::Timeline));
+
+    // with nothing else docked, a reopened panel has to stay docked (the workspace keeps one
+    // docked panel); its floating place is kept, not lost (#2482 review)
+    let mut app = FilmcraftApp::new(Session::default());
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
+    let rect = app.ui.dock.floating.iter().find(|g| g.contains(&PanelKind::Info)).unwrap().rect;
+    for _ in 0..64 {
+        let Some(p) = PanelKind::ALL.iter().copied().find(|p| app.ui.dock.docked(*p)) else { break };
+        if menus::invoke(&mut app, &ctx, "window.closePanel", json!({"panel": p.id()})).is_err() {
+            break;
+        }
+    }
+    let docked = PanelKind::ALL.iter().filter(|p| app.ui.dock.docked(**p)).count();
+    if docked > 0 {
+        eprintln!("SKIPPED: the dock cannot be emptied ({docked} panels stay)");
+        return;
+    }
+    menus::invoke(&mut app, &ctx, "window.closePanel", json!({"panel": "Info"})).unwrap();
+    menus::invoke(&mut app, &ctx, &menus::panel_command_id(PanelKind::Info), json!({})).unwrap();
+    assert!(app.ui.dock.docked(PanelKind::Info), "the only panel stays docked");
+    assert!(app.ui.closed_floating.iter().any(|(p, r)| *p == PanelKind::Info && *r == rect), "{:?}", app.ui.closed_floating);
+}
+
+/// craft-ui's `window.panel.*` commands and FilmCraft's own docking commands share one path.
+#[test]
+fn shared_dock_commands_and_filmcraft_names_move_panels() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.panel.move", json!({"panel": "Info", "anchor": "Program", "zone": "right"})).unwrap();
+    assert!(app.ui.dock.is_visible(PanelKind::Info) && !same_group(&app.ui.dock, PanelKind::Info, PanelKind::Program));
+    menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Info", "anchor": "Program", "before": "Source"})).unwrap();
+    assert_eq!(tabs_containing(&app.ui.dock, PanelKind::Info), vec![PanelKind::Info, PanelKind::Source, PanelKind::Program]);
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info"})).unwrap();
+    assert!(app.ui.dock.floating.iter().any(|window| window.contains(&PanelKind::Info)));
+    menus::invoke(&mut app, &ctx, "window.panel.close", json!({"panel": "Info"})).unwrap();
+    assert!(!app.ui.dock.contains(&PanelKind::Info));
+    assert!(menus::invoke(&mut app, &ctx, "window.panel.move", json!({"panel": "Info", "anchor": "Nowhere"})).is_err());
+}
+
+/// The layer of the floating window holding `panel`.
+fn window_layer(h: &Harness<'_, FilmcraftApp>, panel: PanelKind) -> egui::LayerId {
+    let window = h.state().ui.dock.floating.iter().find(|window| window.contains(&panel)).unwrap();
+    DockArea::floating_layer(filmcraft_ui_egui::dock_area_id(), window).unwrap()
+}
+
+fn demo_harness() -> Harness<'static, FilmcraftApp> {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    h
+}
+
+/// Clicking the Timeline's active sequence tab, in its group header, focuses the Timeline.
+#[test]
+fn clicking_the_active_sequence_tab_focuses_the_timeline() {
+    let mut h = demo_harness();
+    click(&mut h, "panel.tab.Project");
+    assert_eq!(h.state().ui.focused, PanelKind::Project);
+    let active = h.state().session.state.active_sequence.unwrap().0;
+    click(&mut h, &format!("timeline.tab.{active}"));
+    assert_eq!(h.state().ui.focused, PanelKind::Timeline);
+}
+
+/// No move or float may empty the frame tree, whichever unit it moves.
+#[test]
+fn the_last_docked_group_cannot_float_away() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = root(tabs(&[PanelKind::Project, PanelKind::Info], 0));
+    let ctx = egui::Context::default();
+    let before = app.ui.dock.clone();
+    let float = craft_ui::docking::Target::Float { rect: Some([20.0, 20.0, 300.0, 200.0]) };
+    for action in [Action::MoveGroup { panel: PanelKind::Project, to: float.clone() }, Action::MoveColumn { panel: PanelKind::Project, to: float.clone() }] {
+        let _ = menus::invoke(&mut app, &ctx, "window.dockAction", json!({ "action": action }));
+        assert_eq!(app.ui.dock, before);
+    }
+    assert!(menus::invoke(&mut app, &ctx, "window.panel.float", json!({"panel": "Project", "group": true})).is_err());
+    assert_eq!(app.ui.dock, before);
+    // one panel of the group may float; the other stays docked
+    menus::invoke(&mut app, &ctx, "window.panel.float", json!({"panel": "Info"})).unwrap();
+    assert!(app.ui.dock.docked(PanelKind::Project) && !app.ui.dock.docked(PanelKind::Info));
+}
+
+/// Tools and the audio meters are ordinary groups with a tab strip: the meters show their tab,
+/// narrow Tools at least its drag bar, and either one joins another group.
+#[test]
+fn tools_and_meters_move_like_any_group() {
+    let mut h = demo_harness();
+    assert!(h.state().auto.find("panel.tab.AudioMeters").is_some(), "the meters have no tab");
+    let from = rect(&h, "panel.drag.Tools").center();
+    let to = rect(&h, "panel.Program").center();
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(same_group(&h.state().ui.dock, PanelKind::Tools, PanelKind::Program), "{:?}", h.state().ui.dock);
+}
+
+/// A panel floated by command without a rect takes a useful height, not the 120 pt minimum.
+#[test]
+fn program_floats_at_a_useful_height() {
+    let mut h = demo_harness();
+    let ctx = h.ctx.clone();
+    menus::invoke(h.state_mut(), &ctx, "window.panel.float", json!({"panel": "Program"})).unwrap();
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    let window = h.state().ui.dock.floating.iter().find(|window| window.contains(&PanelKind::Program)).unwrap();
+    assert!(window.rect[3] >= 300.0, "Program floated at {:?}", window.rect);
+}
+
+/// Only docked frames maximize: Maximize Frame on a floating panel leaves nothing maximized.
+#[test]
+fn a_floating_panel_does_not_maximize() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
+    app.ui.focused = PanelKind::Info;
+    menus::invoke(&mut app, &ctx, "window.maximizeFrame", json!({})).unwrap();
+    assert_eq!(app.ui.keys.maximized, None);
+    app.ui.focused = PanelKind::Program;
+    menus::invoke(&mut app, &ctx, "window.maximizeFrame", json!({})).unwrap();
+    assert_eq!(app.ui.keys.maximized, Some(PanelKind::Program));
+}
+
+/// A closed panel reopens through `window.panel.activate`.
+#[test]
+fn activate_reopens_a_closed_panel() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.panel.close", json!({"panel": "Info"})).unwrap();
+    assert!(!app.ui.dock.contains(&PanelKind::Info));
+    menus::invoke(&mut app, &ctx, "window.panel.activate", json!({"panel": "Info"})).unwrap();
+    assert!(app.ui.dock.is_visible(PanelKind::Info));
+}
+
+/// Press and release `button` at `pos`.
+fn click_at(h: &mut Harness<'_, FilmcraftApp>, pos: egui::Pos2, button: PointerButton) {
+    h.event(Event::PointerMoved(pos));
+    step(h);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button, pressed, modifiers: Modifiers::NONE });
+        step(h);
+    }
+    for _ in 0..3 {
+        step(h);
+    }
+}
+
+/// Right-click the tab `tab` and choose the context-menu item labeled `item`.
+fn tab_menu(h: &mut Harness<'_, FilmcraftApp>, tab: &str, item: &str) {
+    let pos = rect(h, tab).center();
+    click_at(h, pos, PointerButton::Secondary);
+    let item = h.get_by_label(item).rect().center();
+    click_at(h, item, PointerButton::Primary);
+}
+
+/// A Timeline tab's context menu carries FilmCraft's Timeline items, and its Close Panel closes
+/// the active sequence: the Timeline stays.
+#[test]
+fn close_panel_on_the_timeline_tab_closes_the_sequence() {
+    let mut h = demo_harness();
+    let active = h.state().session.state.active_sequence.unwrap();
+    let pos = rect(&h, "panel.tab.Timeline").center();
+    click_at(&mut h, pos, PointerButton::Secondary);
+    for id in ["panel.menu.Timeline.revealSequence", "panel.tabMenu.Timeline.closeOthers", "panel.tabMenu.Timeline.restoreWorkspace"] {
+        assert!(h.state().auto.find(id).is_some(), "{id} is missing from the tab menu");
+    }
+    let close = h.get_by_label("Close Panel").rect().center();
+    click_at(&mut h, close, PointerButton::Primary);
+    assert!(!h.state().session.state.open_sequences.contains(&active), "the sequence stays open");
+    assert!(h.state().ui.dock.is_visible(PanelKind::Timeline), "the Timeline closed");
+}
+
+/// Close Panel Group on a group holding the Timeline closes the active sequence and the group's
+/// other panels; the Timeline stays.
+#[test]
+fn close_panel_group_keeps_the_timeline_and_closes_the_sequence() {
+    let mut h = demo_harness();
+    let ctx = h.ctx.clone();
+    menus::invoke(h.state_mut(), &ctx, "window.dockPanel", json!({"panel": "Info", "anchor": "Timeline", "zone": "center"})).unwrap();
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    assert!(same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Timeline));
+    let active = h.state().session.state.active_sequence.unwrap();
+    tab_menu(&mut h, "panel.tab.Info", "Close Panel Group");
+    let state = h.state();
+    assert!(!state.session.state.open_sequences.contains(&active), "the sequence stays open");
+    assert!(state.ui.dock.is_visible(PanelKind::Timeline), "the Timeline closed");
+    assert!(!state.ui.dock.contains(&PanelKind::Info), "Info stays open");
+}
+
+/// With the header in the macOS title-bar strip, a floating window saved at the top of the
+/// viewport is drawn below the strip, where a press on it cannot move the app window.
+#[test]
+fn a_floating_panel_stays_out_of_the_integrated_titlebar() {
+    let mut app = FilmcraftApp::new(Session::default());
+    app.ui.dock = layout();
+    app.integrated_titlebar = true;
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
+    app.ui.dock.floating.iter_mut().find(|window| window.contains(&PanelKind::Info)).unwrap().rect[1] = 0.0;
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
+    for _ in 0..3 {
+        step(&mut h);
+    }
+    let drawn = h.ctx.memory(|memory| memory.area_rect(window_layer(&h, PanelKind::Info).id)).expect("Info is drawn floating");
+    assert!(drawn.min.y >= filmcraft_ui_egui::header::HEIGHT, "drawn at {drawn:?}");
+}
diff --git a/crates/ui-egui/tests/source_drag_ui.rs b/crates/ui-egui/tests/it/source_drag_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/source_drag_ui.rs
rename to crates/ui-egui/tests/it/source_drag_ui.rs
diff --git a/crates/ui-egui/tests/source_playback_ui.rs b/crates/ui-egui/tests/it/source_playback_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/source_playback_ui.rs
rename to crates/ui-egui/tests/it/source_playback_ui.rs
diff --git a/crates/ui-egui/tests/timecode_ui.rs b/crates/ui-egui/tests/it/timecode_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timecode_ui.rs
rename to crates/ui-egui/tests/it/timecode_ui.rs
diff --git a/crates/ui-egui/tests/timeline_drop_ui.rs b/crates/ui-egui/tests/it/timeline_drop_ui.rs
similarity index 94%
rename from crates/ui-egui/tests/timeline_drop_ui.rs
rename to crates/ui-egui/tests/it/timeline_drop_ui.rs
index 5b1940f72..b0a7c2571 100644
--- a/crates/ui-egui/tests/timeline_drop_ui.rs
+++ b/crates/ui-egui/tests/it/timeline_drop_ui.rs
@@ -287,7 +287,7 @@ fn offscreen_float_uses_rendered_clamp_and_maximized_timeline_ignores_hidden_flo
     // The very wide offscreen float is clamped back to x=0, over this row.
     float_panel(&mut h, "Info", [-5000.0, at.y - 60.0, 1500.0, 200.0]);
     let visible = control_rect(&h, "panel.Info");
-    assert!(visible.contains(at), "rendered={visible:?}, drop={at:?}, floats={:?}", h.state().ui.floating);
+    assert!(visible.contains(at), "rendered={visible:?}, drop={at:?}, floats={:?}", h.state().ui.dock.floating);
     assert!(!hover_at(&mut h, at));
     drop_at(&mut h, at, &still("drop_clamped_occlusion.png"));
     assert_eq!(clip_counts(&h), (0, 0));
@@ -320,10 +320,28 @@ fn os_cursor_hook_selects_destination_when_egui_pointer_has_no_motion() {
     h.input_mut().dropped_files.clear();
     step(&mut h);
     assert_eq!(clip_counts(&h), (0, 0));
-    h.state_mut().ui.floating.clear();
+    h.state_mut().ui.dock.floating.clear();
     h.input_mut().dropped_files.push(std::sync::Arc::new(OsFile(still("drop_os_hook_visible.png"))));
     step(&mut h);
     h.input_mut().dropped_files.clear();
     step(&mut h);
     assert_eq!(clip_counts(&h), (1, 0));
 }
+
+#[test]
+fn a_floating_window_hidden_by_a_maximized_timeline_does_not_block_drops() {
+    let mut h = harness();
+    h.state_mut().ui.keys.maximized = Some(filmcraft_ui_egui::dock::PanelKind::Timeline);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    let at = point_on_row(&h, "timeline.track.V1.target");
+    // Floating a panel restores the frames; maximize again so the window over `at` is hidden.
+    float_panel(&mut h, "Info", [at.x - 20.0, at.y - 60.0, 320.0, 200.0]);
+    h.state_mut().ui.keys.maximized = Some(filmcraft_ui_egui::dock::PanelKind::Timeline);
+    for _ in 0..4 {
+        step(&mut h);
+    }
+    assert_eq!(point_on_row(&h, "timeline.track.V1.target"), at);
+    assert!(hover_at(&mut h, at));
+}
diff --git a/crates/ui-egui/tests/timeline_escape_ui.rs b/crates/ui-egui/tests/it/timeline_escape_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_escape_ui.rs
rename to crates/ui-egui/tests/it/timeline_escape_ui.rs
diff --git a/crates/ui-egui/tests/timeline_gap_ui.rs b/crates/ui-egui/tests/it/timeline_gap_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_gap_ui.rs
rename to crates/ui-egui/tests/it/timeline_gap_ui.rs
diff --git a/crates/ui-egui/tests/timeline_marquee_ui.rs b/crates/ui-egui/tests/it/timeline_marquee_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_marquee_ui.rs
rename to crates/ui-egui/tests/it/timeline_marquee_ui.rs
diff --git a/crates/ui-egui/tests/timeline_middle_pan_ui.rs b/crates/ui-egui/tests/it/timeline_middle_pan_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_middle_pan_ui.rs
rename to crates/ui-egui/tests/it/timeline_middle_pan_ui.rs
diff --git a/crates/ui-egui/tests/timeline_option_drag_ui.rs b/crates/ui-egui/tests/it/timeline_option_drag_ui.rs
similarity index 77%
rename from crates/ui-egui/tests/timeline_option_drag_ui.rs
rename to crates/ui-egui/tests/it/timeline_option_drag_ui.rs
index 801c2be35..7a49c6020 100644
--- a/crates/ui-egui/tests/timeline_option_drag_ui.rs
+++ b/crates/ui-egui/tests/it/timeline_option_drag_ui.rs
@@ -135,3 +135,40 @@ fn option_drag_preserves_an_already_selected_linked_group() {
         assert_eq!(*d.harness.state().session.project, *before, "one undo removes the group copy");
     }
 }
+
+#[test]
+fn dragging_after_frame_hold_with_repeated_clip_arguments_edits_once() {
+    for copy in [false, true] {
+        let mut d = Driver::demo();
+        let original = d.harness.state().session.active_sequence().unwrap().video_tracks[1].items[0].clone();
+        d.exec("clip.frameHold", json!({"clips": [original.id.0, original.id.0], "time": original.start.0}));
+        let before = d.harness.state().session.project.clone();
+        let undo = d.harness.state().session.history.undo.len();
+        let n = clip_count(&mut d);
+        let r = d.rect(&format!("timeline.clip.{}", original.id.0));
+        let (x, y) = (r[0] + 10.0, r[1] + r[3] / 2.0);
+        d.ok("ui.drag", json!({"from": {"x": x, "y": y}, "to": {"x": x + 240.0, "y": y}, "steps": 12, "modifiers": {"alt": copy}}));
+        d.frames(3);
+        let s = &d.harness.state().session;
+        let q = s.active_sequence().unwrap();
+        if copy {
+            assert_eq!(s.state.selection.len(), 1, "one selected clip produces one copy");
+            let copied = s.state.selection[0];
+            assert_ne!(copied, original.id);
+            assert!(q.find_item(copied).unwrap().1.start > original.start);
+            assert_eq!(q.find_item(original.id).unwrap().1.start, original.start);
+        } else {
+            assert!(q.find_item(original.id).unwrap().1.start > original.start, "a repeated selection must still drag");
+        }
+        let ids: Vec<_> = q.all_tracks().flat_map(|t| t.items.iter().map(|i| i.id)).collect();
+        assert_eq!(ids.len(), n + usize::from(copy));
+        assert_eq!(ids.iter().copied().collect::<std::collections::HashSet<_>>().len(), ids.len());
+        q.check().unwrap();
+        assert_eq!(s.history.undo.len(), undo + 1);
+        let after = s.project.clone();
+        d.exec("edit.undo", json!({}));
+        assert_eq!(d.harness.state().session.project, before);
+        d.exec("edit.redo", json!({}));
+        assert_eq!(d.harness.state().session.project, after);
+    }
+}
diff --git a/crates/ui-egui/tests/timeline_scroll_ui.rs b/crates/ui-egui/tests/it/timeline_scroll_ui.rs
similarity index 92%
rename from crates/ui-egui/tests/timeline_scroll_ui.rs
rename to crates/ui-egui/tests/it/timeline_scroll_ui.rs
index 7587ef14a..aa9dec2b1 100644
--- a/crates/ui-egui/tests/timeline_scroll_ui.rs
+++ b/crates/ui-egui/tests/it/timeline_scroll_ui.rs
@@ -342,3 +342,33 @@ fn repeated_home_and_end_keys_reveal_a_playhead_already_at_the_endpoint() {
 fn repeated_start_and_end_commands_reveal_a_playhead_already_at_the_endpoint() {
     repeated_endpoint_navigation_reveals_the_same_playhead(false);
 }
+
+/// #2325: Settings ▸ Appearance ▸ "Animate zoom, scrolling and menus" off makes a zoom and a
+/// scroll land in one frame, and egui's fades (menus, collapsing sections, tooltips) instant.
+#[test]
+fn turning_animations_off_zooms_and_scrolls_in_one_step() {
+    let mut d = Driver::tall();
+    let animation_time = |d: &mut Driver| d.harness.ctx.global_style().animation_time;
+    assert!(animation_time(&mut d) > 0.0, "animated by default");
+    // animated: one frame later the zoom is on its way, not there
+    let v = &mut d.app().ui.timeline;
+    v.target_pps = 200.0;
+    v.target_scroll = 8.0;
+    d.frames(1);
+    let v = &d.app().ui.timeline;
+    assert!(v.pps > 50.0 && v.pps < 200.0 && v.scroll < 8.0, "eased: {} {}", v.pps, v.scroll);
+    assert_eq!(d.view(), (8.0, 200.0, 0.0, 0.0));
+    d.exec("prefs.set", json!({"key": "appearance.animations", "value": false}));
+    d.frames(2);
+    assert_eq!(animation_time(&mut d), 0.0);
+    let v = &mut d.app().ui.timeline;
+    v.target_pps = 50.0;
+    v.target_scroll = 3.0;
+    d.frames(1);
+    let v = &d.app().ui.timeline;
+    assert_eq!((v.pps, v.scroll), (50.0, 3.0), "in one step");
+    // and back on
+    d.exec("prefs.set", json!({"key": "appearance.animations", "value": true}));
+    d.frames(2);
+    assert!(animation_time(&mut d) > 0.0);
+}
diff --git a/crates/ui-egui/tests/timeline_tabs_ui.rs b/crates/ui-egui/tests/it/timeline_tabs_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_tabs_ui.rs
rename to crates/ui-egui/tests/it/timeline_tabs_ui.rs
diff --git a/crates/ui-egui/tests/timeline_track_height_ui.rs b/crates/ui-egui/tests/it/timeline_track_height_ui.rs
similarity index 54%
rename from crates/ui-egui/tests/timeline_track_height_ui.rs
rename to crates/ui-egui/tests/it/timeline_track_height_ui.rs
index eb272be4b..53e54c6c9 100644
--- a/crates/ui-egui/tests/timeline_track_height_ui.rs
+++ b/crates/ui-egui/tests/it/timeline_track_height_ui.rs
@@ -112,3 +112,83 @@ fn the_bottom_edge_of_the_last_audio_track_resizes_the_audio_tracks_from_either_
     d.drag(&id, 0.1, -15.0);
     assert!(d.heights().1 < a1 - 5.0);
 }
+
+/// Every shape drawn this frame, flattened.
+fn flat_shapes(d: &Driver) -> Vec<egui::Shape> {
+    fn walk(s: &egui::Shape, out: &mut Vec<egui::Shape>) {
+        match s {
+            egui::Shape::Vec(v) => v.iter().for_each(|s| walk(s, out)),
+            other => out.push(other.clone()),
+        }
+    }
+    let mut out = Vec::new();
+    d.harness.output().shapes.iter().for_each(|c| walk(&c.shape, &mut out));
+    out
+}
+
+fn rect_of(d: &mut Driver, id: &str) -> egui::Rect {
+    let v = d.ok("ui.elements", json!({"prefix": id}));
+    let e = v.as_array().unwrap().iter().find(|e| e["id"] == json!(id)).unwrap_or_else(|| panic!("no element {id}")).clone();
+    let r: Vec<f32> = e["rect"].as_array().unwrap().iter().map(|n| n.as_f64().unwrap() as f32).collect();
+    egui::Rect::from_min_size(egui::pos2(r[0], r[1]), egui::vec2(r[2], r[3]))
+}
+
+// Regression test for #703: the lines between the timeline's tracks were drawn in the timeline's own
+// background colour, so they were invisible, and nothing marked the top of the highest video track.
+#[test]
+fn timeline_draws_visible_lines_between_tracks_and_above_the_top_video_track() {
+    let mut d = Driver::demo();
+    let (top, _) = d.labels();
+    let separator = d.app().tokens.separator;
+    let ruler = rect_of(&mut d, "timeline.ruler");
+    let top_edge = rect_of(&mut d, &format!("timeline.track.{top}.resizeTop"));
+    let seq = d.app().session.active_sequence().unwrap();
+    let tracks = seq.video_tracks.len() + seq.audio_tracks.len();
+    // horizontal separator lines across the track area (the headers' own lines start left of the ruler)
+    let mut ys: Vec<f32> = flat_shapes(&d)
+        .into_iter()
+        .filter_map(|s| match s {
+            egui::Shape::LineSegment { points, stroke }
+                if stroke.color == separator
+                    && points[0].y == points[1].y
+                    && points[0].x >= ruler.min.x - 1.0
+                    && points[1].x - points[0].x > 200.0
+                    && points[0].y > ruler.max.y =>
+            {
+                Some(points[0].y)
+            }
+            _ => None,
+        })
+        .collect();
+    ys.sort_by(f32::total_cmp);
+    ys.dedup_by(|a, b| (*a - *b).abs() < 0.1);
+    assert!(ys.len() > tracks, "a line under each of the {tracks} tracks and one above the top video track, found {ys:?}");
+    let first = ys[0];
+    assert!((first - top_edge.center().y).abs() < 1.5, "the first line ({first}) is at the top edge of the highest video track ({})", top_edge.center().y);
+}
+
+// Regression test for #703: the playhead's head spanned the whole ruler and covered the markers and
+// the timecode labels; it must be a short head on the tick row at the bottom of the ruler.
+#[test]
+fn playhead_head_is_short_and_sits_on_the_ruler_tick_row() {
+    let mut d = Driver::demo();
+    let playhead = d.app().tokens.playhead;
+    let ruler = rect_of(&mut d, "timeline.ruler");
+    let heads: Vec<egui::Rect> = flat_shapes(&d)
+        .into_iter()
+        .filter_map(|s| match s {
+            egui::Shape::Path(p) if p.fill == playhead && p.points.len() == 5 => Some(egui::Rect::from_points(&p.points)),
+            _ => None,
+        })
+        .filter(|r| r.max.y <= ruler.max.y + 1.0 && r.min.y >= ruler.min.y)
+        .collect();
+    assert_eq!(heads.len(), 1, "one playhead head over the ruler: {heads:?}");
+    let head = heads[0];
+    assert!(head.height() <= 14.0, "the head is {} tall, ruler is {}", head.height(), ruler.height());
+    assert!(
+        head.min.y >= ruler.max.y - 14.0,
+        "the head starts at y={}, leaving the ruler's marker and label rows (above y={}) clear",
+        head.min.y,
+        ruler.max.y - 14.0
+    );
+}
diff --git a/crates/ui-egui/tests/timeline_transition_move_ui.rs b/crates/ui-egui/tests/it/timeline_transition_move_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/timeline_transition_move_ui.rs
rename to crates/ui-egui/tests/it/timeline_transition_move_ui.rs
diff --git a/crates/ui-egui/tests/timeline_trim_ui.rs b/crates/ui-egui/tests/it/timeline_trim_ui.rs
similarity index 76%
rename from crates/ui-egui/tests/timeline_trim_ui.rs
rename to crates/ui-egui/tests/it/timeline_trim_ui.rs
index 94aabf400..ea30dc80b 100644
--- a/crates/ui-egui/tests/timeline_trim_ui.rs
+++ b/crates/ui-egui/tests/it/timeline_trim_ui.rs
@@ -181,6 +181,67 @@ fn dragging_an_out_edge_inward_trims_the_clip() {
     assert_eq!(d.undo_steps(), undo0 + 1, "one undo step");
 }
 
+/// Duplicate frame markers stay inside a clip while its Out edge is dragged in, and follow the
+/// trim once it is released.
+#[test]
+fn duplicate_frame_markers_stay_inside_a_clip_being_trimmed() {
+    let mut d = Driver::demo();
+    let city = d.v1_clip(CITY);
+    let (item, start, source_in, duration) = {
+        let (_, it) = d.app().session.active_sequence().expect("sequence").find_item(ClipId(city)).expect("clip");
+        (it.item.0, it.start.0, it.source_in.0, it.duration.0)
+    };
+    d.exec("timeline.place", json!({"item": item, "track": "V2", "time": start, "sourceIn": source_in, "duration": duration, "audio": false}));
+    d.exec("sequence.showDuplicateFrameMarkers", json!({"on": true}));
+    d.frames(3);
+    let (x0, x1, y) = d.edges(city);
+    let by = ((x1 - x0) / 2.0).round();
+    let stripe_right = |d: &mut Driver| {
+        let els = d.ok("ui.elements", json!({"prefix": format!("timeline.duplicateFrames.{city}.")}));
+        els.as_array()
+            .expect("elements")
+            .iter()
+            .map(|e| (e["rect"][0].as_f64().expect("x") + e["rect"][2].as_f64().expect("w")) as f32)
+            .fold(f32::MIN, f32::max)
+    };
+    // the markers are worked out on a background thread
+    let t0 = std::time::Instant::now();
+    while stripe_right(&mut d) == f32::MIN && t0.elapsed().as_secs() < 30 {
+        d.frames(1);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!((stripe_right(&mut d) - x1).abs() <= 2.0, "the stripe runs to the Out edge");
+    // press on the Out edge and move half the clip inward, without releasing
+    let push = |d: &mut Driver, e: egui::Event| d.harness.input_mut().events.push(e);
+    push(&mut d, egui::Event::PointerMoved(pos2(x1 - 3.0, y)));
+    d.frames(1);
+    push(&mut d, egui::Event::PointerButton { pos: pos2(x1 - 3.0, y), button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    d.frames(1);
+    for i in 1..=by as usize {
+        push(&mut d, egui::Event::PointerMoved(pos2(x1 - 3.0 - i as f32, y)));
+        d.frames(1);
+    }
+    // (the painter's clip rect is rounded to whole pixels)
+    let body_right = |d: &mut Driver| {
+        let id = format!("timeline.clip.{city}");
+        let els = d.ok("ui.elements", json!({"prefix": id}));
+        let r = &els.as_array().expect("elements").iter().find(|e| e["id"] == id.as_str()).expect("clip")["rect"];
+        (r[0].as_f64().expect("x") + r[2].as_f64().expect("w")) as f32
+    };
+    let (during, right) = (stripe_right(&mut d), body_right(&mut d));
+    assert!(right < x1 - by / 2.0, "the clip is drawn trimmed: {right}");
+    assert!(during <= right + 1.5, "inside the trimmed clip during the drag: {during} > {right}");
+    push(
+        &mut d,
+        egui::Event::PointerButton { pos: pos2(x1 - 3.0 - by, y), button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() },
+    );
+    d.frames(3);
+    let (_, e1) = d.span(city);
+    assert!(e1 < start + duration, "trimmed");
+    let (after, right) = (stripe_right(&mut d), body_right(&mut d));
+    assert!(after <= right + 1.5, "after the trim: {after} > {right}");
+}
+
 /// Just right of a cut the clip on the right is grabbed: its In edge trims, and the clip on the
 /// left stays as it was. The left clip's Out edge used to claim both sides of the cut.
 #[test]
@@ -214,6 +275,49 @@ fn a_wobbly_click_on_an_edge_selects_the_edit_point() {
     assert!(!st.selection.contains(&ClipId(city)), "the clip is not selected");
 }
 
+/// Click a real rolling edge, then the Trim Monitor's +1 button: linked sound follows exactly once.
+fn linked_trim_monitor() -> Driver {
+    let mut d = Driver::demo();
+    let rate = d.app().session.sequence_rate();
+    let video = ClipId(d.v1_clip(CITY));
+    let q = d.app().session.active_sequence().unwrap();
+    let picture = q.find_item(video).unwrap().1;
+    let audio = q.audio_tracks[0].items.iter().find(|i| i.link.is_some() && i.link == picture.link).unwrap().id;
+    let cut = picture.end();
+    d.exec("tool.rolling", json!({}));
+    d.frames(4);
+    let (_, x, y) = d.edges(video.0);
+    d.drag(pos2(x - 2.0, y), pos2(x - 2.0, y), 1);
+    let points = &d.app().session.state.edit_points;
+    assert_eq!(points.len(), 2, "both linked edges selected: {points:?}");
+    assert!(points.iter().any(|e| e.clip == audio));
+    let before = d.app().session.project.clone();
+    d.ok("ui.click", json!({"id": "trimMonitor.forward"}));
+    d.frames(4);
+    for clip in [video, audio] {
+        assert_eq!(d.span(clip.0).1, (cut + rate.frame_duration()).0);
+    }
+    let after = d.app().session.project.clone();
+    d.exec("edit.undo", json!({}));
+    assert_eq!(*d.app().session.project, *before);
+    d.exec("edit.redo", json!({}));
+    assert_eq!(*d.app().session.project, *after);
+    d
+}
+
+/// #3085: the timeline gesture and Trim Monitor button keep picture and sound synchronized.
+#[test]
+fn trim_monitor_button_rolls_linked_audio_once() {
+    linked_trim_monitor();
+}
+
+/// Visual check of the linked edit brackets and Trim Monitor after one frame of rolling.
+#[test]
+#[ignore = "renders a screenshot; requires a GPU"]
+fn screenshot_linked_trim_monitor() {
+    linked_trim_monitor().screenshot("linked-trim-monitor");
+}
+
 /// A moved clip stays under the point it was grabbed by. It used to lag behind the pointer by the
 /// distance egui waits before it calls a press a drag.
 #[test]
@@ -256,7 +360,7 @@ fn cursor_hit_test_and_press_agree_at_a_cut() {
 }
 
 /// Renders the hover bracket at the City_Night_Drive / Desert_Dunes cut to PNGs for visual
-/// review (needs a GPU): `cargo test -p filmcraft-ui-egui --test timeline_trim_ui -- --ignored
+/// review (needs a GPU): `cargo test -p filmcraft-ui-egui --test it timeline_trim_ui:: -- --ignored
 /// hover_bracket_screenshots`. Yellow on City_Night_Drive's Out edge just left of the cut and on
 /// Desert_Dunes' In edge just right of it, red for the Ripple tool, both sides for the Rolling tool.
 #[test]
@@ -301,7 +405,7 @@ fn dragging_a_caption_edge_inward_trims_it() {
 
 /// #374: renders the Ambient_Score music clip mid-way through a trim of its In edge, with the
 /// mouse button still down, for visual review (needs a GPU): `cargo test -p filmcraft-ui-egui
-/// --test timeline_trim_ui -- --ignored trim_waveform_screenshots`. The waveform stays where it was
+/// --test it timeline_trim_ui::trim_waveform_screenshots -- --ignored`. The waveform stays where it was
 /// and is cut off at the moving edge; it used to squeeze the whole clip's waveform into the shorter
 /// clip, so the sound under the pointer moved while dragging.
 #[test]
@@ -365,6 +469,39 @@ fn an_edge_dragged_past_the_media_stops_at_its_end() {
     assert_eq!(d.span(last).1, e0 + limit.0, "released where it was shown");
 }
 
+/// With the Rolling Edit tool, a cut dragged far past the end of the right clip stops while the
+/// drag is still in progress, at the same place the roll lands on release.
+#[test]
+fn a_cut_rolled_past_its_limit_stops_there() {
+    use filmcraft_ui_egui::panels::timeline::Drag;
+    let mut d = Driver::demo();
+    let (city, dunes) = (d.v1_clip(CITY), d.v1_clip(DUNES));
+    d.ok("ui.menu.invoke", json!({"id": "tool.rolling"}));
+    let (cut, x1, y) = d.edges(dunes);
+    let (_, e0) = d.span(city);
+    let far = filmcraft_time::Tick(3600 * filmcraft_time::TICKS_PER_SECOND);
+    let limit = filmcraft_engine::commands::roll_delta(&d.app().session, ClipId(city), ClipId(dunes), far).expect("limit");
+    assert!(filmcraft_time::Tick::ZERO < limit && limit < far, "the roll has a limit: {limit:?}");
+    let (from, to) = (pos2(cut + 3.0, y), pos2(x1 + 100.0, y));
+    let push = |d: &mut Driver, e: egui::Event| d.harness.input_mut().events.push(e);
+    push(&mut d, egui::Event::PointerMoved(from));
+    d.frames(1);
+    push(&mut d, egui::Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    d.frames(1);
+    for i in 1..=60 {
+        push(&mut d, egui::Event::PointerMoved(from + (to - from) * (i as f32 / 60.0)));
+        d.frames(1);
+    }
+    match &d.app().tl.drag {
+        Some(Drag::Roll { delta, .. }) => assert_eq!(*delta, limit, "the rolled cut stops at the roll's limit"),
+        other => panic!("not rolling: {other:?}"),
+    }
+    push(&mut d, egui::Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    d.frames(2);
+    assert_eq!(d.span(city).1, e0 + limit.0, "released where it was shown");
+    assert_eq!(d.span(dunes).0, e0 + limit.0);
+}
+
 /// Dragging a picture in the Trim Monitor must not deadlock: the shift bookkeeping used to call
 /// `drag_delta()` inside `data_mut()`, and both take egui's non-reentrant context write-lock, so
 /// the drag froze the whole app on its first recognised frame (the delta is read before locking
@@ -563,3 +700,33 @@ fn linked_video_drag_adds_video_and_audio_tracks() {
 fn linked_audio_drag_adds_audio_and_video_tracks() {
     move_existing_clip_to_a_new_track(true, true);
 }
+
+/// #3300: with Alt held, dragging the edge of one side of a linked clip trims only that side; the
+/// linked audio keeps its range. Without Alt the partner still follows.
+#[test]
+fn alt_dragging_an_edge_trims_only_that_side_of_a_link() {
+    for alt in [true, false] {
+        let mut d = Driver::demo();
+        let seq = d.app().session.active_sequence().expect("sequence");
+        let (video, sound) = seq.video_tracks[0]
+            .items
+            .iter()
+            .find_map(|v| {
+                let a = seq.audio_tracks.iter().flat_map(|t| &t.items).find(|a| v.link.is_some() && a.link == v.link)?;
+                Some((v.id.0, a.id.0))
+            })
+            .expect("a linked clip on V1");
+        let (v0, a0) = (d.span(video), d.span(sound));
+        let (_, x1, y) = d.edges(video);
+        d.ok("ui.drag", json!({"from": {"x": x1 - 3.0, "y": y}, "to": {"x": x1 - 63.0, "y": y}, "steps": 20, "modifiers": {"alt": alt}}));
+        d.frames(2);
+        let v1 = d.span(video);
+        assert_eq!(v1.0, v0.0, "alt={alt}: the In point stays");
+        assert!(v1.1 < v0.1, "alt={alt}: the video's Out edge was trimmed: {v0:?} -> {v1:?}");
+        if alt {
+            assert_eq!(d.span(sound), a0, "Alt-trim leaves the linked audio alone");
+        } else {
+            assert_eq!(d.span(sound).1, a0.1 - (v0.1 - v1.1), "the linked audio follows a plain trim");
+        }
+    }
+}
diff --git a/crates/ui-egui/tests/it/timeline_work_area_ui.rs b/crates/ui-egui/tests/it/timeline_work_area_ui.rs
new file mode 100644
index 000000000..d04c919f6
--- /dev/null
+++ b/crates/ui-egui/tests/it/timeline_work_area_ui.rs
@@ -0,0 +1,153 @@
+//! The work area bar on the Timeline ruler: dragging an end moves that end, dragging its middle
+//! moves the bar, a double-click fits it to the visible part of the sequence, and none of these
+//! moves the playhead. Each gesture is one `sequence.setWorkArea` undo step.
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+}
+
+impl Driver {
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        // 60 frames a second: the two clicks of a double-click are one frame apart each, well
+        // inside egui's 0.3 s
+        let harness = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_step_dt(1.0 / 60.0).with_max_steps(10_000).build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx };
+        d.frames(4);
+        d
+    }
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+                return v["result"].clone();
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+    fn bar(&mut self) -> Option<[f64; 4]> {
+        let v = self.ok("ui.elements", json!({"prefix": "timeline.workArea"}));
+        let e = v.as_array().unwrap().iter().find(|e| e["id"] == "timeline.workArea")?.clone();
+        let r: Vec<f64> = e["rect"].as_array().unwrap().iter().map(|x| x.as_f64().unwrap()).collect();
+        Some([r[0], r[1], r[2], r[3]])
+    }
+    fn drag(&mut self, from: (f64, f64), dx: f64) {
+        self.ok("ui.drag", json!({"from": {"x": from.0, "y": from.1}, "to": {"x": from.0 + dx, "y": from.1}, "steps": 8}));
+        self.frames(3);
+    }
+    fn area(&self) -> Option<(i64, i64)> {
+        self.harness.state().session.active_sequence().unwrap().work_area.map(|w| (w.start.0, w.end().0))
+    }
+    fn last_undo(&self) -> Option<String> {
+        self.harness.state().session.history.undo.last().map(|u| u.0.clone())
+    }
+}
+
+#[test]
+fn dragging_and_double_clicking_the_work_area_bar() {
+    let mut d = Driver::demo();
+    d.exec("sequence.snap", json!({"on": false}));
+    let rate = d.harness.state().session.sequence_rate();
+    let (f24, f72) = (rate.tick_of(24).0, rate.tick_of(72).0);
+    let frame = rate.frame_duration().0;
+    assert_eq!(d.bar(), None, "hidden, the bar is not drawn");
+    d.exec("sequence.setWorkArea", json!({"start": f24, "end": f72}));
+    d.frames(2);
+    let r = d.bar().expect("the bar is drawn once it is set");
+    let (y, per_frame) = (r[1] + r[3] / 2.0, r[2] / 48.0);
+    let playhead = d.harness.state().session.playhead();
+
+    // the Out end, 24 frames to the right
+    d.drag((r[0] + r[2] - 1.0, y), 24.0 * per_frame);
+    let (start, end) = d.area().unwrap();
+    assert_eq!(start, f24, "the In end stays");
+    assert!((end - rate.tick_of(96).0).abs() <= frame, "the Out end moved 24 frames: {end}");
+    assert_eq!(d.last_undo().as_deref(), Some("Set Work Area"));
+
+    // the middle, 12 frames to the left: both ends move, the length stays
+    let r = d.bar().unwrap();
+    d.drag((r[0] + r[2] / 2.0, y), -12.0 * per_frame);
+    let (start2, end2) = d.area().unwrap();
+    assert_eq!(end2 - start2, end - start);
+    assert!((start2 - rate.tick_of(12).0).abs() <= frame, "the bar moved 12 frames: {start2}");
+    assert_eq!(d.harness.state().session.playhead(), playhead, "dragging the bar leaves the playhead");
+
+    // the In end cannot cross the Out end
+    let r = d.bar().unwrap();
+    d.drag((r[0] + 1.0, y), r[2] + 40.0 * per_frame);
+    let (start3, end3) = d.area().unwrap();
+    assert_eq!((start3, end3), (end2 - frame, end2), "the In end stops one frame before the Out end");
+
+    // a double-click spans the visible part of the sequence (the whole sequence is in view)
+    d.exec("sequence.setWorkArea", json!({"start": f24, "end": f72}));
+    d.ok("ui.menu.invoke", json!({"id": "view.zoomToSequence"}));
+    d.frames(60);
+    let r = d.bar().unwrap();
+    let hit = d.ok("ui.timeline.hit", json!({"x": r[0] + r[2] / 2.0, "y": y}));
+    assert_eq!(hit["hit"], "workArea", "the control channel reports the bar: {hit}");
+    assert_eq!(hit["edge"], Value::Null, "{hit}");
+    d.ok("ui.click", json!({"x": r[0] + r[2] / 2.0, "y": y, "count": 2}));
+    d.frames(3);
+    let duration = d.harness.state().session.active_sequence().unwrap().duration().0;
+    let (start4, end4) = d.area().unwrap();
+    assert_eq!(start4, 0);
+    assert!((end4 - duration).abs() <= frame, "{end4} of {duration}");
+    assert_eq!(d.harness.state().session.playhead(), playhead, "nor does a double-click");
+
+    // hidden again from the Timeline panel menu's command
+    d.exec("sequence.workAreaBar", json!({"show": false}));
+    d.frames(2);
+    assert_eq!(d.bar(), None);
+}
+
+#[test]
+fn the_in_end_of_a_work_area_shorter_than_a_frame_stays_at_zero() {
+    let mut d = Driver::demo();
+    d.exec("sequence.snap", json!({"on": false}));
+    let rate = d.harness.state().session.sequence_rate();
+    let frame = rate.frame_duration().0;
+    // zoomed in about the start of the sequence, so half a frame is a few pixels wide
+    d.exec("playhead.start", json!({}));
+    for _ in 0..5 {
+        d.ok("ui.menu.invoke", json!({"id": "view.zoomIn"}));
+    }
+    d.exec("sequence.setWorkArea", json!({"start": rate.tick_of(24).0, "end": rate.tick_of(72).0}));
+    d.frames(2);
+    let per_frame = d.bar().unwrap()[2] / 48.0;
+    assert!(per_frame > 4.0, "a frame is wide enough to grab half of it: {per_frame}");
+    d.exec("sequence.setWorkArea", json!({"start": 0, "end": frame / 2}));
+    d.frames(2);
+    let r = d.bar().unwrap();
+    let y = r[1] + r[3] / 2.0;
+    d.drag((r[0] + 0.5, y), 10.0 * per_frame);
+    assert_eq!(d.area(), Some((0, frame / 2)), "the In end stays at 0");
+    let status = d.harness.state().ui.status.clone();
+    assert!(!status.contains("must not be negative"), "the release sends a valid start: {status}");
+}
diff --git a/crates/ui-egui/tests/it/track_color_ui.rs b/crates/ui-egui/tests/it/track_color_ui.rs
new file mode 100644
index 000000000..f20d76899
--- /dev/null
+++ b/crates/ui-egui/tests/it/track_color_ui.rs
@@ -0,0 +1,161 @@
+//! Headless UI test of track colour labels (#1186): the strip at the left edge of a track header
+//! opens the colour menu; the label tints the header and the lane and is an undoable track setting.
+//!
+//! Set `FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` to also render offscreen with wgpu and write `track-color-*.png`.
+
+#![allow(dead_code)]
+
+use std::sync::mpsc::{Sender, channel};
+
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::control::ControlRequest;
+use serde_json::{Value, json};
+
+struct Driver {
+    harness: Harness<'static, FilmcraftApp>,
+    tx: Sender<ControlRequest>,
+    snapshots: Option<std::path::PathBuf>,
+}
+
+impl Driver {
+    fn demo() -> Self {
+        let mut session = Session::default();
+        session.execute("file.openDemoProject", json!({})).expect("demo project");
+        let (tx, rx) = channel();
+        let app = FilmcraftApp::new(session).with_control(rx);
+        let snapshots = std::env::var_os("FILMCRAFT_UI_SNAPSHOT_DIR").map(std::path::PathBuf::from);
+        let mut b = Harness::builder().with_size(egui::vec2(1600.0, 980.0)).with_max_steps(10_000);
+        if snapshots.is_some() {
+            b = b.wgpu();
+        }
+        let harness = b.build_eframe(move |_cc| app);
+        let mut d = Driver { harness, tx, snapshots };
+        d.frames(4);
+        d
+    }
+
+    fn frames(&mut self, n: usize) {
+        for _ in 0..n {
+            let ctx = self.harness.ctx.clone();
+            let mut raw = std::mem::take(self.harness.input_mut());
+            eframe::App::raw_input_hook(self.harness.state_mut(), &ctx, &mut raw);
+            *self.harness.input_mut() = raw;
+            self.harness.step();
+        }
+    }
+
+    fn call(&mut self, method: &str, params: Value) -> Value {
+        let (req, reply) = ControlRequest::new(method, params.clone());
+        self.tx.send(req).unwrap();
+        for _ in 0..600 {
+            self.frames(1);
+            if let Ok(v) = reply.try_recv() {
+                return v;
+            }
+        }
+        panic!("no reply to {method} {params}");
+    }
+
+    fn ok(&mut self, method: &str, params: Value) -> Value {
+        let v = self.call(method, params.clone());
+        assert_eq!(v["ok"], json!(true), "{method} {params} failed: {v}");
+        v["result"].clone()
+    }
+
+    fn exec(&mut self, command: &str, params: Value) -> Value {
+        self.ok("engine.execute", json!({"command": command, "params": params}))
+    }
+
+    fn click(&mut self, id: &str) {
+        self.ok("ui.click", json!({"id": id}));
+        self.frames(2);
+    }
+
+    fn element(&mut self, id: &str) -> Option<[f32; 4]> {
+        let v = self.ok("ui.elements", json!({"prefix": id}));
+        v.as_array()?.iter().find(|e| e["id"] == id).map(|e| {
+            let r = &e["rect"];
+            [r[0].as_f64().unwrap() as f32, r[1].as_f64().unwrap() as f32, r[2].as_f64().unwrap() as f32, r[3].as_f64().unwrap() as f32]
+        })
+    }
+
+    fn ids(&mut self, prefix: &str) -> Vec<String> {
+        let v = self.ok("ui.elements", json!({"prefix": prefix}));
+        v.as_array().unwrap().iter().filter_map(|e| e["id"].as_str().map(str::to_string)).collect()
+    }
+
+    /// Offscreen render of the window (or the bounding box of the elements under `prefix`).
+    fn snapshot(&mut self, name: &str, prefix: Option<&str>) {
+        let Some(dir) = self.snapshots.clone() else { return };
+        let crop = prefix.map(|p| {
+            let v = self.ok("ui.elements", json!({"prefix": p}));
+            let mut bb = [f32::MAX, f32::MAX, f32::MIN, f32::MIN];
+            for e in v.as_array().unwrap() {
+                let r = &e["rect"];
+                let (x, y, w, h) = (r[0].as_f64().unwrap() as f32, r[1].as_f64().unwrap() as f32, r[2].as_f64().unwrap() as f32, r[3].as_f64().unwrap() as f32);
+                bb = [bb[0].min(x), bb[1].min(y), bb[2].max(x + w), bb[3].max(y + h)];
+            }
+            bb
+        });
+        self.frames(2);
+        let img = match self.harness.render() {
+            Ok(i) => i,
+            Err(e) => {
+                eprintln!("snapshot {name} skipped: {e}");
+                return;
+            }
+        };
+        let ppp = img.width() as f32 / 1600.0;
+        let img = match crop {
+            Some(bb) => {
+                let x0 = ((bb[0] - 24.0) * ppp).max(0.0) as u32;
+                let y0 = ((bb[1] - 30.0) * ppp).max(0.0) as u32;
+                let x1 = (((bb[2] + 16.0) * ppp) as u32).min(img.width());
+                let y1 = (((bb[3] + 46.0) * ppp) as u32).min(img.height());
+                image::imageops::crop_imm(&img, x0, y0, x1 - x0, y1 - y0).to_image()
+            }
+            None => img,
+        };
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join(format!("{name}.png"));
+        img.save(&path).unwrap();
+        eprintln!("snapshot: {}", path.display());
+    }
+}
+
+fn label(d: &mut Driver, kind: &str, index: usize) -> Value {
+    d.exec("sequence.inspect", json!({}))[kind][index]["label"].clone()
+}
+
+#[test]
+fn the_track_header_strip_sets_a_colour_label() {
+    let mut d = Driver::demo();
+    assert_eq!(label(&mut d, "video", 0), json!(null));
+    let ids = d.ids("timeline.track.");
+    for id in ["timeline.track.V1.color", "timeline.track.A1.color"] {
+        assert!(ids.iter().any(|i| i == id), "{id} missing from {ids:?}");
+    }
+    // the strip sits left of the source patch, inside the header
+    let strip = d.element("timeline.track.V1.color").unwrap();
+    let patch = d.element("timeline.track.V1.sourcePatch").unwrap();
+    assert!(strip[0] + strip[2] <= patch[0], "strip {strip:?} overlaps the source patch {patch:?}");
+    d.click("timeline.track.V1.color");
+    let menu = d.ids("timeline.track.V1.color.");
+    assert!(menu.iter().any(|i| i == "timeline.track.V1.color.Forest") && menu.iter().any(|i| i == "timeline.track.V1.color.None"), "{menu:?}");
+    d.click("timeline.track.V1.color.Forest");
+    assert_eq!(label(&mut d, "video", 0), json!("Forest"));
+    assert!(!d.ids("timeline.track.V1.color.").iter().any(|i| i == "timeline.track.V1.color.Forest"), "the menu closes");
+    // audio tracks too
+    d.click("timeline.track.A1.color");
+    d.click("timeline.track.A1.color.Mango");
+    assert_eq!(label(&mut d, "audio", 0), json!("Mango"));
+    d.snapshot("track-color-labels", None);
+    // None clears; undo brings it back
+    d.click("timeline.track.V1.color");
+    d.click("timeline.track.V1.color.None");
+    assert_eq!(label(&mut d, "video", 0), json!(null));
+    d.exec("edit.undo", json!({}));
+    assert_eq!(label(&mut d, "video", 0), json!("Forest"));
+}
diff --git a/crates/ui-egui/tests/track_select_drag_ui.rs b/crates/ui-egui/tests/it/track_select_drag_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/track_select_drag_ui.rs
rename to crates/ui-egui/tests/it/track_select_drag_ui.rs
diff --git a/crates/ui-egui/tests/transcript_ui.rs b/crates/ui-egui/tests/it/transcript_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/transcript_ui.rs
rename to crates/ui-egui/tests/it/transcript_ui.rs
diff --git a/crates/ui-egui/tests/transform_handles_ui.rs b/crates/ui-egui/tests/it/transform_handles_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/transform_handles_ui.rs
rename to crates/ui-egui/tests/it/transform_handles_ui.rs
diff --git a/crates/ui-egui/tests/transition_drop_ui.rs b/crates/ui-egui/tests/it/transition_drop_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/transition_drop_ui.rs
rename to crates/ui-egui/tests/it/transition_drop_ui.rs
diff --git a/crates/ui-egui/tests/transitions_ui.rs b/crates/ui-egui/tests/it/transitions_ui.rs
similarity index 79%
rename from crates/ui-egui/tests/transitions_ui.rs
rename to crates/ui-egui/tests/it/transitions_ui.rs
index bae155c95..603aedff5 100644
--- a/crates/ui-egui/tests/transitions_ui.rs
+++ b/crates/ui-egui/tests/it/transitions_ui.rs
@@ -344,3 +344,81 @@ fn transition_timeline_in_effect_controls() {
     assert!(ph.is_some_and(|p| p > c.cut), "{ph:?}");
     assert!(d.find("effectControls.transition.timeline.playhead").is_some(), "the playhead shows in the transition's timeline");
 }
+
+/// Dragging the cut line over the transition in Effect Controls moves the cut and the transition
+/// together: the clips' In and Out points change, the sequence keeps its length, and the drag is
+/// one undo step.
+#[test]
+fn dragging_the_cut_in_effect_controls_moves_it_with_the_transition() {
+    let mut d = Driver::demo();
+    let c = d.crossing();
+    let frame = frame_ticks(d.rate());
+    d.click(&format!("timeline.transition.{}", c.id));
+    let x = d.transition(c.id).unwrap();
+    let (from, to) = (x["from"].as_u64().unwrap(), x["to"].as_u64().unwrap());
+    // (start, duration, source in) of a clip
+    let clip = |d: &mut Driver, id: u64| {
+        let q = d.exec("sequence.inspect", json!({}));
+        let it = q["video"].as_array().unwrap().iter().flat_map(|t| t["items"].as_array().unwrap().clone()).find(|i| i["clip"] == id).unwrap();
+        (it["start"].as_i64().unwrap(), it["duration"].as_i64().unwrap(), it["sourceIn"].clone())
+    };
+    let (a0, b0) = (clip(&mut d, from), clip(&mut d, to));
+    let (x0, y0, w, h, _) = d.find("effectControls.transition.timeline.cut").expect("the cut line over the transition");
+    let (cx, cy) = (x0 + w / 2.0, y0 + h / 2.0);
+    d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx + 20.0, "y": cy}, "steps": 8}));
+    d.frames(3);
+    let (a1, b1) = (clip(&mut d, from), clip(&mut d, to));
+    let moved = b1.0 - b0.0;
+    assert!(moved > 0, "the cut moved right: {b0:?} -> {b1:?}");
+    assert_eq!(moved % frame, 0, "by whole frames");
+    assert_eq!((a1.0, a1.1), (a0.0, a0.1 + moved), "the first clip ends at the new cut");
+    assert_eq!(b1.0 + b1.1, b0.0 + b0.1, "the second clip still ends where it did");
+    assert_ne!(b1.2, b0.2, "the second clip starts later in its media");
+    let x1 = d.transition(c.id).unwrap();
+    assert_eq!((x1["start"].as_i64(), x1["duration"].as_i64()), (Some(c.start + moved), Some(c.duration)), "the transition moved with the cut");
+    assert_eq!(x1["align"], json!("center"), "still centered on its cut");
+    // one undo step
+    d.exec("edit.undo", json!({}));
+    assert_eq!((clip(&mut d, from), clip(&mut d, to)), (a0, b0));
+    let back = d.transition(c.id).unwrap();
+    assert_eq!((back["start"].as_i64(), back["duration"].as_i64()), (Some(c.start), Some(c.duration)));
+}
+
+/// With Start at Cut the cut is at the transition's edge, where a press over the transition grabs
+/// its In end, so the cut line is grabbed where it crosses clip A. A drag past what the clips
+/// allow stops where `timeline.roll` stops.
+#[test]
+fn the_cut_is_grabbed_over_the_clips_and_stops_at_the_rolls_limit() {
+    let mut d = Driver::demo();
+    let c = d.crossing();
+    d.click(&format!("timeline.transition.{}", c.id));
+    let x = d.transition(c.id).unwrap();
+    let (from, to) = (x["from"].as_u64().unwrap(), x["to"].as_u64().unwrap());
+    d.exec("sequence.setTransition", json!({"transition": c.id, "align": "start"}));
+    d.frames(3);
+    let cut_of = |d: &mut Driver| {
+        let q = d.exec("sequence.inspect", json!({}));
+        q["video"].as_array().unwrap().iter().flat_map(|t| t["items"].as_array().unwrap().clone()).find(|i| i["clip"] == to).unwrap()["start"].as_i64().unwrap()
+    };
+    let start_of = |d: &mut Driver| d.transition(c.id).unwrap()["start"].as_i64().unwrap();
+    let drag_cut = |d: &mut Driver, by: f64| {
+        let (x0, y0, w, h, _) = d.find("effectControls.transition.timeline.cut.a").expect("the cut line over clip A");
+        let (cx, cy) = (x0 + w / 2.0, y0 + h / 2.0);
+        d.ok("ui.drag", json!({"from": {"x": cx, "y": cy}, "to": {"x": cx + by, "y": cy}, "steps": 8}));
+        d.frames(3);
+    };
+    let (cut0, start0) = (cut_of(&mut d), start_of(&mut d));
+    assert_eq!(start0, cut0, "Start at Cut");
+    drag_cut(&mut d, 20.0);
+    let (cut1, start1) = (cut_of(&mut d), start_of(&mut d));
+    let moved = cut1 - cut0;
+    assert!(moved > 0, "the cut moved right: {cut0} -> {cut1}");
+    assert_eq!(start1, cut1, "the transition still starts at the cut");
+    // far to the right: the cut stops at the roll's limit
+    let far = filmcraft_time::Tick(3600 * filmcraft_time::TICKS_PER_SECOND);
+    let limit =
+        filmcraft_engine::commands::roll_delta(&d.harness.state().session, filmcraft_project::ClipId(from), filmcraft_project::ClipId(to), far).unwrap();
+    assert!(0 < limit.0 && limit < far, "the roll has a limit: {limit:?}");
+    drag_cut(&mut d, limit.0 as f64 / moved as f64 * 20.0 + 200.0);
+    assert_eq!(cut_of(&mut d), cut1 + limit.0, "stopped at the limit");
+}
diff --git a/crates/ui-egui/tests/tts_ui.rs b/crates/ui-egui/tests/it/tts_ui.rs
similarity index 97%
rename from crates/ui-egui/tests/tts_ui.rs
rename to crates/ui-egui/tests/it/tts_ui.rs
index 4a7576285..6e9d7f030 100644
--- a/crates/ui-egui/tests/tts_ui.rs
+++ b/crates/ui-egui/tests/it/tts_ui.rs
@@ -77,9 +77,10 @@ impl Driver {
         self.ui()["ui"]["tts"].clone()
     }
 
-    /// Let a background synthesis job finish.
+    /// Let a background synthesis job finish, for at most two minutes of wall-clock time.
     fn settle(&mut self) {
-        for _ in 0..400 {
+        let t0 = std::time::Instant::now();
+        while t0.elapsed().as_secs() < 120 {
             if self.draft()["pending"].is_null() {
                 return;
             }
diff --git a/crates/ui-egui/tests/ui_control_input.rs b/crates/ui-egui/tests/it/ui_control_input.rs
similarity index 82%
rename from crates/ui-egui/tests/ui_control_input.rs
rename to crates/ui-egui/tests/it/ui_control_input.rs
index 773b451dd..0d437a11c 100644
--- a/crates/ui-egui/tests/ui_control_input.rs
+++ b/crates/ui-egui/tests/it/ui_control_input.rs
@@ -5,14 +5,10 @@ use std::sync::{
     mpsc::{Sender, channel},
 };
 
-use egui::{Event, Id, Key, Modifiers, vec2};
+use egui::{Event, Key, Modifiers, vec2};
 use egui_kittest::Harness;
 use filmcraft_engine::Session;
-use filmcraft_ui_egui::{
-    FilmcraftApp,
-    control::ControlRequest,
-    dock::{DockNode, PanelKind, SplitSize},
-};
+use filmcraft_ui_egui::{FilmcraftApp, control::ControlRequest, dock::PanelKind};
 use serde_json::{Value, json};
 
 struct Driver {
@@ -99,21 +95,29 @@ fn ordinary_control_input_also_resizes_a_background_divider() {
 
 fn background_divider(isolated: bool) {
     let mut d = Driver::new(isolated);
-    d.h.state_mut().ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(400.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
+    d.h.state_mut().ui.dock = craft_ui::docking::Layout {
+        root: Some(craft_ui::docking::Node::Split {
+            axis: craft_ui::layout::SplitAxis::Horizontal,
+            size: craft_ui::layout::SplitSize::FixedFirst(400.0),
+            first: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Project], active: 0 }),
+            second: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
+        }),
+        floating: vec![],
     };
     d.frames(3, true);
     let before_project = d.h.state().session.project.clone();
     let before_playheads = d.h.state().session.state.playheads.clone();
-    let divider = Id::new(("dock-gutter", String::new()));
+    let divider = craft_ui::docking::DockArea::<PanelKind>::hit_id(
+        filmcraft_ui_egui::dock_area_id(),
+        &craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Split(vec![])),
+    );
     d.h.ctx.memory_mut(|memory| memory.request_focus(divider));
     d.frames(2, true);
     d.h.input_mut().events.push(Event::WindowFocused(false));
     d.ok("ui.key", json!({"key":"ArrowRight"}), false);
-    assert!(matches!(d.h.state().ui.dock, DockNode::Split { size: SplitSize::FixedA(408.0), .. }), "control input must work without native activation");
+    d.frames(2, false);
+    let width = d.h.state().auto.find("panel.Project").unwrap().rect[2];
+    assert!((width - 408.0).abs() < 0.5, "control input must work without native activation: Project is {width} wide");
     assert_eq!(d.h.state().session.state.playheads, before_playheads);
     assert!(Arc::ptr_eq(&d.h.state().session.project, &before_project));
     assert!(!d.h.state().playback.playing);
@@ -156,15 +160,7 @@ fn isolation_preserves_close_and_screenshot_delivery_without_claiming_os_focus()
     let viewport = raw.viewports.get_mut(&egui::ViewportId::ROOT).unwrap();
     viewport.focused = Some(false);
     viewport.events.push(egui::ViewportEvent::Close);
-    raw.events = vec![
-        Event::Text("unrelated typing".into()),
-        Event::WindowFocused(false),
-        Event::Screenshot {
-            viewport_id: egui::ViewportId::ROOT,
-            user_data: Default::default(),
-            image: Arc::new(egui::ColorImage::new([1, 1], vec![egui::Color32::WHITE])),
-        },
-    ];
+    raw.events = vec![Event::Text("unrelated typing".into()), Event::WindowFocused(false)];
     raw.hovered_files.push(Default::default());
     #[derive(Debug)]
     struct UnrelatedFile;
@@ -187,7 +183,10 @@ fn isolation_preserves_close_and_screenshot_delivery_without_claiming_os_focus()
     assert!(raw.focused);
     assert_eq!(raw.viewports[&egui::ViewportId::ROOT].focused, Some(false));
     assert_eq!(raw.viewports[&egui::ViewportId::ROOT].events, vec![egui::ViewportEvent::Close]);
-    assert!(matches!(raw.events.as_slice(), [Event::Screenshot { .. }, Event::ModifiersChanged(Modifiers::NONE)]));
+    assert!(
+        matches!(raw.events.as_slice(), [Event::ModifiersChanged(Modifiers::NONE)]),
+        "native input is dropped; screenshot results use callbacks, not raw events"
+    );
     assert!(raw.hovered_files.is_empty() && raw.dropped_files.is_empty());
     let state = filmcraft_ui_egui::control::inspect(d.h.state(), &ctx);
     assert_eq!(state["input"]["nativeWindowFocused"], false);
@@ -275,3 +274,22 @@ fn modified_control_drag_keeps_shift_until_release_and_clears_it_afterward() {
     d.frames(3, false);
     assert_eq!(d.h.ctx.input(|input| input.modifiers), Modifiers::NONE);
 }
+
+/// CodeRabbit on #2006: in control-only mode the native menu's commands are ignored, but its Quit
+/// item (now `app.quit` through the command inbox, #1943) must still close the window, as the
+/// predefined Quit item did.
+#[test]
+fn native_quit_still_quits_in_control_only_mode() {
+    let mut d = Driver::new(true);
+    let (tx, rx) = channel();
+    d.h.state_mut().command_inbox = Some(rx);
+    // another menu command is ignored
+    let project = d.h.state().session.project.clone();
+    tx.send("file.newBin".to_string()).unwrap();
+    d.frames(2, true);
+    assert!(Arc::ptr_eq(&project, &d.h.state().session.project), "menu commands do not run in control-only mode");
+    tx.send("app.quit".to_string()).unwrap();
+    d.frames(1, true);
+    let closing = d.h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::Close));
+    assert!(closing, "Quit asks the window to close");
+}
diff --git a/crates/ui-egui/tests/it/ui_dock_resize.rs b/crates/ui-egui/tests/it/ui_dock_resize.rs
new file mode 100644
index 000000000..ce4a7bc32
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_dock_resize.rs
@@ -0,0 +1,252 @@
+//! Shared pane resizing in the full application, including application shortcut ownership.
+
+use egui::{Event, Key, Modifiers, PointerButton, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use filmcraft_engine::Session;
+use filmcraft_ui_egui::FilmcraftApp;
+use filmcraft_ui_egui::dock::PanelKind;
+use filmcraft_ui_egui::theme::ThemeKind;
+use serde_json::json;
+
+fn step(h: &mut Harness<'_, FilmcraftApp>) {
+    h.step();
+    assert!(h.state().ui_error.is_none(), "the app caught a UI panic: {:?}", h.state().ui_error);
+}
+
+fn frames(h: &mut Harness<'_, FilmcraftApp>, count: usize) {
+    for _ in 0..count {
+        step(h);
+    }
+}
+
+fn snapshots(h: &mut Harness<'_, FilmcraftApp>, directory: Option<&std::path::Path>, phase: &str) {
+    let Some(directory) = directory else { return };
+    std::fs::create_dir_all(directory).unwrap();
+    for (name, theme) in [("dark", ThemeKind::Dark), ("medium", ThemeKind::Medium), ("light", ThemeKind::Light)] {
+        let ctx = h.ctx.clone();
+        h.state_mut().set_theme(&ctx, theme);
+        frames(h, 3);
+        h.render().unwrap().save(directory.join(format!("filmcraft-{phase}-{name}.png"))).unwrap();
+    }
+    let ctx = h.ctx.clone();
+    h.state_mut().set_theme(&ctx, ThemeKind::Dark);
+    frames(h, 3);
+}
+
+/// The drawn width of the Project panel, the first child of the tests' split, after the layout
+/// change has been drawn.
+fn first_size(h: &mut Harness<'_, FilmcraftApp>) -> f32 {
+    frames(h, 2);
+    h.state().auto.find("panel.Project").unwrap().rect[2]
+}
+
+fn assert_near(value: f32, expected: f32) {
+    assert!((value - expected).abs() < 0.5, "{value} is not {expected}");
+}
+
+#[test]
+fn focused_dock_resize_owns_arrows_and_keeps_pointer_dragging() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    // Opt in to GPU snapshots while the ordinary test remains headless and renderer-independent.
+    let directory = std::env::var_os("CRAFT_UI_PANES_SNAPSHOT_DIR").map(std::path::PathBuf::from);
+    let mut builder = Harness::builder().with_size(vec2(1400.0, 900.0)).with_max_steps(10_000);
+    if directory.is_some() {
+        builder = builder.wgpu();
+    }
+    let mut h = builder.build_eframe(move |_| app);
+    frames(&mut h, 4);
+    snapshots(&mut h, directory.as_deref(), "workspace");
+    h.state_mut().ui.focused = PanelKind::Timeline;
+    h.state_mut().ui.dock = craft_ui::docking::Layout {
+        root: Some(craft_ui::docking::Node::Split {
+            axis: craft_ui::layout::SplitAxis::Horizontal,
+            size: craft_ui::layout::SplitSize::FixedFirst(400.0),
+            first: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Project], active: 0 }),
+            second: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
+        }),
+        floating: vec![],
+    };
+    frames(&mut h, 3);
+    let before_project = h.state().session.project.clone();
+    let before_playheads = h.state().session.state.playheads.clone();
+    let id = craft_ui::docking::DockArea::<PanelKind>::hit_id(
+        filmcraft_ui_egui::dock_area_id(),
+        &craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Split(vec![])),
+    );
+    h.ctx.memory_mut(|memory| memory.request_focus(id));
+    frames(&mut h, 2);
+    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(id));
+    snapshots(&mut h, directory.as_deref(), "focused-resize");
+    h.event(Event::Key { key: Key::ArrowRight, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    step(&mut h);
+    h.event(Event::Key { key: Key::ArrowRight, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    step(&mut h);
+    assert_near(first_size(&mut h), 408.0);
+    assert_eq!(h.state().session.state.playheads, before_playheads, "the Timeline shortcut must not seek");
+    assert!(std::sync::Arc::ptr_eq(&h.state().session.project, &before_project));
+
+    frames(&mut h, 2);
+    let element = h.state().auto.find("dock.gutter.").unwrap();
+    let from = Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3])).center();
+    h.event(Event::PointerMoved(from));
+    step(&mut h);
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    step(&mut h);
+    for offset in [5.0, 10.0, 15.0, 20.0] {
+        h.event(Event::PointerMoved(from + vec2(offset, 0.0)));
+        step(&mut h);
+    }
+    h.event(Event::PointerButton { pos: from + vec2(20.0, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    step(&mut h);
+    assert_near(first_size(&mut h), 428.0);
+    assert_eq!(h.state().session.state.playheads, before_playheads);
+}
+
+fn press(h: &mut Harness<'_, FilmcraftApp>, key: Key) {
+    for pressed in [true, false] {
+        h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+        step(h);
+    }
+    frames(h, 2);
+}
+
+#[test]
+fn space_plays_after_a_pane_is_resized_with_the_pointer() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    frames(&mut h, 4);
+    h.state_mut().ui.focused = PanelKind::Timeline;
+    h.state_mut().ui.dock = craft_ui::docking::Layout {
+        root: Some(craft_ui::docking::Node::Split {
+            axis: craft_ui::layout::SplitAxis::Horizontal,
+            size: craft_ui::layout::SplitSize::FixedFirst(400.0),
+            first: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Project], active: 0 }),
+            second: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
+        }),
+        floating: vec![],
+    };
+    frames(&mut h, 3);
+    let element = h.state().auto.find("dock.gutter.").unwrap();
+    let from = Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3])).center();
+    h.event(Event::PointerMoved(from));
+    step(&mut h);
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    step(&mut h);
+    for offset in [5.0, 10.0, 15.0, 20.0] {
+        h.event(Event::PointerMoved(from + vec2(offset, 0.0)));
+        step(&mut h);
+    }
+    h.event(Event::PointerButton { pos: from + vec2(20.0, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    frames(&mut h, 3);
+    assert_near(first_size(&mut h), 420.0);
+    // A pointer drag leaves no keyboard focus on the divider, so the editor keeps its shortcuts.
+    assert_ne!(
+        h.ctx.memory(|memory| memory.focused()),
+        Some(craft_ui::docking::DockArea::<PanelKind>::hit_id(
+            filmcraft_ui_egui::dock_area_id(),
+            &craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Split(vec![]))
+        ))
+    );
+    press(&mut h, Key::Space);
+    assert!(h.state().playback.playing, "Space must start playback after resizing a pane (#1482)");
+    press(&mut h, Key::Space);
+    assert!(!h.state().playback.playing);
+}
+
+/// Space plays while any edge of a floating window's resize grip has keyboard focus, as it does
+/// for the bottom-right corner and pane dividers (#1482).
+#[test]
+fn space_plays_while_any_floating_resize_edge_has_focus() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    frames(&mut h, 4);
+    let ctx = h.ctx.clone();
+    filmcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [300, 200, 400, 300]})).unwrap();
+    frames(&mut h, 3);
+    use craft_ui::docking::{DockArea, Hit, ResizeEdge};
+    for edge in [ResizeEdge::Top, ResizeEdge::Left, ResizeEdge::BottomRight] {
+        let grip = DockArea::<PanelKind>::hit_id(filmcraft_ui_egui::dock_area_id(), &Hit::Resize(PanelKind::Info, edge));
+        h.ctx.memory_mut(|memory| memory.request_focus(grip));
+        frames(&mut h, 2);
+        assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(grip), "{edge:?}");
+        press(&mut h, Key::Space);
+        assert!(h.state().playback.playing, "Space must play with the {edge:?} grip focused");
+        press(&mut h, Key::Space);
+        assert!(!h.state().playback.playing);
+    }
+}
+
+/// The divider between groups split in a floating window has an automation id, and Space plays
+/// while it has keyboard focus (#1482).
+#[test]
+fn space_plays_while_a_floating_group_divider_has_focus() {
+    let mut session = Session::default();
+    session.execute("file.openDemoProject", json!({})).unwrap();
+    let app = FilmcraftApp::new(session);
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    frames(&mut h, 4);
+    let ctx = h.ctx.clone();
+    filmcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [300, 200, 400, 400]})).unwrap();
+    filmcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.dockPanel", json!({"panel": "Project", "anchor": "Info", "zone": "bottom"})).unwrap();
+    frames(&mut h, 3);
+    use craft_ui::docking::{Divider, DockArea, Hit};
+    let area = filmcraft_ui_egui::dock_area_id();
+    let hit = Hit::Divider(Divider::WindowSplit(PanelKind::Info, vec![]));
+    assert!(DockArea::<PanelKind>::hit_rects(&h.ctx, area).iter().any(|(drawn, _)| *drawn == hit), "no window divider drawn");
+    let divider = DockArea::<PanelKind>::hit_id(area, &hit);
+    let element = h.state().auto.find("panel.float.0.gutter.").expect("the window divider has no automation id");
+    assert_eq!(element.widget_id, Some(format!("{:016x}", divider.value())));
+    h.ctx.memory_mut(|memory| memory.request_focus(divider));
+    frames(&mut h, 2);
+    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(divider));
+    press(&mut h, Key::Space);
+    assert!(h.state().playback.playing, "Space must play with the group divider focused");
+    press(&mut h, Key::Space);
+    assert!(!h.state().playback.playing);
+}
+
+/// Tools is an ordinary group: the divider beside it widens and narrows it.
+#[test]
+fn the_divider_beside_tools_moves_both_ways() {
+    let app = FilmcraftApp::new(Session::default());
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    frames(&mut h, 4);
+    h.state_mut().ui.dock = craft_ui::docking::Layout {
+        root: Some(craft_ui::docking::Node::Split {
+            axis: craft_ui::layout::SplitAxis::Horizontal,
+            size: craft_ui::layout::SplitSize::Ratio(0.06),
+            first: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Tools], active: 0 }),
+            second: Box::new(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
+        }),
+        floating: vec![],
+    };
+    frames(&mut h, 3);
+    let width = |h: &Harness<'_, FilmcraftApp>| h.state().auto.find("panel.Tools").unwrap().rect[2];
+    let before = width(&h);
+    let drag = |h: &mut Harness<'_, FilmcraftApp>, dx: f32| {
+        let element = h.state().auto.find("dock.gutter.").unwrap();
+        let from = Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3])).center();
+        h.event(Event::PointerMoved(from));
+        step(h);
+        h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        step(h);
+        for step_index in 1..=4 {
+            h.event(Event::PointerMoved(from + vec2(dx * step_index as f32 / 4.0, 0.0)));
+            step(h);
+        }
+        h.event(Event::PointerButton { pos: from + vec2(dx, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        frames(h, 3);
+    };
+    drag(&mut h, 200.0);
+    let wider = width(&h);
+    assert!(wider >= before + 150.0, "Tools widened only from {before} to {wider}");
+    drag(&mut h, -150.0);
+    let narrower = width(&h);
+    assert!(narrower <= wider - 100.0, "Tools narrowed only from {wider} to {narrower}");
+}
diff --git a/crates/ui-egui/tests/ui_keyboard_focus.rs b/crates/ui-egui/tests/it/ui_keyboard_focus.rs
similarity index 75%
rename from crates/ui-egui/tests/ui_keyboard_focus.rs
rename to crates/ui-egui/tests/it/ui_keyboard_focus.rs
index 8685d4933..11eb818c4 100644
--- a/crates/ui-egui/tests/ui_keyboard_focus.rs
+++ b/crates/ui-egui/tests/it/ui_keyboard_focus.rs
@@ -5,11 +5,7 @@ use std::sync::Arc;
 use egui::{Event, Id, Key, Modifiers, vec2};
 use egui_kittest::Harness;
 use filmcraft_engine::Session;
-use filmcraft_ui_egui::{
-    FilmcraftApp,
-    dock::{DockNode, PanelKind},
-    state::Tool,
-};
+use filmcraft_ui_egui::{FilmcraftApp, dock::PanelKind, state::Tool};
 use serde_json::json;
 
 fn key(h: &mut Harness<'_, FilmcraftApp>, key: Key, modifiers: Modifiers) {
@@ -30,11 +26,12 @@ fn tab_traversal_and_space_select_only_the_focused_tool_with_visible_focus() {
     let app = FilmcraftApp::new(session);
     let mut h = Harness::builder().with_size(vec2(1200.0, 800.0)).build_eframe(move |_| app);
     h.run_steps(4);
-    h.state_mut().ui.dock = DockNode::Tabs { panels: vec![PanelKind::Tools], active: 0 };
+    h.state_mut().ui.dock =
+        craft_ui::docking::Layout { root: Some(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Tools], active: 0 }), floating: vec![] };
     h.run_steps(3);
-    let first = Id::new(("tool", "Selection".to_string()));
-    let second = Id::new(("tool", "TrackSelectForward".to_string()));
-    let third = Id::new(("tool", "Ripple".to_string()));
+    let first = Id::unique(("tool", "Selection".to_string()));
+    let second = Id::unique(("tool", "TrackSelectForward".to_string()));
+    let third = Id::unique(("tool", "Ripple".to_string()));
     for _ in 0..128 {
         key(&mut h, Key::Tab, Modifiers::NONE);
         if h.ctx.memory(|m| m.focused()) == Some(first) {
@@ -74,10 +71,13 @@ fn dock_tab_traversal_and_enter_change_the_visible_panel_without_editing() {
     h.run_steps(4);
     h.state_mut().ui.show_header = false;
     h.state_mut().ui.show_status_bar = false;
-    h.state_mut().ui.dock = DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Effects], active: 0 };
+    h.state_mut().ui.dock = craft_ui::docking::Layout {
+        root: Some(craft_ui::docking::Node::Tabs { panels: vec![PanelKind::Project, PanelKind::Effects], active: 0 }),
+        floating: vec![],
+    };
     h.run_steps(3);
-    let first = Id::new(("tab", String::new(), 0usize));
-    let second = Id::new(("tab", String::new(), 1usize));
+    let first = craft_ui::docking::DockArea::<PanelKind>::hit_id(filmcraft_ui_egui::dock_area_id(), &craft_ui::docking::Hit::Tab(PanelKind::Project));
+    let second = craft_ui::docking::DockArea::<PanelKind>::hit_id(filmcraft_ui_egui::dock_area_id(), &craft_ui::docking::Hit::Tab(PanelKind::Effects));
     for _ in 0..128 {
         key(&mut h, Key::Tab, Modifiers::NONE);
         if h.ctx.memory(|m| m.focused()) == Some(second) {
@@ -85,7 +85,7 @@ fn dock_tab_traversal_and_enter_change_the_visible_panel_without_editing() {
         }
     }
     assert_eq!(h.ctx.memory(|m| m.focused()), Some(second));
-    assert!(matches!(h.state().ui.dock, DockNode::Tabs { active: 0, .. }));
+    assert!(matches!(h.state().ui.dock.root, Some(craft_ui::docking::Node::Tabs { active: 0, .. })));
     let response = h.ctx.read_response(second).unwrap();
     assert!(
         h.output().shapes.iter().any(|shape| matches!(&shape.shape,
@@ -94,12 +94,12 @@ fn dock_tab_traversal_and_enter_change_the_visible_panel_without_editing() {
         "the focused dock tab needs a visible focus outline"
     );
     key(&mut h, Key::Space, Modifiers::NONE);
-    assert!(matches!(h.state().ui.dock, DockNode::Tabs { active: 1, .. }));
+    assert!(matches!(h.state().ui.dock.root, Some(craft_ui::docking::Node::Tabs { active: 1, .. })));
     assert_eq!(h.state().ui.focused, PanelKind::Effects);
     key(&mut h, Key::Tab, Modifiers::SHIFT);
     assert_eq!(h.ctx.memory(|m| m.focused()), Some(first));
     key(&mut h, Key::Enter, Modifiers::NONE);
-    assert!(matches!(h.state().ui.dock, DockNode::Tabs { active: 0, .. }));
+    assert!(matches!(h.state().ui.dock.root, Some(craft_ui::docking::Node::Tabs { active: 0, .. })));
     assert_eq!(h.state().ui.focused, PanelKind::Project);
     assert!(Arc::ptr_eq(&h.state().session.project, &project));
     assert_eq!(h.state().session.state.playheads, playheads);
diff --git a/crates/ui-egui/tests/unlink_ui.rs b/crates/ui-egui/tests/it/unlink_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/unlink_ui.rs
rename to crates/ui-egui/tests/it/unlink_ui.rs
diff --git a/crates/ui-egui/tests/view_ui.rs b/crates/ui-egui/tests/it/view_ui.rs
similarity index 82%
rename from crates/ui-egui/tests/view_ui.rs
rename to crates/ui-egui/tests/it/view_ui.rs
index 1bfeda836..d9bc75664 100644
--- a/crates/ui-egui/tests/view_ui.rs
+++ b/crates/ui-egui/tests/it/view_ui.rs
@@ -192,6 +192,132 @@ fn view_menu_resolutions_and_display_modes() {
     assert_eq!((s["display"].as_str(), s["show_rulers"].as_bool()), (Some("Composite"), Some(true)));
 }
 
+/// The filled rectangles and the mesh vertex colors painted this frame inside `area`.
+fn fills_in(d: &Driver, area: egui::Rect) -> (Vec<(egui::Rect, egui::Color32)>, Vec<egui::Color32>) {
+    fn walk(s: &egui::Shape, area: egui::Rect, rects: &mut Vec<(egui::Rect, egui::Color32)>, verts: &mut Vec<egui::Color32>) {
+        match s {
+            egui::Shape::Rect(r) if area.expand(0.5).contains_rect(r.rect) => rects.push((r.rect, r.fill)),
+            egui::Shape::Mesh(m) => verts.extend(m.vertices.iter().filter(|v| area.expand(0.5).contains(v.pos)).map(|v| v.color)),
+            egui::Shape::Vec(v) => v.iter().for_each(|s| walk(s, area, rects, verts)),
+            _ => {}
+        }
+    }
+    let (mut rects, mut verts) = (Vec::new(), Vec::new());
+    d.harness.output().shapes.iter().for_each(|c| walk(&c.shape, area, &mut rects, &mut verts));
+    (rects, verts)
+}
+
+/// The wrench menu's Transparency Grid paints a gray and white checkerboard behind
+/// the picture instead of the monitor background; each monitor keeps its own setting.
+#[test]
+fn transparency_grid_paints_a_checkerboard_behind_the_picture() {
+    use filmcraft_ui_egui::frames::Target;
+    use filmcraft_ui_egui::panels::monitor_view::{GRID_DARK, GRID_LIGHT};
+    let mut d = Driver::demo();
+    // the check mark of the wrench menu item
+    let checked = |d: &mut Driver| filmcraft_ui_egui::panels::monitor_view::checked(d.harness.state(), "view.transparencyGrid");
+    let menu = d.ok("ui.menu.list", json!({}));
+    assert!(menu.as_array().unwrap().iter().all(|m| m["id"] != "view.transparencyGrid"), "not in the View menu");
+    assert_eq!(d.program()["transparency_grid"], false, "off by default");
+    assert_eq!(checked(&mut d), Some(false));
+    let r = d.rect("program.picture");
+    let pic = egui::Rect::from_min_size(egui::pos2(r[0] as f32, r[1] as f32), egui::vec2(r[2] as f32, r[3] as f32));
+    let covers = |rects: &[(egui::Rect, egui::Color32)]| {
+        rects.iter().any(|(r, c)| *c == GRID_LIGHT && (r.min - pic.min).length() < 1.0 && (r.max - pic.max).length() < 1.0)
+    };
+    let (rects, verts) = fills_in(&d, pic);
+    assert!(!covers(&rects) && !verts.contains(&GRID_DARK), "no grid while it is off");
+
+    d.click("program.settings");
+    assert!(d.try_rect("program.settings.transparencyGrid").is_some(), "the wrench menu lists Transparency Grid");
+    d.click("program.settings.transparencyGrid");
+    d.frames(2);
+    assert_eq!(d.program()["transparency_grid"], true);
+    assert_eq!(checked(&mut d), Some(true));
+    let (rects, verts) = fills_in(&d, pic);
+    assert!(covers(&rects), "the light squares fill the picture");
+    let dark = verts.iter().filter(|c| **c == GRID_DARK).count();
+    assert!(dark >= 4 * 100, "the dark squares are drawn: {dark} vertices");
+    // the Program picture is rendered live (render previews are flattened over black)
+    let live = |d: &Driver| matches!(d.harness.state().program_picture().map(|k| k.target), Some(Target::SequenceLive(_)));
+    for _ in 0..600 {
+        if live(&d) {
+            break;
+        }
+        d.frames(1);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(live(&d), "the Program monitor shows a live render: {:?}", d.harness.state().program_picture());
+    assert_eq!(d.ok("ui.inspect", json!({}))["ui"]["source"]["transparency_grid"], false, "the Source monitor keeps its own setting");
+
+    // Comparison View: the reference frame has the grid behind it too
+    d.menu("view.display.comparison");
+    d.frames(3);
+    let r = d.rect("program.compare.reference");
+    let reference = egui::Rect::from_min_size(egui::pos2(r[0] as f32, r[1] as f32), egui::vec2(r[2] as f32, r[3] as f32));
+    let (rects, _) = fills_in(&d, reference);
+    assert!(
+        rects.iter().any(|(r, c)| *c == GRID_LIGHT && (r.min - reference.min).length() < 1.0 && (r.max - reference.max).length() < 1.0),
+        "the light squares fill the reference frame"
+    );
+    d.menu("view.display.composite");
+    d.frames(2);
+
+    d.ok("ui.menu.invoke", json!({"id": "view.transparencyGrid", "params": {"monitor": "source", "enabled": true}}));
+    assert_eq!(d.ok("ui.inspect", json!({}))["ui"]["source"]["transparency_grid"], true);
+    assert_eq!(d.program()["transparency_grid"], true);
+
+    // a Transparent Video in the Source monitor: the frame keeps its alpha and goes up as the
+    // grid's texture, so the grid shows through it
+    let item = d.exec("file.newTransparentVideo", json!({}))["item"].as_u64().expect("new item");
+    d.exec("source.open", json!({"item": item}));
+    let mut key = None;
+    for _ in 0..600 {
+        d.frames(1);
+        key = d.harness.state().texture_key("monitor-source-grid");
+        if key.is_some() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let key = key.expect("the Source monitor shows its frame through the grid");
+    let frame = d.harness.state().frames.get(&key).expect("the shown frame is cached");
+    assert!(!frame.px.is_empty() && frame.px.as_chunks::<4>().0.iter().all(|p| p[3] == 0), "the frame keeps its alpha");
+
+    d.ok("ui.menu.invoke", json!({"id": "view.transparencyGrid", "params": {"monitor": "program"}}));
+    d.frames(2);
+    assert_eq!(d.program()["transparency_grid"], false);
+    let (rects, verts) = fills_in(&d, pic);
+    assert!(!covers(&rects) && !verts.contains(&GRID_DARK), "the grid goes when it is turned off");
+}
+
+/// Display Mode ▸ Alpha shows a live render of the sequence (render previews are opaque); Red
+/// keeps the usual frames.
+#[test]
+fn alpha_display_mode_shows_a_live_render() {
+    use filmcraft_ui_egui::frames::Target;
+    let shown_live = |d: &mut Driver, live: bool| {
+        let is = |d: &Driver| match d.harness.state().program_picture().map(|k| k.target) {
+            Some(Target::SequenceLive(_)) => live,
+            Some(Target::Sequence(_)) => !live,
+            _ => false,
+        };
+        for _ in 0..600 {
+            if is(d) {
+                break;
+            }
+            d.frames(1);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(is(d), "live render {live}: {:?}", d.harness.state().program_picture());
+    };
+    let mut d = Driver::demo();
+    d.menu("view.display.alpha");
+    shown_live(&mut d, true);
+    d.menu("view.display.red");
+    shown_live(&mut d, false);
+}
+
 fn num(v: &Value) -> f64 {
     v.as_f64().unwrap_or_else(|| panic!("not a number: {v}"))
 }
diff --git a/crates/ui-egui/tests/voiceover_ui.rs b/crates/ui-egui/tests/it/voiceover_ui.rs
similarity index 100%
rename from crates/ui-egui/tests/voiceover_ui.rs
rename to crates/ui-egui/tests/it/voiceover_ui.rs
diff --git a/crates/ui-egui/tests/workspaces_ui.rs b/crates/ui-egui/tests/it/workspaces_ui.rs
similarity index 99%
rename from crates/ui-egui/tests/workspaces_ui.rs
rename to crates/ui-egui/tests/it/workspaces_ui.rs
index a5e4d8d9a..16d554037 100644
--- a/crates/ui-egui/tests/workspaces_ui.rs
+++ b/crates/ui-egui/tests/it/workspaces_ui.rs
@@ -106,7 +106,7 @@ impl Driver {
     }
 
     fn shows(&mut self, p: PanelKind) -> bool {
-        self.app().ui.dock.contains(p)
+        self.app().ui.dock.contains(&p)
     }
 
     /// Window ▸ Workspaces as (label, checked) in menu order.
diff --git a/crates/ui-egui/tests/shared_docking_ui.rs b/crates/ui-egui/tests/shared_docking_ui.rs
deleted file mode 100644
index 3df87b903..000000000
--- a/crates/ui-egui/tests/shared_docking_ui.rs
+++ /dev/null
@@ -1,561 +0,0 @@
-//! Shared docking preserves FilmCraft document state and legacy workspace files.
-
-use craft_ui::docking::{Action, Placement, Zone};
-use egui::{Event, Modifiers, PointerButton, Rect, pos2, vec2};
-use egui_kittest::Harness;
-use egui_kittest::kittest::{NodeT, Queryable};
-use filmcraft_engine::Session;
-use filmcraft_ui_egui::{
-    FilmcraftApp,
-    dock::{self, DockNode, Layout, PanelKind, SplitSize},
-    menus,
-};
-use serde_json::json;
-
-fn layout() -> Layout {
-    Layout {
-        root: DockNode::Split {
-            vertical: false,
-            size: SplitSize::FixedA(400.0),
-            a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Info, PanelKind::History], active: 1 }),
-            b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Source, PanelKind::Program], active: 1 }),
-        },
-        floating: vec![],
-    }
-}
-
-#[test]
-fn shared_transactions_keep_selection_and_reject_invalid_moves_atomically() {
-    let mut layout = layout();
-    layout.apply(Action::Close { panel: PanelKind::Project }).unwrap();
-    assert!(layout.root.is_visible(PanelKind::Info));
-    let before = layout.clone();
-    for action in [
-        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Tools, placement: Placement::Split(Zone::Left) },
-        Action::Float { panel: PanelKind::Info, rect: [0.0, 0.0, f32::NAN, 100.0] },
-        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Program, placement: Placement::Tab { before: Some(PanelKind::Tools) } },
-    ] {
-        assert!(layout.apply(action).is_err());
-        assert_eq!(layout, before);
-    }
-    layout.apply(Action::Float { panel: PanelKind::Info, rect: [50.0, 50.0, 400.0, 300.0] }).unwrap();
-    layout.apply(Action::Move { panel: PanelKind::Info, anchor: PanelKind::Program, placement: Placement::Split(Zone::Bottom) }).unwrap();
-    assert!(layout.floating.is_empty());
-    assert!(layout.root.is_visible(PanelKind::Info));
-}
-
-#[test]
-fn builtin_and_legacy_workspace_shapes_roundtrip_and_save_floating() {
-    for name in dock::WORKSPACES {
-        let root = dock::workspace(name);
-        let before = serde_json::to_value(&root).unwrap();
-        let prefs: dock::WorkspacePrefs = serde_json::from_value(json!({"saved": [{"name": name, "layout": before}], "current": name})).unwrap();
-        let loaded = dock::saved_docking(&prefs, name);
-        loaded.validate().unwrap();
-        assert_eq!(loaded.root, root);
-        assert!(loaded.floating.is_empty());
-        assert!(serde_json::to_value(&prefs).unwrap()["saved"][0].get("floating").is_none());
-    }
-    let dir = std::env::temp_dir().join(format!("filmcraft-shared-dock-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let mut session = Session::default();
-    session.prefs_path = Some(dir.join("preferences.json"));
-    let mut app = FilmcraftApp::new(session);
-    let ctx = egui::Context::default();
-    app.ui.dock = layout().root;
-    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Info", "rect": [45, 65, 420, 320]})).unwrap();
-    menus::invoke(&mut app, &ctx, "window.workspace.saveAs", json!({"name": "Floating test"})).unwrap();
-    let prefs = dock::WorkspacePrefs::load(&dir.join(dock::WORKSPACES_FILE));
-    let restored = dock::saved_docking(&prefs, "Floating test");
-    assert_eq!(restored.floating, app.ui.floating);
-    assert_eq!(restored.root, app.ui.dock);
-    let mut restarted_session = Session::default();
-    restarted_session.prefs_path = Some(dir.join("preferences.json"));
-    let restarted = FilmcraftApp::new(restarted_session);
-    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| restarted);
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    assert_eq!(h.state().ui.dock, restored.root);
-    assert_eq!(h.state().ui.floating, restored.floating);
-    std::fs::remove_dir_all(dir).unwrap();
-}
-
-#[test]
-fn legacy_effects_workspace_drops_only_the_known_inactive_duplicate() {
-    let expected = dock::workspace("Effects");
-    let mut legacy = expected.clone();
-    fn duplicate(node: &mut DockNode) {
-        match node {
-            DockNode::Tabs { panels, active } if panels.as_slice() == [PanelKind::EssentialGraphics] => {
-                panels.insert(0, PanelKind::EffectControls);
-                *active = 1;
-            }
-            DockNode::Split { a, b, .. } => {
-                duplicate(a);
-                duplicate(b);
-            }
-            DockNode::Tabs { .. } => {}
-        }
-    }
-    duplicate(&mut legacy);
-    let prefs: dock::WorkspacePrefs =
-        serde_json::from_value(json!({"saved": [{"name": "Historical Effects", "layout": legacy}], "current": "Historical Effects"})).unwrap();
-    assert_eq!(dock::saved_docking(&prefs, "Historical Effects").root, expected);
-}
-
-fn step(h: &mut Harness<'_, FilmcraftApp>) {
-    let ctx = h.ctx.clone();
-    let mut input = std::mem::take(h.input_mut());
-    eframe::App::raw_input_hook(h.state_mut(), &ctx, &mut input);
-    *h.input_mut() = input;
-    h.step();
-}
-fn rect(h: &Harness<'_, FilmcraftApp>, id: &str) -> Rect {
-    let element = h.state().auto.find(id).unwrap_or_else(|| panic!("missing {id}"));
-    Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3]))
-}
-fn click(h: &mut Harness<'_, FilmcraftApp>, id: &str) {
-    let pos = rect(h, id).center();
-    h.event(Event::PointerMoved(pos));
-    step(h);
-    for pressed in [true, false] {
-        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
-        step(h);
-    }
-    for _ in 0..3 {
-        step(h);
-    }
-}
-fn drag(h: &mut Harness<'_, FilmcraftApp>, from: egui::Pos2, to: egui::Pos2, modifiers: Modifiers) {
-    h.event(Event::ModifiersChanged(modifiers));
-    h.event(Event::PointerMoved(from));
-    step(h);
-    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
-    step(h);
-    for fraction in [0.05, 0.25, 0.5, 0.75, 1.0] {
-        h.event(Event::PointerMoved(from.lerp(to, fraction)));
-        step(h);
-    }
-    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
-    step(h);
-    h.event(Event::ModifiersChanged(Modifiers::NONE));
-    for _ in 0..3 {
-        step(h);
-    }
-}
-
-#[test]
-fn real_panel_drag_merges_splits_floats_and_redocks_without_editing_documents() {
-    let mut session = Session::default();
-    session.execute("file.openDemoProject", json!({})).unwrap();
-    let app = FilmcraftApp::new(session);
-    let snapshots = std::env::var_os("CRAFT_UI_DOCKING_SNAPSHOT_DIR").map(std::path::PathBuf::from);
-    let mut builder = Harness::builder().with_size(vec2(1200.0, 760.0));
-    if snapshots.is_some() {
-        builder = builder.wgpu();
-    }
-    let mut h = builder.build_eframe(move |_| app);
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    h.state_mut().ui.dock = DockNode::Split {
-        vertical: true,
-        size: SplitSize::Ratio(0.62),
-        a: Box::new(layout().root),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
-    };
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    let project = h.state().session.project.clone();
-    let mut action_log = vec![action_state(&h, "start")];
-    let playheads = h.state().session.state.playheads.clone();
-    let from = rect(&h, "panel.tab.Info").center();
-    let to = rect(&h, "panel.Program").center();
-    drag(&mut h, from, to, Modifiers::NONE);
-    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
-    assert!(same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Program));
-    action_log.push(action_state(&h, "merged"));
-    let from = rect(&h, "panel.tab.Info").center();
-    let before = rect(&h, "panel.tab.Source");
-    drag(&mut h, from, pos2(before.left() + 2.0, before.center().y), Modifiers::NONE);
-    assert_eq!(tabs_containing(&h.state().ui.dock, PanelKind::Info).first(), Some(&PanelKind::Info));
-    action_log.push(action_state(&h, "reordered"));
-
-    let from = rect(&h, "panel.tab.Info").center();
-    let left = rect(&h, "panel.History");
-    // Activate a visible sibling after the source left its original group.
-    let to = pos2(left.left() + 8.0, left.center().y);
-    drag(&mut h, from, to, Modifiers::NONE);
-    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
-    assert!(!same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::History));
-    assert!(!same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Program));
-    action_log.push(action_state(&h, "split"));
-    click(&mut h, "panel.tab.Program");
-    assert!(h.state().auto.elements.iter().any(|element| element.id.starts_with("timeline.clip.")));
-    assert!(h.state().auto.find("program.transport.playhead.stepForward").is_some());
-    let from = rect(&h, "panel.tab.Info").center();
-    drag(&mut h, from, pos2(700.0, 400.0), Modifiers::COMMAND);
-    assert_eq!(h.state().ui.floating.len(), 1);
-    assert_eq!(h.get_by_label("Resize floating panel").accesskit_node().role(), egui::accesskit::Role::Button);
-    action_log.push(action_state(&h, "floated"));
-    let original = h.state().ui.floating[0].rect;
-    let grip = rect(&h, "panel.float.0.resize").center();
-    drag(&mut h, grip, grip + vec2(36.0, 24.0), Modifiers::NONE);
-    assert!(h.state().ui.floating[0].rect[2] > original[2] + 25.0);
-    assert!(h.state().ui.floating[0].rect[3] > original[3] + 15.0);
-    action_log.push(action_state(&h, "resized"));
-    let grip_id = egui::Id::new(("floating-panel", PanelKind::Info.id())).with("resize");
-    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
-    let before_keys = h.state().ui.floating[0].rect;
-    for key in [egui::Key::ArrowRight, egui::Key::ArrowDown] {
-        for pressed in [true, false] {
-            h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
-            step(&mut h);
-        }
-    }
-    assert_eq!(h.state().ui.floating[0].rect[2], before_keys[2] + 8.0);
-    assert_eq!(h.state().ui.floating[0].rect[3], before_keys[3] + 8.0);
-    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    step(&mut h);
-    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    assert_ne!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
-    action_log.push(action_state(&h, "keyboard-resized"));
-    let resized = h.state().ui.floating[0].rect;
-    let header = rect(&h, "panel.float.0.move");
-    let from = pos2(header.right() - 24.0, header.center().y);
-    drag(&mut h, from, from - vec2(24.0, 18.0), Modifiers::NONE);
-    assert!(h.state().ui.floating[0].rect[0] < resized[0] - 15.0);
-    assert!(h.state().ui.floating[0].rect[1] < resized[1] - 10.0);
-    action_log.push(action_state(&h, "moved"));
-    let saved_root = h.state().ui.dock.clone();
-    let saved_floating = h.state().ui.floating.clone();
-    let ctx = h.ctx.clone();
-    menus::invoke(h.state_mut(), &ctx, "window.maximizeFrame", json!({})).unwrap();
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    assert!(rect(&h, "panel.Info").width() > 1000.0);
-    action_log.push(action_state(&h, "maximized"));
-    assert_eq!(h.state().ui.dock, saved_root);
-    assert_eq!(h.state().ui.floating, saved_floating);
-    menus::invoke(h.state_mut(), &ctx, "window.maximizeFrame", json!({})).unwrap();
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    assert_eq!(h.state().ui.floating, saved_floating);
-
-    if let Some(directory) = &snapshots {
-        std::fs::create_dir_all(directory).unwrap();
-        h.render().unwrap().save(directory.join("filmcraft-floating.png")).unwrap();
-    }
-    let from = rect(&h, "panel.tab.Info").center();
-    let to = rect(&h, "panel.History").center();
-    drag(&mut h, from, to, Modifiers::NONE);
-    assert!(h.state().ui.floating.is_empty());
-    action_log.push(action_state(&h, "redocked"));
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-    assert_eq!(playheads, h.state().session.state.playheads);
-    let playhead = h.state().session.playhead();
-    click(&mut h, "program.transport.playhead.stepForward");
-    assert!(h.state().session.playhead() > playhead);
-    assert!(h.state().auto.elements.iter().any(|element| element.id.starts_with("timeline.clip.")));
-    action_log.push(action_state(&h, "program-step-forward"));
-    if let Some(directory) = &snapshots {
-        std::fs::write(directory.join("filmcraft-actions.json"), serde_json::to_vec_pretty(&action_log).unwrap()).unwrap();
-    }
-    if let Some(directory) = &snapshots {
-        h.render().unwrap().save(directory.join("filmcraft-redocked.png")).unwrap();
-    }
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-    assert!(h.state().ui_error.is_none());
-}
-
-#[test]
-fn dropping_on_the_window_edge_docks_beside_the_whole_workspace() {
-    let mut app = FilmcraftApp::new(Session::default());
-    app.ui.dock = layout().root;
-    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    let from = rect(&h, "panel.tab.Info").center();
-    let leftmost = rect(&h, "panel.Info");
-    // The outer edge of the leftmost group: without the window-edge zone this splits only that group.
-    drag(&mut h, from, pos2(leftmost.left() + 2.0, leftmost.center().y), Modifiers::NONE);
-    assert_eq!(
-        h.state().ui.dock,
-        DockNode::Split {
-            vertical: false,
-            size: SplitSize::Ratio(0.25),
-            a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Info], active: 0 }),
-            b: Box::new(DockNode::Split {
-                vertical: false,
-                size: SplitSize::FixedA(400.0),
-                a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::History], active: 1 }),
-                b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Source, PanelKind::Program], active: 1 }),
-            }),
-        }
-    );
-}
-
-#[test]
-fn dock_panel_without_anchor_docks_along_a_workspace_edge() {
-    let mut app = FilmcraftApp::new(Session::default());
-    app.ui.dock = layout().root;
-    let ctx = egui::Context::default();
-    menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Program", "zone": "bottom"})).unwrap();
-    let DockNode::Split { vertical: true, size: SplitSize::Ratio(ratio), a, b } = &app.ui.dock else { panic!("root not split: {:?}", app.ui.dock) };
-    assert_eq!(*ratio, 0.75);
-    assert_eq!(**b, DockNode::Tabs { panels: vec![PanelKind::Program], active: 0 });
-    assert!(!a.contains(PanelKind::Program) && a.contains(PanelKind::Source) && a.contains(PanelKind::Info));
-    let before = app.ui.dock.clone();
-    assert!(menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Info", "zone": "center"})).is_err());
-    assert_eq!(app.ui.dock, before);
-    app.ui.dock = DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 };
-    assert!(menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Project", "zone": "left"})).is_err());
-    assert_eq!(app.ui.dock, DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 });
-}
-
-fn same_group(root: &DockNode, first: PanelKind, second: PanelKind) -> bool {
-    match root {
-        DockNode::Tabs { panels, .. } => panels.contains(&first) && panels.contains(&second),
-        DockNode::Split { a, b, .. } => same_group(a, first, second) || same_group(b, first, second),
-    }
-}
-
-fn tabs_containing(root: &DockNode, panel: PanelKind) -> Vec<PanelKind> {
-    match root {
-        DockNode::Tabs { panels, .. } if panels.contains(&panel) => panels.clone(),
-        DockNode::Split { a, b, .. } => {
-            let first = tabs_containing(a, panel);
-            if first.is_empty() { tabs_containing(b, panel) } else { first }
-        }
-        _ => vec![],
-    }
-}
-
-#[test]
-fn docking_commands_reject_bad_geometry_and_targets_without_partial_changes() {
-    let mut app = FilmcraftApp::new(Session::default());
-    app.ui.dock = layout().root;
-    let ctx = egui::Context::default();
-    let before = app.ui.dock.clone();
-    for (id, params) in [
-        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 300]})),
-        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 300, 200, 7]})),
-        ("window.floatPanel", json!({"panel": "Info", "rect": [1, 2, 1e100, 200]})),
-        ("window.dockPanel", json!({"panel": "Info", "anchor": "Tools"})),
-        ("window.dockPanel", json!({"panel": "Info", "anchor": "Program", "zone": 42})),
-        ("window.dockPanel", json!({"panel": "Info", "anchor": "Program", "before": "Tools"})),
-    ] {
-        assert!(menus::invoke(&mut app, &ctx, id, params.clone()).is_err(), "{id} accepted {params}");
-        assert_eq!(app.ui.dock, before);
-        assert!(app.ui.floating.is_empty());
-    }
-    app.ui.dock = DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 };
-    assert!(menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Project", "rect": [1, 2, 300, 200]})).is_err());
-}
-
-fn action_state(h: &Harness<'_, FilmcraftApp>, action: &str) -> serde_json::Value {
-    json!({"action": action, "dock": h.state().ui.dock, "floating": h.state().ui.floating, "focused": h.state().ui.focused})
-}
-
-#[test]
-fn catalog_docking_action_supports_resize_reorder_and_floating_geometry() {
-    let mut app = FilmcraftApp::new(Session::default());
-    app.ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(300.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Info], active: 1 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Program], active: 0 }),
-    };
-    let ctx = egui::Context::default();
-    for action in [
-        Action::ResizeSplit { path: vec![], size: craft_ui::layout::SplitSize::FixedFirst(360.0) },
-        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Project, placement: Placement::Tab { before: Some(PanelKind::Project) } },
-        Action::Float { panel: PanelKind::Info, rect: [20.0, 40.0, 300.0, 200.0] },
-        Action::MoveFloating { panel: PanelKind::Info, rect: [45.0, 65.0, 330.0, 240.0] },
-    ] {
-        filmcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.dockAction", json!({"action": action})).unwrap();
-    }
-    assert_eq!(app.ui.floating[0].rect, [45.0, 65.0, 330.0, 240.0]);
-    let DockNode::Split { size, .. } = &app.ui.dock else { panic!("split lost") };
-    assert_eq!(*size, SplitSize::FixedA(360.0));
-    let before = json!({"dock": app.ui.dock, "floating": app.ui.floating});
-    assert!(
-        filmcraft_ui_egui::menus::invoke(
-            &mut app,
-            &ctx,
-            "window.dockAction",
-            json!({"action": {
-                "ResizeSplit": {"path": [true, true], "size": {"Ratio": 0.5}}
-            }})
-        )
-        .is_err()
-    );
-    assert_eq!(json!({"dock": app.ui.dock, "floating": app.ui.floating}), before);
-}
-
-#[test]
-fn unreadable_floating_workspace_does_not_erase_valid_workspaces_or_current_name() {
-    let root = DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 };
-    let valid = json!({"name": "Valid", "layout": root, "floating": [{
-        "panels": ["TextToSpeech", "Timeline"], "active": 0, "rect": [80, 90, 420, 320]
-    }]});
-    for (index, bad) in [
-        json!([{"panels": ["FuturePanel"], "active": 0, "rect": [80, 90, 420, 320]}]),
-        json!([{"panels": ["Info"], "active": "invalid", "rect": [80, 90, 420, 320]}]),
-        json!({"malformed": true}),
-    ]
-    .into_iter()
-    .enumerate()
-    {
-        let path = std::env::temp_dir().join(format!("filmcraft-floating-isolation-{}-{index}.json", std::process::id()));
-        let prefs = json!({"saved": [valid.clone(), {"name": "Broken", "layout": root, "floating": bad}], "current": "Valid"});
-        std::fs::write(&path, serde_json::to_vec(&prefs).unwrap()).unwrap();
-        let loaded = dock::WorkspacePrefs::load(&path);
-        assert_eq!(loaded.current, "Valid");
-        assert_eq!(loaded.saved.len(), 2);
-        let restored = dock::saved_docking(&loaded, "Valid");
-        restored.validate().unwrap();
-        assert_eq!(restored.root, root);
-        assert_eq!(restored.floating[0].panels, vec![PanelKind::TextToSpeech, PanelKind::Timeline]);
-        assert_eq!(dock::saved_docking(&loaded, "Broken").root, dock::workspace("Broken"));
-        loaded.save(&path).unwrap();
-        assert_eq!(dock::WorkspacePrefs::load(&path), loaded, "saving preserves the unreadable entry for a future version");
-        std::fs::remove_file(path).unwrap();
-    }
-}
-
-#[test]
-fn floating_tts_and_timeline_reveal_keeps_one_owner_and_draft_without_project_edits() {
-    let mut session = Session::default();
-    session.execute("file.openDemoProject", json!({})).unwrap();
-    let mut app = FilmcraftApp::new(session);
-    app.ui.tts.text = "Synthetic retained narration".into();
-    app.show_panel(PanelKind::TextToSpeech);
-    let project = app.session.project.clone();
-    let state = serde_json::to_value(&app.session.state).unwrap();
-    let draft = serde_json::to_value(&app.ui.tts).unwrap();
-    let ctx = egui::Context::default();
-    menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "TextToSpeech", "rect": [80, 90, 420, 320]})).unwrap();
-    menus::invoke(
-        &mut app,
-        &ctx,
-        "window.dockAction",
-        json!({"action": Action::Move {
-            panel: PanelKind::Timeline, anchor: PanelKind::TextToSpeech, placement: Placement::Tab { before: None }
-        }}),
-    )
-    .unwrap();
-    app.show_panel(PanelKind::TextToSpeech);
-    app.show_panel(PanelKind::Timeline);
-    assert!(!app.ui.dock.contains(PanelKind::TextToSpeech));
-    assert!(!app.ui.dock.contains(PanelKind::Timeline));
-    assert_eq!(app.ui.floating.iter().flat_map(|group| &group.panels).filter(|panel| **panel == PanelKind::TextToSpeech).count(), 1);
-    assert_eq!(app.ui.floating.iter().flat_map(|group| &group.panels).filter(|panel| **panel == PanelKind::Timeline).count(), 1);
-    assert_eq!(serde_json::to_value(&app.ui.tts).unwrap(), draft);
-    assert!(std::sync::Arc::ptr_eq(&project, &app.session.project));
-    assert_eq!(serde_json::to_value(&app.session.state).unwrap(), state);
-}
-
-#[test]
-fn narration_selection_reveals_covered_floating_tts_once_without_editing_the_project() {
-    let mut session = Session::default();
-    session.execute("file.openDemoProject", json!({})).unwrap();
-    let clip = session
-        .active_sequence()
-        .unwrap()
-        .audio_tracks
-        .iter()
-        .flat_map(|track| &track.items)
-        .find(|clip| {
-            session.project.item(clip.item).and_then(|item| item.as_media()).is_some_and(|media| media.info.kind == filmcraft_media::MediaKind::AudioOnly)
-        })
-        .unwrap()
-        .clone();
-    let narration = filmcraft_project::Narration {
-        text: "Synthetic narration behind an overlapping pane".into(),
-        language: "en-US".into(),
-        voice: filmcraft_tts::default_voice_id().into(),
-        pitch: filmcraft_project::VocalPitch::Default,
-        pace: 1.2,
-        speech_duration: filmcraft_time::Tick::ZERO,
-    };
-    std::sync::Arc::make_mut(&mut session.project).narrations.insert(clip.item, narration.clone());
-    let project = session.project.clone();
-    let mut app = FilmcraftApp::new(session);
-    app.show_panel(PanelKind::TextToSpeech);
-    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    let ctx = h.ctx.clone();
-    for panel in ["TextToSpeech", "Info"] {
-        menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": panel, "rect": [400, 220, 450, 360]})).unwrap();
-        for _ in 0..4 {
-            step(&mut h);
-        }
-    }
-    let layer = |panel: PanelKind| egui::LayerId::new(egui::Order::Middle, egui::Id::new(("floating-panel", panel.id())));
-    let covered = rect(&h, "panel.TextToSpeech").center();
-    assert!(rect(&h, "panel.Info").contains(covered));
-    ctx.move_to_top(layer(PanelKind::Info));
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    assert_eq!(ctx.layer_id_at(covered), Some(layer(PanelKind::Info)), "precondition: Info really covers TTS");
-    h.state_mut().session.state.selection = vec![clip.id];
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    let draft = h.state().ui.tts.clone();
-    assert_eq!(draft.text, narration.text);
-    assert_eq!(draft.pace, narration.pace);
-    assert_eq!(draft.loaded_from, Some((clip.id.0, clip.item.0)));
-    assert_eq!(ctx.layer_id_at(covered), Some(layer(PanelKind::TextToSpeech)), "narration selection must bring its floating editor forward");
-    assert_eq!(h.state().ui.focused, PanelKind::TextToSpeech);
-    assert!(!h.state().ui.dock.contains(PanelKind::TextToSpeech));
-    assert_eq!(h.state().ui.floating.iter().flat_map(|group| &group.panels).filter(|panel| **panel == PanelKind::TextToSpeech).count(), 1);
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-    // A reveal is one-shot: drawing the selected narration must not steal stacking
-    // from another pane that the user subsequently brings forward.
-    ctx.move_to_top(layer(PanelKind::Info));
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    assert_eq!(ctx.layer_id_at(covered), Some(layer(PanelKind::Info)));
-    assert_eq!(h.state().ui.tts, draft);
-    menus::invoke(h.state_mut(), &ctx, "window.panel.TextToSpeech", json!({})).unwrap();
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    assert_eq!(ctx.layer_id_at(covered), Some(layer(PanelKind::TextToSpeech)));
-    assert_eq!(h.state().ui.tts, draft);
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-    // Replacing the workspace cancels a queued reveal before the next render,
-    // even when the destination happens to contain the same floating panel IDs.
-    ctx.move_to_top(layer(PanelKind::Info));
-    for _ in 0..3 {
-        step(&mut h);
-    }
-    let saved = dock::SavedWorkspace {
-        name: "Reveal cancellation".into(),
-        layout: serde_json::to_value(&h.state().ui.dock).unwrap(),
-        floating: serde_json::to_value(&h.state().ui.floating).unwrap(),
-    };
-    h.state_mut().workspaces.saved.push(saved);
-    h.state_mut().show_panel(PanelKind::TextToSpeech);
-    h.state_mut().set_workspace("Reveal cancellation");
-    for _ in 0..4 {
-        step(&mut h);
-    }
-    assert_eq!(ctx.layer_id_at(covered), Some(layer(PanelKind::Info)));
-    assert_eq!(h.state().ui.tts, draft);
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-}
diff --git a/crates/ui-egui/tests/ui_dock_resize.rs b/crates/ui-egui/tests/ui_dock_resize.rs
deleted file mode 100644
index 2057ce262..000000000
--- a/crates/ui-egui/tests/ui_dock_resize.rs
+++ /dev/null
@@ -1,139 +0,0 @@
-//! Shared pane resizing in the full application, including application shortcut ownership.
-
-use egui::{Event, Id, Key, Modifiers, PointerButton, Rect, pos2, vec2};
-use egui_kittest::Harness;
-use filmcraft_engine::Session;
-use filmcraft_ui_egui::FilmcraftApp;
-use filmcraft_ui_egui::dock::{DockNode, PanelKind, SplitSize};
-use filmcraft_ui_egui::theme::ThemeKind;
-use serde_json::json;
-
-fn step(h: &mut Harness<'_, FilmcraftApp>) {
-    h.step();
-    assert!(h.state().ui_error.is_none(), "the app caught a UI panic: {:?}", h.state().ui_error);
-}
-
-fn frames(h: &mut Harness<'_, FilmcraftApp>, count: usize) {
-    for _ in 0..count {
-        step(h);
-    }
-}
-
-fn snapshots(h: &mut Harness<'_, FilmcraftApp>, directory: Option<&std::path::Path>, phase: &str) {
-    let Some(directory) = directory else { return };
-    std::fs::create_dir_all(directory).unwrap();
-    for (name, theme) in [("dark", ThemeKind::Dark), ("medium", ThemeKind::Medium), ("light", ThemeKind::Light)] {
-        let ctx = h.ctx.clone();
-        h.state_mut().set_theme(&ctx, theme);
-        frames(h, 3);
-        h.render().unwrap().save(directory.join(format!("filmcraft-{phase}-{name}.png"))).unwrap();
-    }
-    let ctx = h.ctx.clone();
-    h.state_mut().set_theme(&ctx, ThemeKind::Dark);
-    frames(h, 3);
-}
-
-fn first_size(h: &Harness<'_, FilmcraftApp>) -> f32 {
-    match h.state().ui.dock {
-        DockNode::Split { size: SplitSize::FixedA(value), .. } => value,
-        ref other => panic!("fixed-size mode changed: {other:?}"),
-    }
-}
-
-#[test]
-fn focused_dock_resize_owns_arrows_and_keeps_pointer_dragging() {
-    let mut session = Session::default();
-    session.execute("file.openDemoProject", json!({})).unwrap();
-    let app = FilmcraftApp::new(session);
-    // Opt in to GPU snapshots while the ordinary test remains headless and renderer-independent.
-    let directory = std::env::var_os("CRAFT_UI_PANES_SNAPSHOT_DIR").map(std::path::PathBuf::from);
-    let mut builder = Harness::builder().with_size(vec2(1400.0, 900.0)).with_max_steps(10_000);
-    if directory.is_some() {
-        builder = builder.wgpu();
-    }
-    let mut h = builder.build_eframe(move |_| app);
-    frames(&mut h, 4);
-    snapshots(&mut h, directory.as_deref(), "workspace");
-    h.state_mut().ui.focused = PanelKind::Timeline;
-    h.state_mut().ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(400.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
-    };
-    frames(&mut h, 3);
-    let before_project = h.state().session.project.clone();
-    let before_playheads = h.state().session.state.playheads.clone();
-    let id = Id::new(("dock-gutter", String::new()));
-    h.ctx.memory_mut(|memory| memory.request_focus(id));
-    frames(&mut h, 2);
-    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(id));
-    snapshots(&mut h, directory.as_deref(), "focused-resize");
-    h.event(Event::Key { key: Key::ArrowRight, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    step(&mut h);
-    h.event(Event::Key { key: Key::ArrowRight, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-    step(&mut h);
-    assert_eq!(first_size(&h), 408.0);
-    assert_eq!(h.state().session.state.playheads, before_playheads, "the Timeline shortcut must not seek");
-    assert!(std::sync::Arc::ptr_eq(&h.state().session.project, &before_project));
-
-    frames(&mut h, 2);
-    let element = h.state().auto.find("dock.gutter.").unwrap();
-    let from = Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3])).center();
-    h.event(Event::PointerMoved(from));
-    step(&mut h);
-    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    step(&mut h);
-    for offset in [5.0, 10.0, 15.0, 20.0] {
-        h.event(Event::PointerMoved(from + vec2(offset, 0.0)));
-        step(&mut h);
-    }
-    h.event(Event::PointerButton { pos: from + vec2(20.0, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    step(&mut h);
-    assert_eq!(first_size(&h), 428.0);
-    assert_eq!(h.state().session.state.playheads, before_playheads);
-}
-
-fn press(h: &mut Harness<'_, FilmcraftApp>, key: Key) {
-    for pressed in [true, false] {
-        h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
-        step(h);
-    }
-    frames(h, 2);
-}
-
-#[test]
-fn space_plays_after_a_pane_is_resized_with_the_pointer() {
-    let mut session = Session::default();
-    session.execute("file.openDemoProject", json!({})).unwrap();
-    let app = FilmcraftApp::new(session);
-    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
-    frames(&mut h, 4);
-    h.state_mut().ui.focused = PanelKind::Timeline;
-    h.state_mut().ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(400.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
-    };
-    frames(&mut h, 3);
-    let element = h.state().auto.find("dock.gutter.").unwrap();
-    let from = Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3])).center();
-    h.event(Event::PointerMoved(from));
-    step(&mut h);
-    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    step(&mut h);
-    for offset in [5.0, 10.0, 15.0, 20.0] {
-        h.event(Event::PointerMoved(from + vec2(offset, 0.0)));
-        step(&mut h);
-    }
-    h.event(Event::PointerButton { pos: from + vec2(20.0, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    frames(&mut h, 3);
-    assert_eq!(first_size(&h), 420.0);
-    // The divider keeps keyboard focus so arrows can nudge it; that must not cost the editor its shortcuts.
-    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(Id::new(("dock-gutter", String::new()))));
-    press(&mut h, Key::Space);
-    assert!(h.state().playback.playing, "Space must start playback after resizing a pane (#1482)");
-    press(&mut h, Key::Space);
-    assert!(!h.state().playback.playing);
-}
diff --git a/crates/vp8/Cargo.toml b/crates/vp8/Cargo.toml
index 52f274907..8089708d3 100644
--- a/crates/vp8/Cargo.toml
+++ b/crates/vp8/Cargo.toml
@@ -11,3 +11,6 @@ workspace = true
 
 [dependencies]
 thiserror = { workspace = true }
+
+[dev-dependencies]
+filmcraft-testkit = { workspace = true }
diff --git a/crates/vp8/README.md b/crates/vp8/README.md
index affb7ff34..5b855a21f 100644
--- a/crates/vp8/README.md
+++ b/crates/vp8/README.md
@@ -28,8 +28,8 @@ test oracles.
 
 Bit-exact with libvpx on the 62 libvpx VP8 test vectors checked (`vp80-00-comprehensive-001` to
 `018` and the `vp80-01` to `vp80-06` intra, inter, segmentation, partition, sharpness and small
-size vectors; `tests/vectors.rs` checks them when they are present) and on the generated fixtures
-of `tests/conformance.rs`.
+size vectors; `tests/it/vectors.rs` checks them when they are present) and on the generated fixtures
+of `tests/it/conformance.rs`.
 
 ## API
 
diff --git a/crates/vp8/examples/fuzz.rs b/crates/vp8/examples/fuzz.rs
index 5929cd640..3a81a7518 100644
--- a/crates/vp8/examples/fuzz.rs
+++ b/crates/vp8/examples/fuzz.rs
@@ -90,7 +90,7 @@ fn main() {
                 Ok(n) => decoded += n,
                 Err(e) => {
                     panics += 1;
-                    let msg = e.downcast_ref::<String>().cloned().or_else(|| e.downcast_ref::<&str>().map(|s| s.to_string())).unwrap_or_default();
+                    let msg = e.downcast_ref::<String>().cloned().or_else(|| e.downcast_ref::<&str>().map(ToString::to_string)).unwrap_or_default();
                     eprintln!("PANIC {path} iteration {it} mode {mode}: {msg}");
                 }
             }
diff --git a/crates/vp8/src/decoder.rs b/crates/vp8/src/decoder.rs
index 0c030c740..b20a89ed5 100644
--- a/crates/vp8/src/decoder.rs
+++ b/crates/vp8/src/decoder.rs
@@ -9,12 +9,22 @@ use crate::error::{Error, Result, ensure};
 use crate::header::{EntropyContext, FrameHeader, FrameTag, LfDeltas, Segmentation, read_header};
 use crate::loopfilter::{self, Kind, Params};
 use crate::predict::{self, RefPlane};
-use crate::spec_tables::*;
-use crate::tables::*;
+use crate::spec_tables::{
+    AC_QLOOKUP, BILINEAR_FILTERS, BMODE_PROBS, COEFF_BANDS, DC_QLOOKUP, KF_BMODE_PROBS, KF_UV_MODE_PROBS, KF_YMODE_PROBS, MODE_CONTEXTS, MVPARTITION_PROBS,
+    SIXTAP_FILTERS, SUB_MV_REF_PROBS,
+};
+use crate::tables::{
+    ABOVE_4X4, B_DC_PRED, B_HE_PRED, B_PRED, B_TM_PRED, B_VE_PRED, BMODE_TREE, CAT_BASE, COEFF_TREE, DC_PRED, DCT_0, DCT_4, DCT_CAT1, DCT_EOB, H_PRED,
+    KF_YMODE_TREE, LEFT_4X4, MV_NEAR, MV_NEAREST, MV_NEW, MV_REF_TREE, MV_SPLIT, MV_ZERO, MVP_BITS, MVP_IS_SHORT, MVP_SHORT, MVP_SIGN, MVPARTITION_TREE, PCAT,
+    SEGMENT_TREE, SMALL_MV_TREE, SPLIT_COUNTS, SPLIT_MAPS, SUB_MV_REF_TREE, TM_PRED, UV_MODE_TREE, V_PRED, YMODE_TREE, ZERO_4X4, ZIGZAG,
+};
 use crate::transform;
 
 /// Largest frame dimension in macroblocks (14-bit sizes).
 const MAX_MBS: usize = 16384 / 16 + 1;
+/// Maximum padded luma samples retained by one VP8 reference picture (about 8K UHD).
+/// 2^26 luma samples: 8192x8192, above every VP8 frame a camera or encoder writes (8192x4320 is 35M).
+const MAX_LUMA_SAMPLES: usize = 1 << 26;
 
 /// A reconstructed frame: planes sized to whole macroblocks.
 #[derive(Clone)]
@@ -162,14 +172,18 @@ impl Decoder {
     /// (`show_frame`), `None` for a hidden frame (an altref).
     pub fn decode(&mut self, data: &[u8], pts: i64) -> Result<Option<Picture>> {
         let tag = FrameTag::parse(data)?;
+        ensure!(tag.first_part_size > 0, "empty first partition");
         if tag.key_frame {
             ensure!(tag.width > 0 && tag.height > 0, "key frame of size {}x{}", tag.width, tag.height);
             let (w, h) = (usize::from(tag.width), usize::from(tag.height));
+            let (mb_w, mb_h) = (w.div_ceil(16), h.div_ceil(16));
+            let samples = mb_w.checked_mul(16).and_then(|w| w.checked_mul(mb_h)).and_then(|h| h.checked_mul(16));
+            ensure!(samples.is_some_and(|n| n <= MAX_LUMA_SAMPLES), "frame size {}x{} exceeds the decoder memory limit", tag.width, tag.height);
             if w != self.width || h != self.height {
                 self.width = w;
                 self.height = h;
-                self.mb_w = w.div_ceil(16);
-                self.mb_h = h.div_ceil(16);
+                self.mb_w = mb_w;
+                self.mb_h = mb_h;
                 self.seg_map = vec![0; self.mb_w * self.mb_h];
             }
             // key frame defaults (9.3, 9.4, 9.7, 13.4, 16.1, 17.2)
@@ -373,7 +387,7 @@ impl Decoder {
                     predict::predict_block(&mut frame.u, cs, px / 2, py / 2, 8, uv_mode);
                     predict::predict_block(&mut frame.v, cs, px / 2, py / 2, 8, uv_mode);
                 } else {
-                    let Some(r) = refs.get(usize::from(info.ref_frame) - 1).and_then(|r| r.as_deref()) else {
+                    let Some(r) = refs.get(usize::from(info.ref_frame) - 1).and_then(Option::as_deref) else {
                         return Err(Error::MissingReference(format!("reference frame {}", info.ref_frame)));
                     };
                     predict_inter_mb(r, &mut frame, mb_x, mb_y, &info, filters, full_pixel);
diff --git a/crates/vp8/src/header.rs b/crates/vp8/src/header.rs
index 880e46d68..9c38c5fdb 100644
--- a/crates/vp8/src/header.rs
+++ b/crates/vp8/src/header.rs
@@ -89,7 +89,7 @@ pub struct EntropyContext {
 
 impl Default for EntropyContext {
     fn default() -> Self {
-        use crate::spec_tables::*;
+        use crate::spec_tables::{DEFAULT_COEFF_PROBS, DEFAULT_MV_PROBS, UV_MODE_PROBS, YMODE_PROBS};
         let mut coeff = [[[[0u8; 11]; 3]; 8]; 4];
         for (i, p) in coeff.iter_mut().flatten().flatten().flatten().enumerate() {
             *p = DEFAULT_COEFF_PROBS[i];
diff --git a/crates/vp8/src/predict.rs b/crates/vp8/src/predict.rs
index 88ba0eefc..411eecc68 100644
--- a/crates/vp8/src/predict.rs
+++ b/crates/vp8/src/predict.rs
@@ -6,7 +6,7 @@
 //! row and 129 below it). Inter prediction reads a reference plane extended infinitely by
 //! repeating its edge pixels.
 
-use crate::tables::*;
+use crate::tables::{B_HD_PRED, B_HE_PRED, B_HU_PRED, B_LD_PRED, B_RD_PRED, B_TM_PRED, B_VE_PRED, B_VL_PRED, B_VR_PRED, H_PRED, TM_PRED, V_PRED};
 
 /// A pixel of the current frame for intra prediction, with the out-of-frame values of section 12.
 #[inline]
diff --git a/crates/vp8/tests/fuzz_hostile.rs b/crates/vp8/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..e72e61bc7
--- /dev/null
+++ b/crates/vp8/tests/fuzz_hostile.rs
@@ -0,0 +1,158 @@
+//! Hostile-input robustness: truncation, header-region sweeps and random mutation of small
+//! ffmpeg-generated VP8 streams (frame by frame) must never panic or run away. Skips without ffmpeg.
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use filmcraft_vp8::Decoder;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+/// (name, encoder args, pix_fmt)
+const SEEDS: &[(&str, &str, &str)] = &[
+    ("vp8_fz_default", "-c:v libvpx -g 4 -b:v 300k", "yuv420p"),
+    ("vp8_fz_partitions", "-c:v libvpx -g 6 -b:v 300k -slices 8 -auto-alt-ref 0 -lag-in-frames 0 -error-resilient 1", "yuv420p"),
+];
+
+fn ivf_frames(data: &[u8]) -> Vec<Vec<u8>> {
+    let mut out = Vec::new();
+    let Some(h) = data.get(6..8) else { return out };
+    let mut pos = usize::from(u16::from_le_bytes([h[0], h[1]]));
+    while let Some(hd) = data.get(pos..pos + 12) {
+        let size = u32::from_le_bytes([hd[0], hd[1], hd[2], hd[3]]) as usize;
+        pos += 12;
+        let end = pos.saturating_add(size).min(data.len());
+        out.push(data[pos..end].to_vec());
+        pos = end;
+    }
+    out
+}
+
+fn make(ff: &std::path::Path, name: &str, args: &str, pix: &str) -> Option<Vec<Vec<u8>>> {
+    let out = filmcraft_testkit::fixtures_dir("vp8").join(format!("{name}.ivf"));
+    let p = filmcraft_testkit::fixtures::generate(&out, |tmp| {
+        let a: Vec<&str> = args.split_whitespace().collect();
+        matches!(
+            Command::new(ff)
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=25", "-frames:v", "6", "-pix_fmt", pix])
+                .args(a)
+                .args(["-f", "ivf"])
+                .arg(tmp)
+                .stdin(Stdio::null())
+                .status(),
+            Ok(s) if s.success()
+        )
+    })?;
+    Some(ivf_frames(&std::fs::read(p).ok()?))
+}
+
+static PANICS: AtomicUsize = AtomicUsize::new(0);
+
+/// Decoder worker threads may catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(frames: &[Vec<u8>], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for _ in 0..1 {
+            let mut dec = Decoder::new();
+            for (i, f) in frames.iter().enumerate() {
+                let _ = dec.decode(f, i as i64);
+            }
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(Ordering::SeqCst) == before, "panic: {label}");
+}
+
+/// Random-mutation rounds per seed (raise with FILMCRAFT_FUZZ_ITERS for a long hunt).
+fn iters() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()).unwrap_or(300)
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("VP8 fuzz") else { return };
+    for &(name, args, pix) in SEEDS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, "libvpx") {
+            filmcraft_testkit::skip("VP8 fuzz", &format!("this ffmpeg has no libvpx encoder (seed {name})"));
+            continue;
+        }
+        let Some(seed) = make(&ff, name, args, pix) else {
+            panic!("ffmpeg has libvpx but could not encode the {name} seed");
+        };
+        if seed.is_empty() {
+            filmcraft_testkit::skip("VP8 fuzz", &format!("the {name} seed has no frames"));
+            continue;
+        }
+        // truncate each of the first frames at every length
+        for fi in 0..seed.len().min(3) {
+            let len = seed[fi].len();
+            for n in (0..len).step_by((len / 200).max(1)) {
+                let mut d = seed.clone();
+                d[fi].truncate(n);
+                run_all(&d, &format!("{name} frame {fi} truncate {n}"));
+            }
+        }
+        // header region of every frame: every byte to a few values, every bit
+        for fi in 0..seed.len() {
+            for p in 0..seed[fi].len().min(96) {
+                for v in [0u8, 0xff, 0x80, 0x01, 0x7f] {
+                    let mut d = seed.clone();
+                    d[fi][p] = v;
+                    run_all(&d, &format!("{name} frame {fi} byte {p}={v:#x}"));
+                }
+                for b in 0..8 {
+                    let mut d = seed.clone();
+                    d[fi][p] ^= 1 << b;
+                    run_all(&d, &format!("{name} frame {fi} flip {p}.{b}"));
+                }
+            }
+        }
+        let mut rng = Rng(0x9e3779b97f4a7c15 ^ name.len() as u64);
+        for i in 0..iters() {
+            let mut d = seed.clone();
+            for _ in 0..1 + rng.below(6) {
+                let fi = rng.below(d.len());
+                if d[fi].is_empty() {
+                    continue;
+                }
+                let p = rng.below(d[fi].len());
+                if rng.below(2) == 0 {
+                    d[fi][p] ^= 1 << rng.below(8);
+                } else {
+                    d[fi][p] = rng.next() as u8;
+                }
+            }
+            run_all(&d, &format!("{name} random {i}"));
+        }
+    }
+}
diff --git a/crates/vp8/tests/common/mod.rs b/crates/vp8/tests/it/common/mod.rs
similarity index 94%
rename from crates/vp8/tests/common/mod.rs
rename to crates/vp8/tests/it/common/mod.rs
index cc42e8e88..15416b864 100644
--- a/crates/vp8/tests/common/mod.rs
+++ b/crates/vp8/tests/it/common/mod.rs
@@ -108,15 +108,17 @@ pub fn run(cmd: &mut Command) -> bool {
 /// Generate (if needed) the fixture stream and its reference decode by libvpx through ffmpeg.
 /// `None` (the test skips) without ffmpeg or its libvpx encoder.
 pub fn ensure(f: &Fixture) -> Option<(PathBuf, PathBuf)> {
-    // one generation at a time: tests share fixtures, and realtime libvpx encodes differ from run
-    // to run, so a stream and its reference decode must come from the same encode
-    static GENERATING: std::sync::Mutex<()> = std::sync::Mutex::new(());
-    let _guard = GENERATING.lock().unwrap_or_else(|e| e.into_inner());
     let Some(ff) = ffmpeg() else {
         eprintln!("SKIP {}: ffmpeg not found", f.name);
         return None;
     };
     let dir = fixtures_dir();
+    // one generation at a time, across test processes too: tests share fixtures, and realtime
+    // libvpx encodes differ from run to run, so a stream and its reference decode must come from
+    // the same encode
+    // a lock failure is a broken environment, not a missing tool: fail rather than skip
+    let lock = std::fs::File::create(dir.join("vp8.generate.lock")).expect("create the fixture lock file");
+    lock.lock().expect("lock the fixture lock file");
     let ivf = dir.join(format!("{}.ivf", f.name));
     let yuv = dir.join(format!("{}.yuv", f.name));
     if !ivf.exists() {
diff --git a/crates/vp8/tests/conformance.rs b/crates/vp8/tests/it/conformance.rs
similarity index 99%
rename from crates/vp8/tests/conformance.rs
rename to crates/vp8/tests/it/conformance.rs
index 27c7b92aa..3f120877f 100644
--- a/crates/vp8/tests/conformance.rs
+++ b/crates/vp8/tests/it/conformance.rs
@@ -1,7 +1,7 @@
 //! Bit-exactness against libvpx (through ffmpeg) on generated fixtures covering every coding
 //! tool: skipped when ffmpeg or its libvpx encoder is absent.
 
-mod common;
+use crate::common;
 
 fn check(name: &str) {
     let f = common::fixture(name);
diff --git a/crates/vp8/tests/it/main.rs b/crates/vp8/tests/it/main.rs
new file mode 100644
index 000000000..ffc58b90c
--- /dev/null
+++ b/crates/vp8/tests/it/main.rs
@@ -0,0 +1,4 @@
+mod common;
+mod conformance;
+mod robustness;
+mod vectors;
diff --git a/crates/vp8/tests/robustness.rs b/crates/vp8/tests/it/robustness.rs
similarity index 86%
rename from crates/vp8/tests/robustness.rs
rename to crates/vp8/tests/it/robustness.rs
index 7dfc4f897..0c5081402 100644
--- a/crates/vp8/tests/robustness.rs
+++ b/crates/vp8/tests/it/robustness.rs
@@ -1,6 +1,6 @@
 //! Damaged, truncated, reordered and random input must never panic (errors are fine).
 
-mod common;
+use crate::common;
 
 use filmcraft_vp8::{Decoder, Error};
 
@@ -78,7 +78,15 @@ fn random_bytes_and_tiny_frames_do_not_panic() {
     key[3..6].copy_from_slice(&[0x9d, 0x01, 0x2a]);
     key[6..8].copy_from_slice(&1920u16.to_le_bytes());
     key[8..10].copy_from_slice(&1080u16.to_le_bytes());
-    let _ = dec.decode(&key, 0);
+    assert!(dec.decode(&key, 0).is_err(), "empty first partition must not reconstruct a frame");
+
+    // A header can declare nearly 16K square dimensions with just ten bytes. It must be rejected
+    // before the macroblock map and reference planes are allocated.
+    key[0] = 0x30; // one-byte first partition
+    key[10] = 0;
+    key[6..8].copy_from_slice(&16_383u16.to_le_bytes());
+    key[8..10].copy_from_slice(&16_383u16.to_le_bytes());
+    assert!(dec.decode(&key, 0).is_err(), "oversized key frame must be rejected");
 }
 
 #[test]
diff --git a/crates/vp8/tests/vectors.rs b/crates/vp8/tests/it/vectors.rs
similarity index 99%
rename from crates/vp8/tests/vectors.rs
rename to crates/vp8/tests/it/vectors.rs
index 789a40f56..d992c1926 100644
--- a/crates/vp8/tests/vectors.rs
+++ b/crates/vp8/tests/it/vectors.rs
@@ -3,7 +3,7 @@
 //! downloaded by the tests; fetch them from
 //! `https://storage.googleapis.com/downloads.webmproject.org/test_data/libvpx/<name>`.
 
-mod common;
+use crate::common;
 
 /// MD5 (RFC 1321), for comparing with the vectors' checksums.
 fn md5(data: &[u8]) -> String {
diff --git a/crates/vp8/tools/extract_tables.py b/crates/vp8/tools/extract_tables.py
index 5f7710e93..2daaf87e4 100644
--- a/crates/vp8/tools/extract_tables.py
+++ b/crates/vp8/tools/extract_tables.py
@@ -11,8 +11,18 @@ emitted flat (row-major, as printed) with its element count checked against the
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read()
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read()
 cut = text.find("\n20.  Attachment One")
 if cut < 0:
     sys.exit("section 20 not found")
diff --git a/crates/vp9/Cargo.toml b/crates/vp9/Cargo.toml
index 5e9fd06e3..c8aef8ca3 100644
--- a/crates/vp9/Cargo.toml
+++ b/crates/vp9/Cargo.toml
@@ -19,3 +19,4 @@ thiserror = { workspace = true }
 rayon = { workspace = true, optional = true }
 
 [dev-dependencies]
+filmcraft-testkit = { workspace = true }
diff --git a/crates/vp9/README.md b/crates/vp9/README.md
index aea3a7781..765eb4b0c 100644
--- a/crates/vp9/README.md
+++ b/crates/vp9/README.md
@@ -115,16 +115,16 @@ draft mode.
 - Draft mode (`draft_mode_changes_only_flagged_non_reference_frames`): on a two-layer temporal
   scalability stream, single- and frame-threaded, every unflagged frame is bit-exact and only
   flagged frames differ.
-- Conformance (`tests/conformance.rs`): the fixture matrix below plus a stream concatenating two
+- Conformance (`tests/it/conformance.rs`): the fixture matrix below plus a stream concatenating two
   sizes. `compare_detects_mismatch` guards the harness. `coverage_report` (ignored) prints the
   decoder statistics for each fixture.
-- Synthetic (`tests/synthetic.rs`): headers of libvpx output are rewritten to produce what ffmpeg's
+- Synthetic (`tests/it/synthetic.rs`): headers of libvpx output are rewritten to produce what ffmpeg's
   libvpx wrapper cannot: inter frames of a stream encoded at another size spliced after a 352x288
   key frame with explicit frame sizes, i.e. **scaled reference prediction** (downscale 256x208,
   upscale 480x400, odd 301x199; a same-size splice is the control); a key frame rewritten as a
   hidden **intra-only frame** (reset_frame_context 3 / 2 / 0, various refresh masks) shown with
   **show_existing_frame**; show_existing_frame of every slot, also inside a superframe.
-- Robustness (`tests/robustness.rs`): bit flips, byte replacement and truncation of real streams,
+- Robustness (`tests/it/robustness.rs`): bit flips, byte replacement and truncation of real streams,
   truncated frames, random data and oversized frames never panic (debug and release) or hang,
   single- and multi-threaded.
 
@@ -158,7 +158,7 @@ Backward adaptation is on (`-frame-parallel 0`) unless noted.
 
 ## Performance
 
-`cargo test --release -p filmcraft-vp9 --test perf -- --ignored --nocapture` (bit-exactness is
+`cargo test --release -p filmcraft-vp9 --test it perf:: -- --ignored --nocapture` (bit-exactness is
 verified first), or `VP9_THREADS=n VP9_LOOPS=k cargo run --release -p filmcraft-vp9 --example
 vp9dec -- in.ivf` (decodes the file k times and prints the statistics; `VP9_DRAFT=1` for draft
 mode).
diff --git a/crates/vp9/src/decoder.rs b/crates/vp9/src/decoder.rs
index af1f969c7..619d1b5c2 100644
--- a/crates/vp9/src/decoder.rs
+++ b/crates/vp9/src/decoder.rs
@@ -15,6 +15,10 @@ use std::collections::VecDeque;
 use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::sync::{Arc, Condvar, Mutex, MutexGuard, RwLock};
 
+/// Maximum luma samples accepted for one decoded reference frame: 8192x8192, above level 6.2's
+/// 8192x4352 (35 651 584 samples).
+const MAX_LUMA_SAMPLES: u64 = 1 << 26;
+
 /// Counters describing what the decoder has seen (useful to check test coverage).
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct DecodeStats {
@@ -257,6 +261,12 @@ impl Decoder {
             return Ok(());
         }
         ensure!(h.width <= 16384 && h.height <= 16384, "frame size {}x{} too large", h.width, h.height);
+        ensure!(
+            u64::from(h.width).checked_mul(u64::from(h.height)).is_some_and(|n| n <= MAX_LUMA_SAMPLES),
+            "frame size {}x{} exceeds the decoder memory limit",
+            h.width,
+            h.height
+        );
         let (mi_rows, mi_cols) = (h.mi_rows as usize, h.mi_cols as usize);
         // compute_image_size semantics (7.2.6).
         let size = (h.width, h.height);
@@ -279,6 +289,7 @@ impl Decoder {
         let off = h.uncompressed_size;
         let hs = h.header_size_in_bytes as usize;
         ensure!(off + hs <= data.len(), "compressed header exceeds frame data");
+        ensure!(off + hs < data.len(), "frame has no tile data");
         let mut fc = self.st.contexts[h.frame_context_idx as usize].clone();
         parse_compressed(&data[off..off + hs], &mut h, &mut fc)?;
         self.count_frame(&h);
@@ -341,6 +352,7 @@ impl Decoder {
                     ensure!(s <= data.len() - pos, "tile size {s} beyond frame data");
                     s
                 };
+                ensure!(sz > 0, "empty tile payload");
                 td.push(&data[pos..pos + sz]);
                 pos += sz;
             }
diff --git a/crates/vp9/tests/fuzz_hostile.rs b/crates/vp9/tests/fuzz_hostile.rs
new file mode 100644
index 000000000..a04227331
--- /dev/null
+++ b/crates/vp9/tests/fuzz_hostile.rs
@@ -0,0 +1,221 @@
+//! Hostile-input robustness: truncation, header-region sweeps and random mutation of small
+//! ffmpeg-generated VP9 streams (frame by frame) must never panic or run away. Skips without ffmpeg.
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use filmcraft_vp9::Decoder;
+
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+/// (name, encoder args, pix_fmt)
+const SEEDS: &[(&str, &str, &str)] = &[
+    ("vp9_fz_default", "-c:v libvpx-vp9 -g 4 -b:v 300k -lag-in-frames 0", "yuv420p"),
+    // libvpx needs 256 px per tile column, so two columns need 512 px
+    ("vp9_fz_2tiles_10bit", "-c:v libvpx-vp9 -g 6 -b:v 300k -lag-in-frames 0 -tile-columns 1 -profile:v 2 -s 512x48", "yuv420p10le"),
+    ("vp9_fz_444", "-c:v libvpx-vp9 -g 6 -b:v 300k -lag-in-frames 0 -profile:v 1", "yuv444p"),
+    ("vp9_fz_altref", "-c:v libvpx-vp9 -g 6 -b:v 300k -auto-alt-ref 1 -lag-in-frames 5", "yuv420p"),
+];
+
+fn ivf_frames(data: &[u8]) -> Vec<Vec<u8>> {
+    let mut out = Vec::new();
+    let Some(h) = data.get(6..8) else { return out };
+    let mut pos = usize::from(u16::from_le_bytes([h[0], h[1]]));
+    while let Some(hd) = data.get(pos..pos + 12) {
+        let size = u32::from_le_bytes([hd[0], hd[1], hd[2], hd[3]]) as usize;
+        pos += 12;
+        let end = pos.saturating_add(size).min(data.len());
+        out.push(data[pos..end].to_vec());
+        pos = end;
+    }
+    out
+}
+
+fn make(ff: &std::path::Path, name: &str, args: &str, pix: &str) -> Option<Vec<Vec<u8>>> {
+    let out = filmcraft_testkit::fixtures_dir("vp9").join(format!("{name}.ivf"));
+    let p = filmcraft_testkit::fixtures::generate(&out, |tmp| {
+        let a: Vec<&str> = args.split_whitespace().collect();
+        matches!(
+            Command::new(ff)
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=25", "-frames:v", "6", "-pix_fmt", pix])
+                .args(a)
+                .args(["-f", "ivf"])
+                .arg(tmp)
+                .stdin(Stdio::null())
+                .status(),
+            Ok(s) if s.success()
+        )
+    })?;
+    Some(ivf_frames(&std::fs::read(p).ok()?))
+}
+
+static PANICS: AtomicUsize = AtomicUsize::new(0);
+
+/// Decoder worker threads may catch panics and turn them into errors; count them so they still fail the test.
+fn count_panics() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        std::panic::set_hook(Box::new(|info| {
+            PANICS.fetch_add(1, Ordering::SeqCst);
+            eprintln!("PANIC: {info}");
+        }));
+    });
+}
+
+fn run_all(frames: &[Vec<u8>], label: &str) {
+    filmcraft_testkit::set_progress(label);
+    count_panics();
+    let before = PANICS.load(Ordering::SeqCst);
+    let res = catch_unwind(AssertUnwindSafe(|| {
+        for threads in [1, 3] {
+            let mut dec = Decoder::with_threads(threads);
+            for (i, f) in frames.iter().enumerate() {
+                let _ = dec.decode(f, i as i64);
+            }
+            let _ = dec.flush();
+        }
+    }));
+    assert!(res.is_ok() && PANICS.load(Ordering::SeqCst) == before, "panic: {label}");
+}
+
+const VALUES: [u8; 5] = [0, 0xff, 0x80, 0x01, 0x7f];
+
+/// How much of the sweep runs. `FILMCRAFT_FUZZ_ITERS=N` runs all of it (about 200 truncation
+/// points spread over each of the first three frames, every header byte, overwrite value and
+/// bit flip) plus N random rounds per seed: 300 is the full depth, more hunts longer. Unset, CI
+/// runs a third of the truncation points and of the full depth's random rounds and, for each
+/// header byte of each frame, one value and one bit, shifted by the frame index. A rotation
+/// offset shifts which share runs (`FILMCRAFT_FUZZ_SEED`, else the UTC day number), so every
+/// case of the full sweep runs within a few days, and a random round's mutations match the same
+/// round of a full run.
+struct Depth {
+    full: bool,
+    truncations: usize,
+    rounds: usize,
+    rotation: usize,
+}
+
+impl Depth {
+    fn from_env() -> Self {
+        match std::env::var("FILMCRAFT_FUZZ_ITERS").ok().and_then(|s| s.parse().ok()) {
+            Some(rounds) => Depth { full: true, truncations: 200, rounds, rotation: 0 },
+            None => {
+                let rotation = rotation();
+                eprintln!("fuzz subset rotation {rotation} (FILMCRAFT_FUZZ_SEED={rotation} replays it; FILMCRAFT_FUZZ_ITERS=300 runs everything)");
+                Depth { full: false, truncations: 200, rounds: 300, rotation }
+            }
+        }
+    }
+    /// Truncation lengths for a `len`-byte input: every point of the full sweep, or every third one.
+    fn truncations(&self, len: usize) -> std::iter::StepBy<std::ops::Range<usize>> {
+        let stride = (len / self.truncations).max(1);
+        let (start, step) = if self.full { (0, stride) } else { ((self.rotation % 3) * stride, 3 * stride) };
+        (start..len).step_by(step)
+    }
+    fn value(&self, fi: usize, p: usize, i: usize) -> bool {
+        self.full || i == (p + fi + self.rotation % VALUES.len()) % VALUES.len()
+    }
+    fn bit(&self, fi: usize, p: usize, b: usize) -> bool {
+        self.full || b == (p + fi + self.rotation % 8) % 8
+    }
+    fn round(&self, i: usize) -> bool {
+        self.full || i % 3 == self.rotation % 3
+    }
+}
+
+/// The default subset's rotation offset: `FILMCRAFT_FUZZ_SEED`, else days since the Unix epoch (UTC).
+fn rotation() -> usize {
+    std::env::var("FILMCRAFT_FUZZ_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or_else(|| {
+        let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        usize::try_from(secs / 86_400).unwrap_or(0)
+    })
+}
+
+/// Seconds the whole sweep may take before it counts as a hang (override: FILMCRAFT_HOSTILE_TIMEOUT_SECS).
+const DEADLINE_SECS: u64 = 600;
+
+/// CI runs a rotating share of every part of the sweep; `FILMCRAFT_FUZZ_ITERS=300` runs all of it (see [`Depth`]).
+#[test]
+fn hostile_streams_never_panic() {
+    filmcraft_testkit::with_deadline(DEADLINE_SECS, sweep);
+}
+
+fn sweep() {
+    let Some(ff) = filmcraft_testkit::ffmpeg_or_skip("VP9 fuzz") else { return };
+    let depth = Depth::from_env();
+    for &(name, args, pix) in SEEDS {
+        if !filmcraft_testkit::ffmpeg_has_encoder(&ff, "libvpx-vp9") {
+            filmcraft_testkit::skip("VP9 fuzz", &format!("this ffmpeg has no libvpx-vp9 encoder (seed {name})"));
+            continue;
+        }
+        let Some(seed) = make(&ff, name, args, pix) else {
+            panic!("ffmpeg has libvpx-vp9 but could not encode the {name} seed");
+        };
+        if seed.is_empty() {
+            filmcraft_testkit::skip("VP9 fuzz", &format!("the {name} seed has no frames"));
+            continue;
+        }
+        // truncate each of the first frames at every length
+        for fi in 0..seed.len().min(3) {
+            let len = seed[fi].len();
+            for n in depth.truncations(len) {
+                let mut d = seed.clone();
+                d[fi].truncate(n);
+                run_all(&d, &format!("{name} frame {fi} truncate {n}"));
+            }
+        }
+        // header region of every frame: every byte to a few values, every bit
+        for fi in 0..seed.len() {
+            for p in 0..seed[fi].len().min(96) {
+                for (i, v) in VALUES.into_iter().enumerate() {
+                    if !depth.value(fi, p, i) {
+                        continue;
+                    }
+                    let mut d = seed.clone();
+                    d[fi][p] = v;
+                    run_all(&d, &format!("{name} frame {fi} byte {p}={v:#x}"));
+                }
+                for b in 0..8 {
+                    if !depth.bit(fi, p, b) {
+                        continue;
+                    }
+                    let mut d = seed.clone();
+                    d[fi][p] ^= 1 << b;
+                    run_all(&d, &format!("{name} frame {fi} flip {p}.{b}"));
+                }
+            }
+        }
+        let mut rng = Rng(0x9e3779b97f4a7c15 ^ name.len() as u64);
+        // Skipped rounds still draw their mutations, so round i matches round i of a full run.
+        for i in 0..depth.rounds {
+            let mut d = seed.clone();
+            for _ in 0..1 + rng.below(6) {
+                let fi = rng.below(d.len());
+                if d[fi].is_empty() {
+                    continue;
+                }
+                let p = rng.below(d[fi].len());
+                if rng.below(2) == 0 {
+                    d[fi][p] ^= 1 << rng.below(8);
+                } else {
+                    d[fi][p] = rng.next() as u8;
+                }
+            }
+            if depth.round(i) {
+                run_all(&d, &format!("{name} random {i}"));
+            }
+        }
+    }
+}
diff --git a/crates/vp9/tests/common/mod.rs b/crates/vp9/tests/it/common/mod.rs
similarity index 100%
rename from crates/vp9/tests/common/mod.rs
rename to crates/vp9/tests/it/common/mod.rs
diff --git a/crates/vp9/tests/conformance.rs b/crates/vp9/tests/it/conformance.rs
similarity index 99%
rename from crates/vp9/tests/conformance.rs
rename to crates/vp9/tests/it/conformance.rs
index ceb875e0b..58a7e21ad 100644
--- a/crates/vp9/tests/conformance.rs
+++ b/crates/vp9/tests/it/conformance.rs
@@ -1,7 +1,7 @@
 //! Bit-exactness against ffmpeg's VP9 decoder on libvpx-vp9 fixtures (skipped when ffmpeg or
 //! libvpx is absent).
 
-mod common;
+use crate::common;
 
 macro_rules! fixture_tests {
     ($($name:ident),* $(,)?) => {
diff --git a/crates/vp9/tests/it/main.rs b/crates/vp9/tests/it/main.rs
new file mode 100644
index 000000000..c26f9adcf
--- /dev/null
+++ b/crates/vp9/tests/it/main.rs
@@ -0,0 +1,5 @@
+mod common;
+mod conformance;
+mod perf;
+mod robustness;
+mod synthetic;
diff --git a/crates/vp9/tests/perf.rs b/crates/vp9/tests/it/perf.rs
similarity index 92%
rename from crates/vp9/tests/perf.rs
rename to crates/vp9/tests/it/perf.rs
index 162392ba1..ad427ea1a 100644
--- a/crates/vp9/tests/perf.rs
+++ b/crates/vp9/tests/it/perf.rs
@@ -1,7 +1,7 @@
 //! Decode speed (ignored by default; run with
-//! `cargo test --release -p filmcraft-vp9 --test perf -- --ignored --nocapture`).
+//! `cargo test --release -p filmcraft-vp9 --test it perf:: -- --ignored --nocapture`).
 
-mod common;
+use crate::common;
 
 use filmcraft_vp9::Decoder;
 use std::time::Instant;
diff --git a/crates/vp9/tests/robustness.rs b/crates/vp9/tests/it/robustness.rs
similarity index 99%
rename from crates/vp9/tests/robustness.rs
rename to crates/vp9/tests/it/robustness.rs
index be63331d9..80db3d0fb 100644
--- a/crates/vp9/tests/robustness.rs
+++ b/crates/vp9/tests/it/robustness.rs
@@ -1,6 +1,6 @@
 //! Damaged, truncated and random input must never panic or hang (errors are fine).
 
-mod common;
+use crate::common;
 
 use filmcraft_vp9::Decoder;
 use std::time::{Duration, Instant};
diff --git a/crates/vp9/tests/synthetic.rs b/crates/vp9/tests/it/synthetic.rs
similarity index 96%
rename from crates/vp9/tests/synthetic.rs
rename to crates/vp9/tests/it/synthetic.rs
index a01c7a1b8..64094f800 100644
--- a/crates/vp9/tests/synthetic.rs
+++ b/crates/vp9/tests/it/synthetic.rs
@@ -7,7 +7,7 @@
 //!   show_existing_frame;
 //! - show_existing_frame of hidden alt-ref frames and of arbitrary slots.
 
-mod common;
+use crate::common;
 
 use std::path::Path;
 
@@ -236,10 +236,15 @@ fn encode(name: &str, w: u32, h: u32, frames: u32, extra: &[&str]) -> Option<Vec
         c.arg(format!("testsrc2=size={w}x{h}:rate=25,noise=alls=8:allf=t+u"));
         c.args(["-frames:v", &frames.to_string(), "-c:v", "libvpx-vp9", "-b:v", "500k", "-frame-parallel", "0"]);
         c.args(extra);
-        c.args(["-f", "ivf"]).arg(&path);
+        // written aside and renamed: a test in another process may be reading this fixture
+        let tmp = path.with_extension(format!("tmp.{}.ivf", common::unique()));
+        c.args(["-f", "ivf"]).arg(&tmp);
         if !common::run(&mut c) {
             return None;
         }
+        if std::fs::rename(&tmp, &path).is_err() && !path.exists() {
+            return None;
+        }
     }
     let d = std::fs::read(&path).unwrap();
     Some(common::ivf_frames(&d).into_iter().map(|f| f.to_vec()).collect())
diff --git a/crates/vp9/tools/extract_tables.py b/crates/vp9/tools/extract_tables.py
index bdd59bb7b..d3870f530 100644
--- a/crates/vp9/tools/extract_tables.py
+++ b/crates/vp9/tools/extract_tables.py
@@ -12,8 +12,18 @@ element count checked against the declared dimensions.
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read().replace("−", "-").replace("–", "-")
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read().replace("−", "-").replace("–", "-")
 lines = [l for l in text.split("\n") if "Copyright" not in l and "VP9 Bitstream & Decoding Process Specification" not in l]
 text = "\n".join(lines)
 
diff --git a/docs/agents.md b/docs/agents.md
index 4b85410f0..34c49e1ac 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -23,6 +23,7 @@ and write wherever the user can.
 
 ```sh
 cargo build --release -p filmcraft-cli -p filmcraft
+export FILMCRAFT_CONTROL_TOKEN="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
 ./target/release/filmcraft --control 9876 &      # only for the bridge server
 claude                                           # approve the project MCP servers when asked
 ```
@@ -37,6 +38,16 @@ claude mcp add filmcraft-headless -- /abs/path/filmcraft/target/release/filmcraf
 { "mcpServers": { "filmcraft": { "command": "/abs/path/filmcraft-cli", "args": ["mcp", "--bridge", "127.0.0.1:9876"] } } }
 ```
 
+### Effect parameter replies
+
+`effects.setParam` returns `{"keyframes": n, "param": id, "value": value}` on success.
+The keyframe count is zero for a static parameter: this is a successful static edit,
+not a failure. `param` identifies the edited parameter and `value` reports the accepted
+value; a choice supplied by name is returned as its numeric option index. An animated
+edit reports the value written at the requested time, rather than the static fallback.
+For example, setting opacity `blend` to `"Screen"` returns
+`{"keyframes": 0, "param": "blend", "value": 8}`.
+
 ### From an installed release
 
 The release packages ship `filmcraft-cli` alongside the desktop app, so no build is needed:
@@ -134,29 +145,31 @@ progress and stop it:
 ## 2. Control channel
 
 `filmcraft --control 9876` (or `FILMCRAFT_CONTROL_PORT=9876`) listens on `127.0.0.1` only. Send one
-JSON request per line and get one JSON reply per line. Full method table:
+JSON request per line and get one JSON reply per line. Set a fresh `FILMCRAFT_CONTROL_TOKEN` for the
+desktop session as above; the CLI / MCP bridge must inherit the same variable. Raw requests must
+include it as `token` on every line (replace the placeholders below). Full setup and method table:
 [control-protocol.md](control-protocol.md).
 
 ```jsonc
-{"id":1,"method":"engine.commands"}
-{"id":2,"method":"engine.execute","params":{"command":"file.openDemoProject"}}
-{"id":3,"method":"engine.execute","params":{"command":"playhead.set","params":{"seconds":2}}}
-{"id":4,"method":"engine.execute","params":{"command":"sequence.addEdit"}}
-{"id":5,"method":"engine.execute","params":{"command":"effects.apply","params":{"effect":"Gaussian Blur"}}}
-{"id":6,"method":"ui.elements","params":{"prefix":"tools."}}
-{"id":7,"method":"ui.click","params":{"id":"tools.Razor"}}
-{"id":8,"method":"ui.key","params":{"key":"Cmd+Z"}}
-{"id":9,"method":"ui.screenshot","params":{"path":"/tmp/timeline.png","panel":"Timeline"}}
+{"id":1,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"engine.commands"}
+{"id":2,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"engine.execute","params":{"command":"file.openDemoProject"}}
+{"id":3,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"engine.execute","params":{"command":"playhead.set","params":{"seconds":2}}}
+{"id":4,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"engine.execute","params":{"command":"sequence.addEdit"}}
+{"id":5,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"engine.execute","params":{"command":"effects.apply","params":{"effect":"Gaussian Blur"}}}
+{"id":6,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"ui.elements","params":{"prefix":"tools."}}
+{"id":7,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"ui.click","params":{"id":"tools.Razor"}}
+{"id":8,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"ui.key","params":{"key":"Cmd+Z"}}
+{"id":9,"token":"<FILMCRAFT_CONTROL_TOKEN>","method":"ui.screenshot","params":{"path":"/tmp/timeline.png","panel":"Timeline"}}
 ```
 
 Replies look like `{"id":4,"ok":true,"result":{"cuts":2}}` or `{"id":7,"ok":false,"error":"…"}`.
 Minimal client:
 
 ```python
-import json, socket
+import json, os, socket
 s = socket.create_connection(("127.0.0.1", 9876)); f = s.makefile("rw")
 def call(method, **params):
-    f.write(json.dumps({"id": 1, "method": method, "params": params}) + "\n"); f.flush()
+    f.write(json.dumps({"id": 1, "token": os.environ["FILMCRAFT_CONTROL_TOKEN"], "method": method, "params": params}) + "\n"); f.flush()
     return json.loads(f.readline())
 print(call("engine.execute", command="sequence.inspect"))
 ```
diff --git a/docs/architecture.md b/docs/architecture.md
index f8995621b..3056a7e37 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -534,7 +534,8 @@ with different vertex counts hold). Feather, Opacity and Expansion are ordinary
   removeVertex / toggleVertexSmooth / roundCorners / select / list; `masks.add` takes a
   `cornerRadius` for a rounded rectangle); keyframe commands take `"mask": n`. The
   Program monitor overlay drags vertices, Bézier handles, the whole mask and the feather /
-  expansion handles; drags merge into one undo step.
+  expansion handles; a marquee from outside the shape or Shift-click selects several vertices,
+  which move together (`masks.moveVertex` `vertices`); drags merge into one undo step.
 - **Tracking** (`render::track`, `masks.track`): Shi–Tomasi features inside the mask, pyramidal
   Lucas–Kanade (4 levels, 15×15 window) with a forward–backward check, then RANSAC + least squares
   for Position / Position & Rotation / Position, Scale & Rotation (2D Procrustes). Each frame's
diff --git a/docs/captions.md b/docs/captions.md
index 871427d48..e4212fe7d 100644
--- a/docs/captions.md
+++ b/docs/captions.md
@@ -40,13 +40,15 @@ Details of each format and the SCC encoder are in [`crates/captions/README.md`](
 | `captions.add` | Sequence ▸ Captions ▸ Add Caption at Playhead (⌥⌘C) | `track`, `text`, `time`, `durationSeconds` (3) |
 | `captions.next` / `captions.previous` | Sequence ▸ Captions ▸ Go to Next/Previous Caption Segment (⌥⌘↓/↑) | |
 | `captions.showAll` / `captions.hideAll` | Sequence ▸ Captions | |
-| `captions.split` | Text panel ✂ | `caption`, `time` (default: every caption under the playhead) |
+| `captions.split` | Text panel ✂; Razor tool on a caption (⇧: every caption track) | `caption`, `time` (default: every caption under the playhead) |
 | `captions.merge` | Text panel | `captions` (consecutive, one track) |
 | `captions.setText` | Text panel text field | `caption`, `text`, `speaker` |
 | `captions.setTimes` | Text panel in/out fields | `caption`, `start…`/`end…` (`Time` ticks, `Frame`, `Seconds`, `Timecode`) |
 | `captions.trim` | drag a caption edge in the timeline | `caption`, `edge` (`in`/`out`), `delta` or `deltaFrames` |
 | `captions.move` | drag a caption in the timeline | `captions`, `delta` or `deltaFrames` |
+| `captions.duplicate` | ⌥-drag a caption in the timeline | `captions`, `delta` or `deltaFrames` — copies on the same tracks, overwriting what is there |
 | `captions.delete` | Edit ▸ Clear / Ripple Delete with captions selected | `captions`, `ripple` |
+| `edit.copy` / `edit.cut` / `edit.paste` / `edit.pasteInsert` | ⌘C / ⌘X / ⌘V / ⇧⌘V with only captions selected | captions paste at the playhead on the tracks they came from, overwriting (Paste Insert pushes later captions on); Paste places whichever of clips or captions was copied last |
 | `captions.select`, `captions.goTo` | click / number button | `captions`, `add` / `caption` |
 | `captions.setTrack` | caption track header (eye, lock) | `track`, `name`, `format`, `language`, `enabled`, `locked`, `syncLock` |
 | `captions.setStyle` | Text panel style strip | `track`, `size`, `color`, `background`, `backgroundColor`, `outline`, `outlineColor`, `align`, `anchor`, `margin`, `lineSpacing`, `reset` |
@@ -62,14 +64,16 @@ also splits captions.
 ## Timeline and Text panel
 
 - Caption rows: header with `C1…` badge, lock, output eye, name and format; caption blocks in
-  violet showing their text (Arabic and Hebrew in reading order from the block's right edge). Click selects (⌘/⇧ adds), drag moves, edge drag trims, double-click
+  violet showing their text (Arabic and Hebrew in reading order from the block's right edge). Click selects (⌘/⇧ adds), drag moves (the whole selection; ⌥-drag
+  copies), edge drag trims, the Razor tool cuts, double-click
   opens the Text panel. Automation ids: `timeline.caption.<id>`,
   `timeline.captionTrack.C1[.locked|.enabled]`.
 - **Text panel ▸ Captions**: search, track picker (also creates tracks of each format), add /
   split / merge / delete / export buttons, the list of segments with editable in/out timecodes
   and text (committed when the field loses focus; Arabic and Hebrew show in reading order and are
   edited in logical order while the field has focus), and the track style strip (size, colour, box,
-  alignment, position). Automation ids: `text.tab.Captions`, `text.captions.add|split|merge|delete|export|search|track`,
+  alignment, position). The list keeps the caption under the playhead in view (centred as the
+  playhead reaches it, not while a field is being edited). Automation ids: `text.tab.Captions`, `text.captions.add|split|merge|delete|export|search|track`,
   `text.captions.<id>.in|out|text|goto|row`, `text.captions.style.*`.
 
 ## Burn-in
diff --git a/docs/codec-parity.md b/docs/codec-parity.md
index f1ae5245c..d3a79679d 100644
--- a/docs/codec-parity.md
+++ b/docs/codec-parity.md
@@ -1,6 +1,6 @@
 # Codec parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (new file: every codec Premiere Pro 26.5.2 decodes or encodes, against ours) · **Target:** Adobe Premiere Pro 2026 (26.5.2) and Media Encoder 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (ProRes alpha final-run conformance and native macOS validation) · **Target:** Adobe Premiere Pro 2026 (26.5.2) and Media Encoder 2026
 
 Video and audio codecs, decode and encode, with fidelity and how each is tested. Containers,
 project and interchange files are in [file-format-parity.md](file-format-parity.md); hardware
@@ -17,7 +17,7 @@ contents). Percent is ready-for-real-work for that codec: depth, profiles, speed
 |---|---|---|---|---|---|---|
 | H.264 / AVC | decode all common profiles incl. High 10, 4:2:2 (XAVC S-I, AVC-Intra); encode 8/10-bit | own decoder, **8-bit 4:2:0 only** (Baseline / Main / High, CABAC / CAVLC); no High 10 / 4:2:2 / 4:4:4, interlaced field / MBAFF, lossless | own encoder (High / Main / Baseline, B-frames, CBR / VBR / 2-pass); 8-bit 4:2:0 only; hardware VideoToolbox / NVENC | decode bit-exact on 37+ conformance streams, 500–600 fps 1080p; encode ffprobe-checked, byte-identical across machines | 65% | 20–35 h |
 | HEVC / H.265 | decode Main, Main 10, 4:2:2 10 (XAVC HS); encode 8/10-bit, HDR | own decoder Main / Main 10 / Main Still Picture, bit-exact on 41 fixtures, ~225 fps 1080p; **no 4:2:2 / RExt** | **hardware only** (VideoToolbox 8-bit; NVENC 8-bit and Main 10 HDR on Windows); no software encoder | NVENC round trip 48.9 dB (8-bit), 71.1 dB (10-bit); ffprobe | 60% | 30–60 h |
-| ProRes 422 family / 4444 / XQ | decode + encode all | own decode + encode, all six profiles, alpha | yes (export UI exposes 422 flavours; 4444 / XQ request #342) | ±1 LSB, 318 fps | 85% | 3–6 h |
+| ProRes 422 family / 4444 / XQ | decode + encode all | own decode + encode, all six profiles, alpha | yes (export UI exposes 422 flavours; 4444 / XQ request #342) | ±1 LSB, 318 fps; alpha final-run conformance and native macOS HD decode checked ([details](../crates/prores/README.md#alpha-bitstream-conformance)) | 85% | 3–6 h |
 | ProRes RAW | decode | none (#345) | — | — | 0% | 30–50 h (spec availability uncertain) |
 | DNxHD / DNxHR | decode + encode, MXF / MOV | own decode (all SMPTE ST 2019-1 CIDs, 8/10/12-bit, 4:2:2 / 4:4:4, interlaced, alpha) and encode LB / SQ / HQ / HQX / 444 | yes, MOV + MXF | within IDCT precision of ffmpeg on 22 fixtures | 90% | 2–4 h |
 | AV1 | decode (hardware on Windows); export through Media Encoder plug-ins / recent versions | own decoder Main 8/10-bit, all tools, film grain, bit-exact vs libdav1d on 41 vectors; hardware on Windows | none | slow in software (~4 fps 1080p single-thread) | 55% | 30–50 h (encoder + speed) |
@@ -61,5 +61,6 @@ contents). Percent is ready-for-real-work for that codec: depth, profiles, speed
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-22 | minor | ProRes alpha final-run syntax regression tests and native macOS HD decode validation |
 | 2026-10-11 | minor | CinemaDNG / DNG decode (#1065) |
 | 2026-10-10 | major | Created: codec-by-codec comparison with Premiere 26.5.2 from the codec crates' READMEs, the export format registry and the installed bundle's listings |
diff --git a/docs/contributing.md b/docs/contributing.md
index c7af17706..3ad802bff 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -8,7 +8,7 @@ of the crate you will change.
 
 | | All platforms |
 |---|---|
-| Rust | stable ≥ 1.95 (edition 2024; egui 0.36 requires it), via [rustup](https://rustup.rs) |
+| Rust | stable ≥ 1.95 (edition 2024; egui 0.37 requires it), via [rustup](https://rustup.rs) |
 | wasm target | `rustup target add wasm32-unknown-unknown` (for `cargo xtask wasm`) |
 | Components | `rustup component add rustfmt clippy` |
 | ffmpeg + ffprobe (optional) | test oracle and fixture generator only; tests skip without it |
@@ -39,6 +39,7 @@ cargo xtask web --serve 8765                          # the web app on http://12
 | Variable | Effect |
 |---|---|
 | `FILMCRAFT_CONTROL_PORT` | Same as `--control <port>` |
+| `FILMCRAFT_CONTROL_TOKEN` | Required for `--control`: 64 random hex characters, inherited by authorized clients; [setup](control-protocol.md) |
 | `FILMCRAFT_CPU_COMPOSITE=1` | Disables the GPU compositor |
 | `FILMCRAFT_DEV_DESKTOP_ENTRY=1` | Linux, opt-in: a run from a source tree installs a user-level desktop entry (and the icons from `assets/app-icon`) so the taskbar shows the FilmCraft icon. Nothing is written without it; packaged runs never write one |
 | `FILMCRAFT_DATA_DIR` | Same as `--data-dir <dir>`: auto-save, crash recovery, settings and logs |
@@ -88,7 +89,8 @@ Regular, to keep the wasm small). The Japanese ones become the last fallback of
 (`crates/ui-egui/src/theme.rs`, BIZ UDPGothic first) and fallback faces in the text engine (Gothic
 for sans text, Mincho for serif text). Without `CRAFT_FONTS_DIR`, `CRAFT_FONTS` is empty and
 FilmCraft uses its bundled and system fonts. A `CRAFT_FONTS_DIR` that is not a checkout is a build
-warning, or an error with `CRAFT_FONTS_REQUIRED=1` (release builds set both). Tests on these fonts'
+warning, or an error with `CRAFT_FONTS_REQUIRED=1` (release builds set both). With
+`CRAFT_FONTS_REQUIRED=1`, a build without `CRAFT_FONTS_DIR` is an error too. Tests on these fonts'
 glyphs skip when it is empty; when you touch fonts, run the gates both with and without it.
 
 Chinese media names and track labels use the `Hans` / `Hant` craft-fonts faces after the Japanese
@@ -116,11 +118,11 @@ Every commit must pass all of these:
 |---|---|
 | Format | `cargo fmt --check` (`rustfmt.toml`: `max_width = 160`) |
 | Lints | `cargo clippy --workspace --all-targets -- -D warnings` |
-| Tests | `cargo test --workspace` |
+| Tests | `cargo nextest run --workspace` ([cargo-nextest](https://nexte.st), or `cargo test --workspace`), then `cargo test --workspace --doc` |
 | Layering | `cargo xtask layers` |
 | Assets | `cargo xtask assets` |
 | wasm | `cargo xtask wasm` (checks every L0–L4 crate, `filmcraft-ui-egui` and `filmcraft-web` for `wasm32-unknown-unknown`) |
-| All of the above | `cargo xtask ci` (runs clippy and tests with `--release`) |
+| All of the above | `cargo xtask ci` |
 
 Run them with `CRAFT_FONTS_DIR` set too when you change font code ([craft-fonts](#building-with-craft-fonts)).
 
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 80802cf20..aa82c2e98 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -2,6 +2,27 @@
 
 ## Desktop control channel
 `filmcraft --control 9876` (or `FILMCRAFT_CONTROL_PORT`) listens on `127.0.0.1:<port>` (loopback only).
+The listener requires `FILMCRAFT_CONTROL_TOKEN`: 64 random hex characters shared with authorized
+clients through their inherited environment. Generate a fresh token for each desktop session, then
+start the desktop and bridge from that environment:
+
+```sh
+export FILMCRAFT_CONTROL_TOKEN="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
+filmcraft --control 9876 &
+filmcraft-cli mcp --bridge 127.0.0.1:9876
+```
+
+The CLI / MCP bridge reads this variable automatically. Keep it private: don't put the value in
+command-line arguments, logs, checked-in MCP configuration, or shared files. Without a valid value,
+the desktop leaves the listener closed. Every raw JSON request must include the same top-level
+`token` string; missing or incorrect credentials get an error and close the connection before any
+request is dispatched. Loopback alone does not restrict clients to the desktop owner's OS account.
+
+Socket reads and writes time out after two minutes without progress, releasing the connection slot.
+Expiration closes the connection without an unsolicited reply; reconnect before the next request
+(the CLI / MCP bridge does this automatically). Waiting for a UI reply has its separate 60-second
+limit. A partial request that times out is not dispatched.
+
 One JSON request per line → one JSON reply per line. The app opts out of macOS App Nap
 (`apps/filmcraft/src/app_nap.rs`): a hidden window would otherwise drop the whole process to
 background priority, and on a busy machine it would stop answering.
@@ -13,11 +34,11 @@ nothing sent after it on that connection runs. That covers text that isn't JSON,
 an object without `method`, invalid UTF-8, and a line longer than 4 MiB. An HTTP request (for example a
 web page's cross-origin `fetch` to `127.0.0.1:<port>`) therefore can't smuggle a command in its body:
 its request line is rejected first. At most 16 connections are served at once; further ones get an error
-line and are closed. Clients that get an error reply should reconnect. The port has no authentication,
-so only enable it while you use it. Transport: `apps/filmcraft/src/control_server.rs`.
+line and are closed. Clients that get an error reply should reconnect. Transport:
+`apps/filmcraft/src/control_server.rs`.
 
 ```json
-{"id": 1, "method": "engine.execute", "params": {"command": "sequence.addEdit", "params": {"seconds": 3}}}
+{"id": 1, "token": "<FILMCRAFT_CONTROL_TOKEN>", "method": "engine.execute", "params": {"command": "sequence.addEdit", "params": {"seconds": 3}}}
 {"id": 1, "ok": true, "result": {"cuts": 2}}
 ```
 
@@ -28,20 +49,25 @@ Methods (handlers in `crates/ui-egui/src/control.rs`):
 | `engine.execute` / `ui.menu.invoke` | `{command, params}` | any engine or UI command id |
 | `engine.commands` / `ui.menu.list` | – | command registry / menu tree |
 | `ui.inspect` | – | UI state (tool, workspace, dock, timeline view, playback, fps…) |
-| `ui.elements` | `{prefix?}` | every on-screen interactive element: id, label, rect |
+| `ui.docking` | – | the panel layout (craft-ui `Layout`), the focused and maximized panel, and `hitRects`: each docking gesture source drawn last frame (`{hit, rect}`) |
+| `ui.elements` | `{prefix?}` | every on-screen interactive element: id, label, rect; `window` (the `n` of `panel.float.<n>`) marks an element drawn in a floating panel's own OS window, whose rect is in that window's coordinates |
 | `ui.set` | `{tool, workspace, mode, theme, focused, playbackRes, timeline:{pps,scroll,fit}, program:{…}, source:{…}, clipDialog:{param: value}, menuDialog:{param: value}, panels:{scopes, timecode, reference, events, progress}, export:{…}, keyframeSelection:[…]}` | `keyframeSelection` replaces the Effect Controls keyframe selection (`[{clip, effect, param, mask?, time}]`, `time` in media ticks; read back as `ui.inspect` → `ui.keyframe_selection`; a click on a lane keyframe selects just that one); `program` / `source` merge fields into the monitor view state (`res`, `paused_res`, `high_quality`, `display`, `zoom`, `pan`, `show_rulers`, `show_guides`, `lock_guides`, `snap`, `guides`, `compare_ref`, …; see [monitors.md](monitors.md)); `clipDialog` sets fields of the open Edit / Clip / File dialog (Paste Attributes, Make Subclip, Frame Hold Options, …); `menuDialog` those of the M3.11 dialogs (Find, Create Search Bin, Project Settings, Scene Edit Detection, Simplify Sequence, Automate to Sequence…; see `panels::menu_dialogs`); `panels` merges into the panel settings (`ui.inspect` → `ui.panels`; see `panels::panel_state`): Lumetri Scopes `{shown: ["vectorscopeYuv"|"vectorscopeHls"|"histogram"|"parade"|"waveform"], waveformType, paradeType, colorSpace, brightness, scale, clamp, targets}`, Timecode `{rows: [{source, mode, display}], showName}`, Reference Monitor `{ganged, time, display: "composite"|"scopes", scopes}`, Events `{level, selected}`, Progress `{showFinished}` `export` deep-merges into Export mode state (`preset` — applied first —, `settings` (ExportSettings JSON), `fileName`, `location`, `range`, `customStart`, `customEnd`, `openSections`, `manager` (Preset Manager: `query`, `favoritesOnly`, `selected`, `saveName`), `quickOpen`, `quickPath`, `quickPreset`); `program` / `source` merge fields into the monitor view state (`res`, `paused_res`, `high_quality`, `display`, `zoom`, `pan`, `show_rulers`, `show_guides`, `lock_guides`, `snap`, `guides`, `compare_ref`, …; see [monitors.md](monitors.md)); `clipDialog` sets fields of the open Edit / Clip / File dialog (Paste Attributes, Make Subclip, Frame Hold Options, …); `menuDialog` those of the M3.11 dialogs (Find, Create Search Bin, Project Settings, Scene Edit Detection, Simplify Sequence, Automate to Sequence…; see `panels::menu_dialogs`); `projectPanel` merges into the Project panel's view state (`bin` shown in place, `tabs` (bins in a tab or window: `{bin, floating, view, iconSize, nav}`), `activeTab`, `selectedBin`, `rename: {item|bin, text}`, `dialog` (`{"metadataDisplay": {columns, filter}}`, `{"savePresetAs": {name}}`, `{"managePresets": {selected, name}}`, `{"freeformOptions": {options}}`, `{"saveArrangement": {name, bin}}`)); `mediaBrowser` into the Media Browser's (`expanded`, `pathEdit`, `editColumns`, `treeWidth`). View settings, columns and presets are engine commands (`project.view.set`, `project.columns.set`, `project.viewPreset.*`, `mediaBrowser.settings`) |
 | `ui.panel.show` / `ui.panel.close` | `{panel}` | |
-| `ui.click` / `ui.move` | `{id}` or `{x,y}`, `button`, `count`, `modifiers` | synthetic pointer input |
-| `ui.drag` | `{from, to, steps, modifiers}` | press–move–release |
+| `ui.click` / `ui.move` | `{id}` or `{x,y}`, `button`, `count`, `modifiers` | synthetic pointer input; click `count` is an integer 0–10 (default 1); `ui.move` ignores it |
+| `ui.drag` | `{from, to, steps, modifiers}` | press–move–release; `steps` is an integer 0–1024 (default 12; 0 or 1 uses 2 steps) |
 | `ui.scroll` | `{id|x,y, dx, dy, modifiers}` | wheel / trackpad |
 | `ui.key` / `ui.type` | `{key}` (`Cmd+K`, `Space`…; off macOS `Ctrl+K` is the same key) / `{text}` | keyboard |
-| `ui.timeline.hit` / `ui.timeline.locate` | `{x,y,modifiers?}` / `{clip, edge?}` | timeline hit-testing. `hit` reports a clip's `edge` (`In`/`Out`) within 7 px of it (a third of a narrow clip); just left of a cut that is the left clip's Out, from the cut rightwards the right clip's In. `kind` is the trim a press of the current tool with `modifiers` starts there (`trim`, `ripple`, `roll`, `rateStretch`, `remix`), `volume` on an audio clip's Volume line (Selection and Pen tools), or null |
+| `ui.timeline.hit` / `ui.timeline.locate` | `{x,y,modifiers?}` / `{clip, edge?}` | timeline hit-testing. `hit` reports a clip's `edge` (`In`/`Out`) within 7 px of it (a third of a narrow clip); just left of a cut that is the left clip's Out, from the cut rightwards the right clip's In. `kind` is the trim a press of the current tool with `modifiers` starts there (`trim`, `ripple`, `roll`, `rateStretch`, `remix`), `volume` on an audio clip's Volume line (Selection and Pen tools), or null. On the ruler it reports `ruler`, or `workArea` with the bar's `edge` on the work area bar |
 | `ui.playback` | `{action: play|stop|toggle, speed?}` | |
 | `ui.screenshot` | `{path?, panel?}` | PNG of the window or one panel; fails after 10 s when no frame is presented (window hidden, display asleep) |
 | `ui.resize`, `app.quit` | `{width,height}` / `{}` | resize or close the native window; `app.quit` quits without the save prompt (unsaved changes stay in the recovery journal), while the command `app.quit` asks first |
 | `ui.focus` | `{}` / `{id}` | empty parameters activate the native window; a widget ID requests egui focus without OS activation |
 | `perf.stats` | – | performance counters (also the command `perf.stats`, so `engine.execute` and MCP `command_run` reach it; headless sessions return the engine part). `decode`: GOP-cache requests / hits / `cacheHitRate`, decoder seeks, samples decoded and skipped while catching up, `draftFrames` (decoded in draft mode), `h264Threads` (frame-threading workers per H.264 decoder), `liveDecoders` (sources holding a decoder now), `cacheMB` / `cacheBudgetMB` (decoded frames all sources hold, and the shared budget), `planePoolMB` / `planesReused` (idle buffers of the frame pool, the planes of evicted frames and the compositor's float images, which a standalone export frees when it ends; and buffers taken from it instead of allocated), decoder ms (total and per sample), `framesDecoded`, `hardware` (Settings ▸ Playback ▸ Hardware decoding: `enabled`, pictures from hardware decoders `frames` vs `softwareFrames`, `sessions`, `declined` streams, mid-stream `fallbacks`); `playback`: playing, shown / dropped frames and `dropRate` of the current or last play, resolution, `draftDecode` (Settings ▸ Playback ▸ Draft decoding), `audio` (desktop: sound is mixed 200 ms ahead of the device; device `callbacks`, `underruns` and `missingFrames` played as silence because the mixer fell behind, `minLeadMs` the least sound left buffered); `frames`: frame-worker jobs, cancelled, `requestHitRate`, `decodeMs` / `renderMs` (mean, p50, p95 of the last 256 jobs), queue, render-cost estimate, cache use; `monitor`: the `frame` and `revision` of the picture the Program monitor shows against `playheadFrame` and `projectRevision` (how far a drag or a scrub is ahead of the picture); `ui`: fps and frame ms; `process`: CPU seconds; `media`, `jobs`. Counters are cumulative: diff two readings to measure an interval ([performance.md](performance.md)) |
 
+For `ui.click` and `ui.drag`, omitted or null counts/steps use the defaults. Out-of-range or
+non-integer values return `{"ok": false, "error": "…"}` before queuing any pointer input.
+These limits also apply to the MCP bridge's `ui_click`, `ui_drag` and `ui_control` tools.
+
 **Timeline thumbnails.** `ui.set {timeline: {thumbnails}}` sets the Timeline wrench menu's Show Video
 Thumbnails: `off`, `head`, `headAndTail` or `continuous`.
 
@@ -125,7 +151,12 @@ the new clips as `copied`, they are selected, and copies of linked clips are lin
 
 **Trim mode** (`crates/engine/src/trim.rs`): `trim.selectEditPoint` / `trim.selectNearest` enter trim
 mode (the Program monitor becomes the Trim Monitor, ids `trimMonitor.*`); `trim.monitor` returns what
-it shows. Dynamic trimming takes an explicit clock (seconds) so it is deterministic: `trim.shuttle
+it shows. With Linked Selection on, selecting an edge includes its unlocked linked partners, even
+on untargeted tracks; `add: true` (Shift-click) toggles the group. Regular/ripple trims select the
+corresponding In/Out edges. Rolls include only matching linked cuts at the same time, leaving split
+audio cuts separate. Each linked group moves once and shares its tightest trim limit; turning
+Linked Selection off allows individual edges to be selected and edited.
+Dynamic trimming takes an explicit clock (seconds) so it is deterministic: `trim.shuttle
 {direction, slow?, clock}` (J/L), `trim.tick {clock}`, `trim.shuttleStop {clock?}` (K, one undo step),
 `trim.cancelDynamic` (Esc), `trim.playAround {clock, loop?}` (Space / Shift+K).
 
@@ -176,18 +207,28 @@ Time is in ticks (254 016 000 000 per second); commands also accept `seconds`, `
 
 | Command | Parameters | Result |
 | --- | --- | --- |
-| `window.floatPanel` | `{panel?, rect?: [x,y,width,height]}` | Move an existing panel into a floating group. Omitted panel uses the focused panel; omitted rect uses a centered 420×320 group. |
+| `window.floatPanel` | `{panel?, rect?: [x,y,width,height]}` | Move an existing panel into a floating group. Omitted panel uses the focused panel; without a rect it floats inside the dock area, 24 points from its top-left corner, at the size a drag floats it at. |
 | `window.dockPanel` | `{panel?, anchor?, zone?: "center"\|"left"\|"right"\|"top"\|"bottom", before?}` | Move into the anchor's tab group or a side split; `before` names an existing destination tab for precise ordering. Floating destinations accept tabs only. Without `anchor`, a side `zone` docks the panel along that edge of the whole workspace, at a quarter of its width or height. |
 | `window.closePanel` | `{panel?}` | Close a docked or floating panel without closing its project documents. |
 
 Invalid source/target identities and non-finite or out-of-range geometry return an error with
-the layout unchanged. `ui.inspect.ui.floating` reports floating groups and their logical-point
-rectangles. `panel.drag.<Panel>` locates each panel's header grip; `panel.float.<index>.move`
-and `.resize` locate floating geometry handles. Named workspace saves include these groups.
+the layout unchanged. `ui.inspect.ui.dock.floating` reports floating windows and their
+logical-point rectangles. `panel.drag.<Panel>` locates the drag bar of each panel's group;
+`panel.float.<index>.move`, `.resize` (bottom-right corner) and `.resize.<Edge>` locate floating
+geometry handles; `dock.gutter.<path>`
+locates a split divider (`a`/`b` per split level), `dock.corner.<outer path>.<inner path>` the
+four-way handle where two dividers meet, `panel.float.<index>.gutter.<path>` and
+`panel.float.<index>.corner.<outer path>.<inner path>` the same inside a floating window;
+`ui.docking` lists every docking gesture source. Named workspace saves include floating windows.
+
+The panels use craft-ui's shared docking with its split-tree settings. Its control commands
+(`window.panel.move`, `.float`, `.dock`, `.activate`, `.close`, `.closeGroup`, `.closeOthers`,
+`.minimize`, `.layout`; see craft-libs `docs/ui-docking.md`) route here too; the three
+commands above are FilmCraft's names for `window.panel.float`, `.dock` and `.close`.
 
 `window.dockAction` accepts `{action}` using the shared docking action's JSON form. It
 covers tab moves and ordering, split and floating geometry, activation, and closing.
-For example, `{"action":{"ResizeSplit":{"path":[],"size":{"FixedFirst":360}}}}`
+For example, `{"action":{"ResizeSplit":{"path":[],"size":{"Ratio":0.3}}}}`
 resizes the root split; path entries use `false` for the first child and `true` for
 the second. `{"action":{"MoveFloating":{"panel":"Info","rect":[45,65,420,320]}}}`
 repositions and resizes the floating group containing Info. Invalid actions leave the
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 000000000..6fe950b12
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,1606 @@
+# FilmCraft — egui 0.37 migration plan
+
+Current reconciliation (2026-10-25): the local tree incorporates main
+`a504f3c5adc4cd60d9c1120916cddb50c9b24b86`. Managed CI
+`egui037-filmcraft-oracle8-full-ci-20261025-0871` passed formatting, strict lint,
+workspace tests and doctests, assets, layers and the 49-crate WASM check.
+It recorded 3,756 passing test executions, zero failures and 45 ignored across
+164 summaries. Required external oracles used the retained checksum-pinned
+FFmpeg 8.1.3 toolchain and fresh generated fixtures. The source patch matched
+the completed run before this prose update. Native/browser GUI, native IME,
+platform runtime, final packages and paired performance remain open. Human
+review and human merge are required.
+
+The following landing record qualifies the earlier candidate; its test counts
+and captured main are historical.
+
+Historical landing status, 2026-10-25: the migration integrates main `bfc23840b603e69c782302c6ed04d4a9f6ec26a8` and uses egui `6d518fc799681571963842f95b55a6b68431b15a`, winit `a517b3846ee8457d84ee4975110bfda6797c44dc` and craft-ui `25da1314d443171b4adeaad2cd9454b273f35c6f`. Cargo.lock SHA-256 is `8ddb2d92ec359928491b47c084501bbecaa9ff708d678156dab99d1cbd24642e`; the independent media/document-path pins remain selected in the lockfile. Release workflows use craft-fonts `b076417b5880bd4154bd22f00695b1d28c6bea83`.
+
+Fresh static review verified preservation of the captured main and the final dependency graph. The final managed CI run `egui037-filmcraft-oracle8-full-ci-20261025-0570` passed formatting, strict lint, workspace tests and doctests, layers, assets and the 49-crate WASM check, including the web app. It recorded 3,733 passing test executions, zero failures and 45 ignored across 164 summaries. Earlier passing counts below qualify their historical snapshots only. The icon-font attribution URL now identifies the selected egui source; font bytes are unchanged. Visible GUI, browser/platform runtime, native IME, final packages and paired performance remain separate acceptance gates. Human review and human merge are required.
+
+External oracle checks ran with `FILMCRAFT_REQUIRE_ORACLES=1`, checksum-pinned FFmpeg 8.1.3 (`n8.1.3-24-g92611900bb`) and fresh generated fixtures. An earlier run using FFmpeg 7.1.5 failed ten codec/oracle/workflow tests. All ten passed unchanged with the new tools in managed job0567, before the full suite passed in0570; no decoder, tolerance or fixture-source changes were made to clear them. The newer tool provides the required APV, half-float, SVT-AV1 and Kvazaar capabilities. It remains a private external oracle, not an app dependency or distributed asset.
+
+The original planning and earlier qualification record follows. Its pins, hashes, paths and passing counts are historical.
+
+
+Status: local implementation revision after the independent adversarial reviews of
+`plan-reviews/filmcraft-v1.md` and `filmcraft-v2.md`. The owned checkout now contains the
+0.37 migration work; commits, pushes, publications, and final immutable pins/lock remain
+gated. This document is the implementation contract, not publication acceptance. Every
+statement about runtime behavior below is source inspection at the recorded revisions unless
+it is explicitly labelled a proposed test or a proposed command.
+
+This revision resolves the review findings inline, including the dependency DAG. Section 17
+is a disposition index only; it does not override any section.
+
+## 1. Scope and exact baseline
+
+| Item | Value |
+|---|---|
+| Repository | `storytold/filmcraft` |
+| Assigned checkout | `/home/codex/work/CraftApps/egui037-migration-20261022/filmcraft-implementation` |
+| Latest qualified tree | HEAD `4ce159e1cda036bbc972d6d27d125626ff714b98` (2026-10-25; merge of migration `df5f86ae` and main `bfc23840`), with main `a504f3c5adc4cd60d9c1120916cddb50c9b24b86` merged locally but uncommitted; `Cargo.toml` SHA-256 `d544c4368d222e79e34be0c681b3b34f435109903b4f85f1ccc4ff27e35b8efb`; `Cargo.lock` SHA-256 `8ddb2d92ec359928491b47c084501bbecaa9ff708d678156dab99d1cbd24642e` |
+| Planning-snapshot branch HEAD (historical) | `fa550ce2d07bdfee6b1d7b6835e8abc8c6913d00` (2026-10-24; migration work is uncommitted on this base) |
+| Planning baseline (historical) | `abf44fda9015f4b7a96dc338f6042499bf8e9d9f` (2026-10-22, "Reject non-hex characters in colour hex parsing (#2600)") |
+| `Cargo.toml` SHA-256 (planning snapshot) | `b41244b83b0aff71ab6e122826d20a49a2d59c35e87da57c8dfd228a962ec2cf` |
+| `Cargo.lock` SHA-256 (planning snapshot) | `67528fa8486c963dadbaf04e487ab5a8af59ac8f98dac97e1d51f40b953b5bb5` |
+| Workspace | resolver 3, edition 2024, Rust 1.95, 50 crates plus 3 apps and `xtask` |
+| Planned UI stack (planning snapshot) | `egui`, `eframe`, `egui-wgpu`, `egui-winit`, `egui_glow`, `egui_kittest`, `emath`, `epaint`, `epaint_default_fonts` at `0.37.0`; `winit 0.30.13`; `wgpu 30.0.1`; `accesskit 0.24.1`; `arboard 3.6.1` |
+| Shared UI dependency | Planning manifest (historical): `craft-ui` at `5c874d51eeb3de70e735c8ce87a59a7dedd47675`, `craft-media` at `f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4`, `craft-docpath` at `82a24b006eefa036b43c09a67fb9a3fbd17ffe63`. Reconciled PR #199 base: `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`; final immutable pins and lock remain G-PINS/G-CL2F/G-CRAFT-LIBS gates. |
+| Target release | `egui 0.37.0` = upstream commit `841a328ba2dd8f6996beb7189ebb7fc00e668a2a` |
+| Research candidate | `aiongg/egui` `craft/0.37` = `a4f9a17f64a6bae61350fb85804c9df0d9865916`; `aiongg/winit` `craft/0.30.13-lang` = `8b35388bd719e8cc86a95971ba0bc026c9a8f058` |
+| Production fork pins | **Unknown and deliberately not invented.** They become valid only after reviewed, published immutable `storytold/egui` and `storytold/winit` commits exist. See §3.2 and §15 gate G-PINS. |
+| Evidence directory | `/home/codex/work/ssd2/task-evidence/egui037-migration-20261022` |
+| Historical diagnostics | `/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/{fork,stock}/filmcraft.errors` — older checkout (FilmCraft manifest 0.10.0), clues only, never acceptance |
+
+The existing `App::logic` / `App::ui` split and root-`Ui` architecture are **not** introduced
+by 0.37 and must not be rewritten as if they were. This plan changes where frame side effects
+run and how input is handled across layout passes; it does not change the command, undo,
+project or persistence model. Do not add a FilmCraft-specific `egui` compatibility crate. Use
+the new APIs directly, and add a helper to `craft-ui` only for semantics that at least two
+consumers need with the same contract.
+
+This repository has:
+
+- one root workspace (`Cargo.toml`) with `members = ["crates/*", "apps/*", "xtask"]`;
+- one workspace lockfile (`Cargo.lock`, 708 packages);
+- no `[patch]` section, no `vendor/` directory, no source replacement and no local crate copy;
+  `.cargo/config.toml` contains only the `xtask` alias;
+- exactly four manifests that mention `egui`: the workspace, `crates/ui-egui/Cargo.toml`,
+  `apps/filmcraft/Cargo.toml` and `apps/filmcraft-web/Cargo.toml`;
+- a native entry point (`apps/filmcraft/src/main.rs`), a wasm entry point
+  (`apps/filmcraft-web/src/lib.rs`), a CLI app and a web app;
+- no `egui_plot`, `egui_extras` or `egui_dock`; all other crate manifests scanned for `egui`,
+  `eframe`, `winit`, `rfd` and `egui_*` contain none;
+- `crates/ui-egui/Cargo.toml` has the only relevant target cfgs: `rustix` for Unix
+  thread/process clocks and `cpu-time` for Windows;
+- `craft-libs` vendors `krilla`/`hayro` for PDF work, unrelated to the windowing stack; this
+  plan does not touch them.
+
+### 1.1 Reverse dependency: EffectCraft
+
+EffectCraft (`9581b53c3f8945683252af0eb5fac79e0e43aed4` in the owned checkout) pins fifteen
+`filmcraft-*` crates to `2c5ba7a72619935f0481f99d59409e0d1844b234` in `effectcraft/Cargo.toml`.
+That revision is not an ancestor of FilmCraft baseline `abf44fda`; it is reachable from
+`origin/effectcraft/webm-alpha`. None of those crates (`media`, `codecs`, `frame`, `color`,
+`time`, `project`, `interchange`, `geom`, the encoders/decoders and the muxer) contains
+`egui`, and EffectCraft does not depend on `filmcraft-ui-egui`.
+
+Decision: EffectCraft needs no change for this migration. Retain its separate branch pin.
+Re-audit only if (a) the pin moves to FilmCraft main or another revision that changes a
+shared public type, or (b) EffectCraft starts consuming `filmcraft-ui-egui` (directly or
+through another crate). The re-audit must check the actual Cargo identities, not just a
+version string. This is the required explicit cross-repository check; it is not a silent
+deferral of FilmCraft's own compatibility work.
+
+## 2. Current architecture and lifecycle
+
+### 2.1 Entry points
+
+| Target | Entry point / symbol | Notes |
+|---|---|---|
+| Native desktop | `apps/filmcraft/src/main.rs:80` `main`, `:139` `eframe::run_native`, `:168` `native_options`, `:190` `app_creator` | wgpu only; features `default_fonts`, `wgpu`, `accesskit`, `wayland`, `x11`; no `system_fonts`, no `links` |
+| macOS native | `apps/filmcraft/Cargo.toml` target deps `muda`, `objc2-*`, `winit`; `main.rs:430` `agent_event_loop`; `native_menu.rs` | custom titlebar and menu; `--control` must not activate the app |
+| Linux native | `apps/filmcraft/Cargo.toml` `zbus`; `main.rs` `run_dialog_off_thread` | X11 and Wayland at runtime; XDG portal dialogs |
+| Windows native | `apps/filmcraft/Cargo.toml` `winresource`; `graphics.rs` DX12/default/software ladder | DX12 FXC shader compilation is relevant to startup measurement |
+| Browser | `apps/filmcraft-web/src/lib.rs:125` `start`, `:156` `WebRunner::start`, `:92` `impl eframe::App for WebApp` | wasm32 only; WebGPU with WebGL2 fallback; WebCodecs; OPFS |
+| Headless UI | `crates/ui-egui/tests/scripted.rs` and the other `tests/*_ui.rs` `Harness::builder().build_eframe(...)` | `egui_kittest` drives the same `FilmcraftApp` |
+
+### 2.2 The app object
+
+`FilmcraftApp` is in `crates/ui-egui/src/lib.rs`. The UI code is already split:
+
+- `crates/ui-egui/src/lib.rs:2133` `impl eframe::App for FilmcraftApp::logic`;
+- `crates/ui-egui/src/lib.rs:2193` `impl eframe::App for FilmcraftApp::ui`;
+- `crates/ui-egui/src/lib.rs:1807` private `FilmcraftApp::frame(&mut self, ui: &mut egui::Ui)`,
+  called from `App::ui` and wrapped in `catch_unwind`;
+- `cargo xtask` only builds/tests; FilmCraft does not implement a second `update` path;
+- the main workspace is custom-drawn: `App::ui` receives the root `Ui`, then calls
+  `header::show`, `dock_area`, `panels::*` and dialog functions. It does not use
+  `egui::TopBottomPanel`, `SidePanel` or `CentralPanel`;
+- floating panels are `egui::Area`s managed by `crates/ui-egui/src/dock.rs` and `dock_ui.rs`,
+  not native viewports. There is no `show_viewport_deferred` and no child-window dock;
+- dialogs use `egui::Window::new(...).show(ctx, ...)`, valid only inside a pass.
+
+### 2.3 Where side effects live (exhaustive inventory)
+
+These are the behaviours that must survive hidden logic-only calls, forced hidden paint and
+multi-pass layout without duplication. All clock-driven entries use a monotonic host clock
+after migration; no hidden work may read `ctx.input(|i| i.time)`.
+
+| Effect | Current location | Required migration decision |
+|---|---|---|
+| Theme/font installation and language fallback | `lib.rs:2133` `logic` (`theme::install`, `i18n::install_japanese_font`, `chinese_font_available`, `korean_font_available`) | Keep in logic; once-per-process state, not per pass; never call `Context::root_ui` |
+| Control channel, deferred requests, input waiters | `lib.rs:1672` `drain_control`, retry deadlines `:1682`, `now - last_ui_time > 0.25` raise heuristic `:1679` | Logic; consumed `try_recv` queue; monotonic `now`; `ui.*` requests that need composition send `ViewportCommand::RequestPaintWhileHidden` (see §4.5) |
+| Screenshot settle / issue / collect | `lib.rs:1702` settle timestamp, `:1714` `issue_screenshots`, `:1744` `collect_screenshots`; `queued_screenshots` `*frames += 1` (`lib.rs:1717-1720`), `monitor_inexact` `mem::take` (`:2182`), `timeline_still` increment (`:2163`) | Logic; monotonic deadline; `ScreenshotCallback` plus the CL-2 completion slot. Settle counters advance once per rendered frame/pass identity, not per logic call; a queued-but-not-yet-issued hidden request repeats `RequestPaintWhileHidden` until issued, after which the screenshot command itself forces the paint. |
+| FPS, frame time, close interception | `lib.rs:2133` `logic` (`ctx.input(i.time)`, `visible()`, `close_requested()`) | Logic; monotonic host clock; viewport metadata is fresh in `run_logic`, input time is not |
+| Frame worker pump | `lib.rs:2193` `ui` calls `self.frames.pump(...)` | Logic/background tick; do not rely on paint |
+| Persistence polling | `lib.rs:1825` `frame` calls `session.poll_persistence()` | Logic; once per state transition, not per pass |
+| Engine event drain | `lib.rs:1826` `session.drain_events()` | Logic; drain the one-shot queue; an event is consumed exactly once regardless of pass count |
+| Toast timestamp | `lib.rs:1840` `Event::Toast` stamps `ctx.input(i.time)` while `drain_events` moves to logic | Stamp with the monotonic host clock; repeated logic calls must not re-time or duplicate the toast |
+| Media refresh and pool sync | `lib.rs:1822` `sync_pool`, `:1825` `tick_media_refresh` (`:1777`) | Logic; monotonic deadlines and `request_repaint_after`; consumed scan state |
+| Preferences application | `lib.rs:717` `apply_prefs`, called from `frame` | Logic or known UI pass 0; idempotent; font/visual side effects once |
+| Drop import | `lib.rs:1473` `handle_drops` | `App::ui` pass 0 only; uses `RawInput` events; never `run_logic` |
+| Native menu / command inbox | `lib.rs:1846` command inbox and `menus::invoke`; `:1860` `sync_native_menu` | Command inbox in logic (consumed channel); native menu sync in UI pass 0; `menus::invoke` must not run twice per frame |
+| Keyboard shortcuts and focus/IME | `lib.rs:1546` `handle_shortcuts` | `App::ui` pass 0 only; `consume_key` remains the anti-duplication mechanism; fork E19 Latin-layout handling |
+| Playback/source playback/scrub audio | `lib.rs:1128` `advance_playback`, `advance_source_playback`, `scrub_audio` | Logic; monotonic host clock; set playhead from anchor + elapsed, never accumulate per call |
+| Undo press transaction | `lib.rs:2000` `begin_press` | `App::ui` pass 0 before UI; one press transaction per user gesture |
+| Escape drag rollback | `lib.rs:2011` `cancel_value_drag` | Latch Escape and the press mark in UI pass 0; apply rollback exactly once after the final UI pass (§4.4) |
+| TTS selection following | `lib.rs:1865` `panels::tts::follow_selection` | Logic or UI pass 0; idempotent selection identity |
+| Job watch / auto-play after render | `lib.rs:1916` `watch_jobs` | Logic; consumed job results; status-bar drawing remains in UI |
+| Auto-save dirty poll | `lib.rs:1818` `session.is_dirty()` and `request_repaint_after` | Logic; monotonic deadlines; worker stays alive while hidden |
+| Dynamic trim / loop playback (`trim.tick`) | `lib.rs:1817` `panels::trim_monitor::advance`; `panels/trim_monitor.rs:39-48` executes `session.execute("trim.tick", {"clock": ctx.input(i.time)})` on every frame | Move to logic; monotonic host clock; compute an idempotent target time (same target called twice is a no-op), not one tick per pass; keep `request_repaint` |
+| Metadata selection follow | `lib.rs:1814` `panels::metadata::follow_selection` | UI pass 0 or idempotent logic state; follows selection identity |
+| Auto/undo frame bookkeeping | `lib.rs:1813` `self.auto.begin_frame()` | UI pass 0 once; no second call in a discarded pass |
+| Timeline view sync | `lib.rs:1844` `self.sync_timeline_view()` | UI pass 0; idempotent |
+| Native menu sync | `lib.rs:1860` `self.sync_native_menu()` | UI pass 0; idempotent |
+| `last_ui_time` update | `lib.rs:2213` `self.last_ui_time = ctx.input(i.time)` | UI pass 0; monotonic host clock; drives the control raise heuristic and screenshot settle heuristics |
+| Input waiters drain | `lib.rs:2193` `App::ui` tail and synthetic queue | UI pass; consumed waiter vector; respond once |
+| Synthetic input / control input | `raw_input_hook` `lib.rs:2092`, synthetic queue | `raw_input_hook` runs before every `run_ui` frame and before `update_logic_only` ticks. Keep one unapplied synthetic gesture step in app state across repeated hidden logic ticks until a full UI pass consumes it; never collapse a press into its release or inject the same step twice. |
+
+Additional deadline/side-effect calls found by the review and covered by this table:
+`drain_control`'s `now + 3.0` retry deadline, its `now - last_ui_time > 0.25` raise decision,
+`issue_screenshots`'s `settle` and timeout, `tick_media_refresh`'s persisted `last` timestamp,
+the auto-save `request_repaint_after(1s)`, TTS `request_repaint_after(100ms)`, the synthetic
+input repaint, and the `monitor_inexact`/`timeline_still` settle counters. None may use stale
+`ctx.input(i.time)` after the lifecycle split; the toast stamp and settle counters have explicit
+rows above.
+
+### 2.4 Actual multi-pass exposure
+
+- FilmCraft does not call `Context::request_discard` (verified by grep).
+- egui 0.37 components used by FilmCraft can request it: `Grid` on first show
+  (`crates/egui/src/grid.rs`, "new Grid" path), `Aligned` on size change
+  (`containers/aligned.rs`), and `Resize` on a sizing pass (`containers/resize.rs`). FilmCraft
+  uses `Grid` in many dialogs, `ResizeHandle` through `craft_ui::layout`, and `Aligned` only if
+  a dependency introduces it.
+- Both native `crates/eframe/src/native/epi_integration.rs::update` and web
+  `crates/eframe/src/web/app_runner.rs` call `app.logic` **and** `app.ui` inside the
+  `Context::run_ui` closure. Both call logic once per layout pass, not once per frame.
+  When the root window/tab is hidden and no paint is requested, native
+  `update_logic_only` and the web runner call `Context::run_logic` with no UI pass.
+- `run_ui` may run a second pass after a discard. `RawInput::take()` moves `events` out, so
+  pass 1+ receives an empty event list; `InputState` recomputes pointer clicks and
+  `key_pressed` only from `new.events`. A click or key seen in pass 0 is therefore not
+  re-derived in pass 1.
+- After a normally completed `run_ui`, `current_pass_index()` is **zero**, including after
+  multiple passes: `end_pass` takes the output. Do not claim or test a stale nonzero index.
+  A pass-index first-pass guard is valid only for genuinely once-per-layout-frame UI state
+  under this pinned integration, and needs a regression proving hidden calls still run. It
+  must not suppress fresh asynchronous results, control commands or widget actions merely
+  because a later pass has a nonzero index.
+- `InputState::viewport().visible() == Some(false)` does **not** prove that the current
+  callback has no fresh input. A pending screenshot or `RequestPaintWhileHidden` can force a
+  real UI pass while minimized/occluded, and that pass can carry fresh input. Do not infer a
+  "logic-only" phase from visibility.
+
+## 3. Dependency and pin strategy
+
+### 3.1 Shared `craft-libs` baseline — corrected facts
+
+- The reconciled shared-library base is the merged PR #199 squash
+  `3832c47ef68a0e6214f2c1e85f3526b6adcb686e` on `storytold/craft-libs`. The implementation
+  checkouts use that base; `49190884278f16c9a9f5823d7698a8ffb5deb062` and its verification
+  below are historical planning evidence.
+- GitHub `repos/storytold/craft-libs/branches/main` returned
+  `49190884278f16c9a9f5823d7698a8ffb5deb062` at approximately 06:25 UTC on 2026-10-23. This was
+  the shared-library baseline at planning time.
+- The local `origin/main` ref (`b1401e3`) is stale. A stale remote-tracking ref **does not
+  prove** that `4919088` is unpublished. The review's "unpublished local/audit branch" claim
+  is rejected; the corrected evidence is the GitHub main verification above.
+- FilmCraft's current manifest pins `craft-ui` at
+  `5c874d51eeb3de70e735c8ce87a59a7dedd47675`, `craft-media` at
+  `f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4`, and `craft-docpath` separately at
+  `82a24b006eefa036b43c09a67fb9a3fbd17ffe63`. The old `5c874d51` commit was fetched exactly
+  into the owned `craft-libs` checkout for inspection without changing HEAD or any source.
+  These manifest pins are not the final publication pins.
+- Between `5c874d51` and `4919088`, `crates/ui` changes seven files, **607 insertions and two
+  deletions**: `README`, `docking/model.rs`, `docking/surface.rs`, `docking/tests.rs`,
+  `lib.rs`, new `printing.rs` and `printing/tests.rs`. `Cargo.toml` is unchanged.
+  - The docking change is the protected-group fix: `MoveFloating` now requires every
+    floating-group member to be movable, including the resize grip. Preserve the tests from
+    `d66e345`, `fd9cf54` and `c67b1e1`; this intentional security behavior must not be
+    reverted to match the old FilmCraft baseline.
+  - Printing is additive and lazy. Enabling the updated crate must not start discovery at
+    startup. Relevant print commits include `b700ae7`, `d27646a`, `4cae45d`, `2bbef53` and
+    `4f85efb`.
+- `craft-docpath` has no `egui` dependency. Keep it at `82a24b0` unless a later actual
+  cross-type or feature reason requires the move; do not fold it into the `craft-ui` bump.
+- PR 199 is **not** mergeable as a tree. Its head `b68de8c` and historical audit tree
+  `ec8840a` are stale relative to `4919088`, omit current `craft-platform`, and revert
+  security, settings, docking and printer fixes. Reuse only the API port hunks from
+  `8614e4a04fae516fba16c22b31ff1008cb6be10b` and the relevant README changes from
+  `1764bca`, applied onto current `4919088`. Preserve intervening fixes and provenance.
+  Never merge `b68de8c` or `ec8840a` as a tree.
+- The shared 0.37 port and the CL-2 capture helper will produce a later published
+  `craft-libs` revision. FilmCraft's final compatibility review must compare its actual old
+  API/use sites against that final published revision, not against `b68de8c` or a branch
+  point.
+
+### 3.2 One coherent production graph, not a stock-0.37 stage
+
+Stock 0.37 is a **local comparison** and CI control only. It is not a landable production
+stage. The production landing uses one coherent graph: the final reviewed immutable
+`storytold/egui` family, the final reviewed immutable `storytold/winit`, and the matching
+published `craft-libs` revision. The previous coherent 0.36.2 graph remains the rollback
+target.
+
+The exact production pins are **not known yet** and must not be invented. `a4f9a17f` and
+`8b35388b` are aiongg research candidates and comparison sources, not approved production
+pins. Gate G-PINS (§15) blocks the entire landing stage until:
+
+1. the complete reviewed/published `storytold/egui` P8 commit is immutable: E1-E21,
+   P2b bounded async W15P routing, P7 held-key pairing, P7b/E21b, P7c selected #8763/#8748
+   fixes and justified performance fixes;
+2. the completed reviewed/published `storytold/winit` commit contains the bounded W15P
+   transfer path, the W27 owner/support lifecycle and the required W1-W27 behavior;
+3. the matching published `storytold/craft-libs` commit contains CL-1 (the PR-199 API hunks
+   and one coherent fork graph) and the frozen CL-2F helper;
+4. the exact SHAs, feature sets, provenance and test mappings are recorded in the suite pin
+   manifest and the ledger.
+
+Until then, no `[patch]` block in FilmCraft names a fabricated or guessed revision. The
+eventual block must name the same immutable revision for every egui-family package that can
+resolve, plus `winit`; a patch section inside `craft-libs` does not propagate into this root.
+`egui_extras` is unused. `egui_plot` does not exist in FilmCraft; do not add it because its
+version numbering differs. `winit` stays exactly `0.30.13`.
+
+The final production manifest will look like the following shape, with `REPLACE_WITH_*`
+resolved only after G-PINS:
+
+```toml
+[patch.crates-io]
+egui = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+eframe = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+egui-winit = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+egui-wgpu = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+egui_glow = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+egui_kittest = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+epaint = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+emath = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+ecolor = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui", rev = "REPLACE_WITH_APPROVED_EGUI_SHA" }
+winit = { git = "https://github.com/storytold/winit", rev = "REPLACE_WITH_APPROVED_WINIT_SHA" }
+```
+
+If a stock-0.37 comparison is needed, it lives in a separate local/CI branch or harness with
+its own lockfile and evidence. It is never merged to main as an intermediate production
+state, and it does not change the production pin policy.
+
+### 3.3 Capture-helper sequence (CL-2 -> adapters -> CL-2F -> consumers)
+
+The suite capture contract is one completion slot per admitted request: the app holds it
+strongly and the callback holds it weakly.
+
+1. **CL-2** in `craft-libs` (`crates/ui/src/capture.rs`): provisional bounded completion-slot
+   prototype and tests. The app owns the request ID, path, deadline, settling policy,
+   capture-frame geometry, DPI/scale identity and reply schema.
+2. **DesignCraft and GridCraft adapters** against that exact provisional revision. DesignCraft
+   exercises multiple viewports; GridCraft exercises a single window. Their tokens, paths,
+   settle delays, deadlines and replies remain app-owned.
+3. **CL-2F** freezes the helper API after joint review of those adapters.
+4. **FilmCraft and the other consumers** pin the published revision containing CL-1 and
+   CL-2F in one atomic dependency stage, not a branch head and not a path dependency.
+
+All fourteen capture consumers adopt this contract. The eleven apps that already declare
+`craft-ui` (CADCraft, DesignCraft, EffectCraft, FilmCraft, GridCraft, LightCraft, PdfCraft,
+PhotoCraft, SoundCraft, VectorCraft and WordCraft) import the helper from the published
+revision that contains both CL-1 and CL-2F in the same atomic dependency stage. DesignCraft
+and GridCraft are the pilot adapters against the reviewed CL-2 provisional revision before
+CL-2F freezes the API. DeckCraft, FigCraft and ArtCraft Native do not declare `craft-ui`;
+they use contract-compatible local adapters unless they choose to add the dependency. Any
+consumer that already carries an incompatible `craft-ui` bump must reconcile it in that same
+atomic dependency stage, not a separate registry-only state. The earlier "thirteen `craft-ui`
+consumers" wording was based on substring matches and is superseded by the exact TOML-key
+inventory.
+
+The helper contract, which every adapter must satisfy:
+
+- the app's live request record owns the completion slot and a strong viewport waker; the
+  callback holds only a `Weak` reference to that slot, never a strong `Context` or app
+  reference and never a cycle back into the owning context. `ScreenshotCallback::new` does
+  not request a new frame when data arrives (`egui/src/data/screenshot_callback.rs:22-24`),
+  so the live slot's waker must request the repaint after the slot lock is released;
+- the request record owns one slot; correlation is by ownership, not callback order or a
+  second global token map;
+- admission uses the shared defaults of **four outstanding requests, 128 MiB per image and
+  256 MiB aggregate reserved in-flight/completed bytes**; a stricter documented app cap is
+  permitted (the shared SoundCraft example is 64 MiB/image and 192 MiB aggregate with the
+  same four-request count). Check the count and aggregate budget before issue, reserve
+  checked `width * height * 4` bytes, and do not evict an earlier admitted request;
+- record the target-UI logical bounds and a geometry epoch at issuance and bind the returned
+  pixels to that epoch. Cancel/retry on any intervening resize, DPI, zoom or surface-epoch
+  change before save, **even a change back**; with an unchanged epoch derive pixel scale
+  from the returned image dimensions and verify aspect/rounding. A callback carries pixels
+  only, not capture metadata;
+- cancel, close, drop and late callbacks release the image and send no reply/file; release
+  the slot lock before waking the owning viewport. The callback has no repaint request of its
+  own; the live slot's waker is the only wake path and runs after unlocking;
+- the app keeps the request ID, output path, serialization, timeout, settling and reply
+  schema; the callback does no PNG encoding, file I/O, command execution or long locking;
+- retained image bytes return to zero after drain/shutdown; a post-hoc size check does not
+  substitute for pre-issue accounting.
+
+### 3.4 Lockfile and reachability checks
+
+Before publication, run these against a clean checkout and a fresh `CARGO_HOME` (or with
+`--locked` after fetching). These are proposed checks, not executed here:
+
+```sh
+cargo metadata --locked --format-version 1 > /dev/null
+cargo tree -i egui@0.36.2        # must report no match
+cargo tree -i egui               # exactly one 0.37.0 source
+cargo tree -i winit              # exactly one pinned source
+cargo tree -d -i winit           # no duplicate winit
+cargo tree -d -i wgpu            # one resolved wgpu source/version
+cargo tree -e features -i egui | grep -E 'default_fonts|monochrome_emoji_fonts|clipboard'
+```
+
+Add a CI/`xtask` check that fails if:
+
+- an egui-family package has a source other than the chosen immutable fork;
+- `winit` has more than one source or a version other than 0.30.13;
+- a published manifest contains `path = "/home/`, `path = "/Users/` or an uncommitted local
+  checkout;
+- a git pin changes revision without the same change in the suite pin record;
+- the required `clipboard` or `monochrome_emoji_fonts` feature is absent from the selected
+  native/egui feature set.
+
+The lockfile is committed. A fresh clone with `cargo fetch --locked` is the publication
+reachability test.
+
+### 3.5 Feature policy
+
+The current feature lists are explicit. Migrate to 0.37 with these decisions:
+
+- workspace `egui`: `default-features = false` and features `["default_fonts",
+  "monochrome_emoji_fonts"]`;
+- native `apps/filmcraft`: keep `default_fonts`, `wgpu`, `accesskit`, `wayland`, `x11`, and
+  **add `clipboard`**. Without `clipboard`, eframe 0.37's `egui-winit` uses the in-app
+  fallback clipboard, so cross-application text copy/paste silently stops working;
+- `crates/ui-egui`: keep `default_fonts`, `wgpu`, `accesskit`; the native app root is
+  authoritative for OS clipboard;
+- web `apps/filmcraft-web`: keep `default_fonts`, `wgpu`; the eframe `clipboard` feature is
+  native (`egui-winit`) and is not added to wasm. Verify browser clipboard behavior in the
+  browser workflow instead;
+- do **not** add `system_fonts`; do **not** add `links` or `web_screen_reader` by accident.
+  Record them as deliberate opt-outs in the PR (`links` is not used; `web_screen_reader` is
+  a separate speech/accessibility decision, not part of this migration). Revisit only with
+  measured evidence.
+
+`monochrome_emoji_fonts` is not implied by `default_fonts` in 0.37. It must be explicit;
+otherwise the bundled `NotoEmoji-Regular`/`emoji-icon-font` faces disappear and symbols such
+as `✔ ✓ ✖ ⚡ ⚠ ⚙ ♪ ☑` can become tofu or switch to a platform face.
+
+These feature decisions apply to production roots. They do **not** flow through
+`egui_kittest`: its normal `egui` dependency is `default-features = false`, and only its own
+dev-dependencies enable fonts, which do not propagate. Test roots must enable the features
+explicitly or install controlled fonts (§11.1).
+
+## 4. Lifecycle and root-Ui design
+
+### 4.1 Rule: logic is idempotent background; UI is composition; input is pass-0 only
+
+Introduce private `FilmcraftApp::run_logic_frame(&mut self, ctx: &egui::Context)` and
+`FilmcraftApp::run_ui_frame(&mut self, ui: &mut egui::Ui)`:
+
+- `App::logic` runs `run_logic_frame` on **every** call. Under this pinned eframe/egui
+  integration, native and web call `App::logic` once per `run_ui` layout pass, and also call
+  it through `run_logic` for hidden ticks. Therefore `run_logic_frame` must be safe to call
+  more than once per frame:
+  - background queues are consumed (`try_recv`, `drain`, `Option::take`), so a second call
+    sees no work;
+  - playback/trim/autosave/deadline work compares a monotonic host time and computes an
+    idempotent target; calling it twice at the same instant does not advance twice;
+  - engine events are drained once and processed as values, not replayed;
+  - no logic path reads UI input events, `consume_key`, `Response`, or stale input time.
+- `App::ui` runs only `run_ui_frame`. Fresh-input handling (drops, shortcuts, `begin_press`,
+  Escape, IME/focus, synthetic queue, screenshot request dispatch) runs in **pass 0** of a
+  UI pass, where events are fresh. Pass 1+ has no events and must not re-derive them.
+- `raw_input_hook` runs before each UI frame **and** before each `update_logic_only` tick
+  (eframe `prepare_raw_input`). It must therefore advance at most one synthetic gesture step
+  per call and leave that step in app state until a full UI pass consumes it; repeated hidden
+  logic ticks must not drain a whole press/release sequence or inject it twice.
+- `run_logic_frame` is wrapped in `catch_unwind` with a latch: an unwinding logic pass sets
+  `ui_error`, stops playback and does not re-run the same panicking code every tick or
+  re-log it every pass. `run_ui_frame` keeps its catch around `frame(ui)` and the graphics
+  notice.
+- `on_exit` stays in `FilmcraftApp` and calls `session.shutdown()` exactly once.
+
+No `ui_pass`/`hidden_tick` predicate based on `viewport.visible()` is used. Visibility is
+used only for presentation policy (for example whether a hidden window should be raised),
+never to infer that the current pass has no input or that background work is complete.
+
+### 4.2 Hidden work and monotonic time
+
+`Context::run_logic` leaves `InputState` events and time at the previous pass. Therefore:
+
+- all background code uses a monotonic host clock (`web_time::Instant` on all targets, or a
+  small `Clock` wrapper around it); no hidden work uses `ctx.input(|i| i.time)`;
+- background code never reads `i.raw.events`, never calls `consume_key`, and never polls
+  `Response`/`read_response`;
+- input-dependent work is in `App::ui` pass 0, not in logic and not inferred from a
+  visibility flag;
+- `Window::show`, `Area::show`, and any other widget construction run only inside a UI pass;
+  they are never called from `run_logic_frame`;
+- control `ui.*` requests and gesture stages that need composition while hidden use
+  `ViewportCommand::RequestPaintWhileHidden` (see §4.5). A screenshot request already causes
+  the needed paint.
+
+A regression test exercises visible single/multipass, repeated hidden logic ticks, a forced
+hidden UI paint, restore with buffered events, a background completion between passes, and
+one gesture yielding one command/undo.
+
+### 4.3 Do not use `Context::root_ui` recursively
+
+`Context::root_ui` panics if called while `App::ui`/`Context::run_ui` already holds the root
+`Ui` (upstream #8535). FilmCraft does not need it. Keep passing the existing `&mut egui::Ui`
+to `header::show`, `dock_area`, `panels::*` and dialogs. Where a helper takes
+`&egui::Context` only to add widgets, change it to take `&mut egui::Ui` (or return an
+action/shape), not a `Context` bridge.
+
+### 4.4 Multi-pass actions: no clearing on a no-event pass
+
+Immediate mode plus `request_discard` means a UI handler can run in a pass whose output is
+discarded. FilmCraft's project mutations must run once, and must not be lost.
+
+Design:
+
+- Add a frame-scoped `pending_ui_actions` queue and an `input_generation` counter in
+  `crates/ui-egui/src/lib.rs`. Each action carries a stable `ActionKey` (command, target
+  identity, payload digest) and the generation in which it was queued.
+- Input-driven handlers queue only in UI pass 0. Pass 1+ receives no events, so it cannot
+  re-derive a click or key.
+- **Never clear the queue at the start of pass 1+.** There is no reliable way to predict a
+  future discard from inside pass 0; `ctx.will_discard()` describes the current pass's
+  output, not the next pass.
+- Dispatch policy:
+  - input-driven actions execute at the end of pass 0 (the pass that saw the events); the
+    empty-event pass cannot recreate them, so this is exactly once;
+  - actions that must observe final layout (dialog OK/Apply/close, dock reflow, actions that
+    close a panel) stay queued across discarded passes and are drained at the end of the
+    first pass whose `ctx.will_discard()` is false;
+  - a duplicate enqueue in a later pass coalesces by `ActionKey`; it is never used as a
+    reason to drop the original;
+  - if a frame ends with deferred actions still pending (for example an abnormal maximum-pass
+    exit or a caught panic), do not silently drop them: keep them, surface a visible status
+    error, and dispatch once at the next safe pass. A test forces this path.
+- `cancel_value_drag` (Escape drag rollback) is also pass-0-aware. In pass 0, if
+  `pointer.any_down() && key_pressed(Escape)`, latch `escape_cancel` together with the undo
+  mark. Apply the rollback once after the final UI pass (or after pass 0 when no discard
+  occurred), then clear the latch. The final pass has no key event, so it must use the latch,
+  not re-read `ctx.input`. The latch is scoped to the active press transaction; it does not
+  cancel unrelated queued actions.
+- `begin_press` runs before UI in pass 0; `cancel_value_drag` sees the corresponding mark and
+  runs once.
+
+Tests: click + forced discard = exactly one command/undo step; click on a `Grid` first-show
+frame; key shortcut + forced discard; Escape drag + forced discard; two queued actions with
+the same key coalesce; an abnormal pending queue is surfaced and dispatched exactly once.
+
+This replaces the reviewed design that cleared the queue on `pass_index > 0`; that design
+would have lost the user's click on every discarded frame.
+
+### 4.5 Screenshot callback, hidden paint and CL-2
+
+0.37 removes `egui::UserData` and `Event::Screenshot`; `ViewportCommand::Screenshot` takes a
+`ScreenshotCallback` (`crates/egui/src/data/screenshot_callback.rs`).
+
+Replace `lib.rs:1714 issue_screenshots` and `lib.rs:1744 collect_screenshots` with:
+
+- one CL-2 completion slot per request, owned by the request record; the live slot holds the
+  strong viewport waker (`Context` clone plus `ViewportId`, or `request_repaint` callback),
+  and the callback holds only a `Weak` slot;
+- `ViewportCommand::Screenshot(ScreenshotCallback::new(move |image| { /* complete the weak slot once, unlock, then wake */ }))`;
+- `ScreenshotCallback::new` does not request a frame when the data arrives. Completion must
+  unlock the slot and then call the stored waker; the callback has no repaint path of its own
+  and does not hold a strong `Context` or app reference;
+- `collect_screenshots` drains the result in logic and calls `control::save_screenshot(ctx,
+  &image, path, crop)` as today; after timeout/close/cancel, release the slot and ignore a
+  late image;
+- token/correlation still required: two queued screenshots may complete out of order; use
+  ownership plus the request ID, not callback order;
+- admission and memory limits from §3.3: four outstanding requests, 128 MiB per image, 256
+  MiB aggregate (a stricter documented cap is allowed), checked `width * height * 4`
+  reservation before issue, and revalidation/rejection after any resize/DPI/zoom epoch
+  change;
+- the issuance record binds the target-UI logical bounds and geometry epoch to the returned
+  pixels; a change back to the old geometry does not restore validity.
+
+Hidden-window semantics are the 0.37 behavior, not the old assumption:
+
+- `ViewportCommand::Screenshot` maps to `ActionRequested::Screenshot`/`PaintWhileHidden` and
+  makes the integration run a UI pass even when hidden; the callback is then completed from
+  that forced paint. A hidden pending screenshot is therefore expected to deliver an image.
+- A request that is still queued and not yet issued — settling frames or a hidden logic tick
+  — has no screenshot command to force its paint. Logic must send
+  `ViewportCommand::RequestPaintWhileHidden` while such a request is pending so the UI pass
+  that advances settling can run; once issued, the screenshot command itself forces paint.
+- `ViewportCommand::RequestPaintWhileHidden` is also the supported way to force a UI pass for
+  other stages that need composition/gesture handling while hidden (for example control
+  `ui.*` requests that need fresh layout or settling without a screenshot).
+- The screenshot timeout (`SCREENSHOT_TIMEOUT_S`) is a renderer/readback failure guard, not a
+  "hidden never presents" path. A test must not encode "hidden returns timeout" as normal
+  behavior. Test both branches: hidden + pending screenshot → image delivered, including the
+  queued-but-not-yet-issued settling case; hidden + no capture request → no capture (and,
+  where a request is admitted but the renderer cannot complete, the documented timeout
+  error).
+- `raw_input_hook` (`lib.rs:2092`) no longer preserves `Event::Screenshot`; it clears input
+  events as it already clears hovered/dropped files. Update
+  `crates/ui-egui/tests/ui_control_input.rs:153`: assert close/viewport metadata survive and
+  no screenshot event is expected; add a native/VM check that the callback still delivers.
+- `raise_for_control` (`lib.rs:1665-1673`) remains for occluded macOS raising without focus;
+  pair it with `RequestPaintWhileHidden` where a UI pass is required, rather than assuming a
+  hidden window never runs UI.
+
+### 4.6 Playback, audio, autosave, jobs, trim and deadlines
+
+- `advance_playback` (`lib.rs:1128`) sets the playhead from `anchor_tick + elapsed`; use a
+  monotonic host clock and do not accumulate dt. Repeated calls at the same time are
+  idempotent.
+- `playback_mix` remains the live project snapshot; audio callbacks are outside egui. Logic
+  keeps polling `audio.played_frames()` while hidden.
+- `FilmcraftApp::frames.pump` moves from `App::ui` to logic. The web runner's `WebApp::logic`
+  also pumps jobs/audio; its per-frame work must be idempotent because web calls logic per
+  pass.
+- Auto-save: `Session::poll_persistence` and `session.is_dirty` move to logic; the recovery
+  journal worker must not depend on painted frames.
+- `watch_jobs` splits: `poll_jobs` in logic handles completion and `play_after_render`; the
+  status-bar `job_status` remains in UI.
+- `trim_monitor::advance` (`lib.rs:1817`; `panels/trim_monitor.rs:39-48`) moves to logic and
+  uses a monotonic clock. `trim.tick` receives an idempotent target time/step, so a second
+  logic call for the same pass does not advance edits twice; it still requests repaint.
+- Metadata follow, `auto.begin_frame`, `sync_timeline_view` and `sync_native_menu` run once
+  in UI pass 0 (or are made idempotent if moved to logic).
+- Screenshot settling still waits for `monitor_inexact` and `timeline_still`, both updated in
+  logic/UI with the monotonic clock.
+- Add a CI grep that rejects direct `session.execute`, `menus::invoke` and `trim.tick`
+  execution from UI-only modules outside the queue/dispatch module and an explicit
+  allow-list. Until that check is green, the one-action guarantee is not claimed.
+
+## 5. Concrete API migration catalogue
+
+These are the source-grounded incompatibilities. Line numbers are baseline line numbers.
+
+### 5.1 `FontData` is a shared blob
+
+0.37 `epaint` has `pub type Blob = Arc<dyn AsRef<[u8]> + Send + Sync>` and
+`FontData::from_blob(Blob, index)` (`crates/epaint/src/text/font_data.rs`). Replace literal
+`FontData { font: Cow::... }` in:
+
+| File:symbol | Current code | Migration |
+|---|---|---|
+| `crates/ui-egui/src/cjk.rs:53` `find_system_font` | `FontData { font: Cow::Owned(face.data()?), index: face.info.index, ... }` | `FontData::from_blob(Arc::new(face.data()?), face.info.index)` |
+| `crates/ui-egui/src/i18n/mod.rs:292` `system_japanese_font` | `FontData { font: Cow::Borrowed(bytes), index: face.info.index, ... }` | `FontData::from_static(bytes)` (bytes are already leaked and shared) |
+| `crates/ui-egui/src/rtl.rs:92` `system_fonts` | `FontData { font: Cow::Owned(data), index: face.info.index, ... }` | `FontData::from_blob(Arc::new(data), face.info.index)` |
+
+Keep `Arc<FontData>` in `font_data` maps; `FontData` is cheap to clone now. Add a regression
+that a TTC face index is preserved (non-zero `info.index`), because the literal construction
+was the only place that carried it.
+
+### 5.2 `MouseWheel` gained `source`
+
+0.37 `Event::MouseWheel` has a required `source: MouseWheelSource`. Add
+`source: MouseWheelSource::Wheel` for the control-channel synthetic wheel in
+`crates/ui-egui/src/control.rs:370`, and to the two tests that construct it:
+`crates/ui-egui/tests/monitor_geometry.rs:176` and `crates/ui-egui/tests/panels_ui.rs:249`.
+Use `Wheel` rather than `Unknown` so ScrollArea behavior and kinetic-scroll policies match a
+real mouse wheel. Add a test that the timeline wheel path (`panels/timeline.rs:2221`) still
+steps one tab per notch and does not start kinetic scrolling in headless tests.
+
+### 5.3 `WidgetType` -> `Role`, and one role per control
+
+`WidgetType` is a deprecated alias of `accesskit::Role`; `SelectableLabel` no longer exists
+and `TextEdit` is `TextInput`. Replace the ten sites:
+
+| File:line | Current role | New role |
+|---|---|---|
+| `crates/ui-egui/src/dock.rs:673` | `WidgetType::Button` | `Role::Button` |
+| `crates/ui-egui/src/dock.rs:725` | `WidgetType::SelectableLabel` | `Role::Tab` with `selected(active)`; the code already overrides the node role to `Tab` |
+| `crates/ui-egui/src/dock.rs:765`, `:779` | `Button` | `Button` |
+| `crates/ui-egui/src/dock_ui.rs:326` | `Button` (floating-panel resize grip) | `Role::Button` with the accessible name "Resize panel". Do **not** expose `Splitter` here; a floating-window grip is not a pane divider. Dock split dividers use `Role::Splitter`; update `crates/ui-egui/tests/shared_docking_ui.rs:201` to the chosen role in the same PR |
+| `crates/ui-egui/src/panels/graphics.rs:1028` | `TextEdit` | `Role::TextInput` with a name |
+| `crates/ui-egui/src/panels/tools.rs:27` | `SelectableLabel` | `Role::Button` with `selected`; a radio-group model is a later accessibility change |
+| `crates/ui-egui/src/panels/monitor.rs:1013` | `Button` | `Button` |
+| `crates/ui-egui/src/panels/source_drag.rs:46` | `Button` | `Button` |
+| `crates/ui-egui/src/theme_favorites.rs:4` | `Button` | `Button` (favorite toggle; `CheckBox` is a later semantic change) |
+
+The previous `Button` vs `Splitter` contradiction is resolved: floating grip = `Button`;
+dock pane divider = `Splitter`. The test is updated once, not left ambiguous.
+
+### 5.4 `ScrollArea::State::offset` is private
+
+0.37 provides `clamped_offset()` and `unclamped_offset()`; the old `offset` field is private.
+Replace `crates/ui-egui/src/panels/media_browser.rs:576` and
+`crates/ui-egui/src/panels/project_views.rs:516` (`out.state.offset.x`) with
+`clamped_offset().x` for header alignment. Add a test that scrolls the project list
+horizontally to the end and asserts the header’s first column x matches the last visible
+row’s column x within one point.
+
+### 5.5 `Context::run_ui` callback is `&mut Ui`
+
+`crates/ui-egui/src/lib.rs:2411` currently writes:
+
+```rust
+let mut out = ctx.run_ui(raw, |ctx| secondary = ctx.input(|i| i.pointer.secondary_clicked()));
+```
+
+Change to:
+
+```rust
+let mut out = ctx.run_ui(raw, |ui| secondary = ui.ctx().input(|i| i.pointer.secondary_clicked()));
+```
+
+The other `run_ui` call sites already use `|ui|`. Do not call `Context::root_ui` inside these
+closures.
+
+### 5.6 `Id::new` and `Ui::id`
+
+0.37 deprecates `Id::new` and `Ui::id` (`Id::unique` / `Ui::scope_id`). FilmCraft has 403
+`Id::new` occurrences across `crates/ui-egui/src` and tests. Under `clippy -- -D warnings`,
+deprecation is a hard failure.
+
+- `egui::Id::new(x)` -> `egui::Id::unique(x)` for every root id; same hash, same identity.
+- `Id::new(parent).with(child)` -> `Id::unique(parent).with(child)`.
+- `UiBuilder::id(x)` -> `UiBuilder::scope_id(x)`; FilmCraft uses `id_salt` and has no
+  `UiBuilder::id` (verified), but `craft-ui` PR #199 performs its own conversion.
+- `Ui::id()` -> `Ui::scope_id()`; FilmCraft has no `ui.id()` call (verified).
+- Keep `id_salt` for child UIs; do not replace every `id_salt` with a global id.
+
+Add a grep-based CI check that no `Id::new(` remains in FilmCraft or its tests.
+
+### 5.7 `Event::PasteImage`
+
+0.37 emits `Event::PasteImage(Arc<ColorImage>)` when the clipboard has no text. Update
+`crates/ui-egui/src/lib.rs:2299` `clipboard_events_as_keys` to map `PasteImage` with
+`command` to `Key::V`, with `shift` to `Key::Insert`, and plain to `Key::Paste`, exactly as
+`Event::Paste`. Add tests alongside `ctrl_c_x_v_become_key_presses`.
+
+The native app’s `clipboard_media` hook (arboard) still supplies files/images to the Paste
+command. On wasm, either keep the existing “FilmCraft clips only” path or extend
+`ClipboardMedia` with the `PasteImage` bytes; that is a separate feature decision. Do not
+double-read the clipboard if the event already carries an image.
+
+### 5.8 `Event::Screenshot` / `UserData`
+
+Covered in §4.5. Remove `egui::UserData::new` at `lib.rs:1721` and the `Event::Screenshot`
+matches at `lib.rs:1753` and `lib.rs:2100`.
+
+### 5.9 Other 0.37 changes that are compile-compatible but visible
+
+- `default_fonts` off by default: explicit feature; `monochrome_emoji_fonts` explicit (§3.5,
+  §6.1).
+- `clipboard` opt-in in eframe/egui-winit: native feature added (§3.5).
+- `Id` deprecations (§5.6).
+- `Panel` constructors take `impl AsIdSalt`: FilmCraft does not use `egui::Panel`, but
+  `craft-ui` and any new panel code must use the new form.
+- `UiBuilder::scope_id`: see PR #199.
+- `ComboBox` is built from atoms and takes `IntoAtoms`; existing `selected_text`/`show_ui`
+  calls remain source-compatible, but styling/measurement changes must be reviewed.
+- `WidgetType::TextEdit` renamed to `Role::TextInput`; `TextEdit` itself uses
+  `Role::TextInput`.
+- `Context::root_ui`/`run_pass`: not adopted; no recursive root UI.
+- `ViewportCommand::Screenshot` callback and `RequestPaintWhileHidden`: adopted as above.
+- `egui::Event::PasteImage`, `MouseWheelSource`, PRIMARY selection: adopted as above.
+- kittest 0.37 hard-fails input widgets without accessible names (#8589/#8611). The first
+  green compatibility stage must name all input widgets, including all 56 `TextEdit`
+  construction sites; do not disable strict naming globally.
+
+## 6. Fonts, glyph coverage, language and RTL
+
+### 6.1 Font installation and bundled coverage
+
+`crates/ui-egui/src/theme.rs:420` `install` builds `FontDefinitions`, inserts Inter/JetBrains
+Mono, then appends Japanese craft-fonts (`add_craft_fonts`), Chinese (`cjk::install`) and RTL
+(`rtl::install`). Keep that order.
+
+The explicit `default_fonts` feature preserves egui’s built-in fallback, but in 0.37 the
+monochrome emoji faces moved behind `monochrome_emoji_fonts`. Enable it explicitly. FilmCraft
+starts from `FontDefinitions::default()` and uses `✔ ✓ ✖ ⚡ ⚠ ⚙ ♪ ☑` (20 occurrences across
+10 files); with `system_fonts` off, those symbols can otherwise become tofu or switch to a
+platform face. Add a glyph-coverage assertion for exactly these characters plus a screenshot
+diff.
+
+### 6.1.1 Deliberate visible `▸` → `>` substitution
+
+The integrated tree replaces the user-visible chevron U+25B8 (BLACK RIGHT-POINTING SMALL
+TRIANGLE) with ASCII `>` in 38 lines across 18 files: status, toast and error hints that
+point at menu paths (`Settings ▸ Audio Hardware`, `File ▸ Link Media…`, `Export ▸ Hardware
+encoding`, `Project Settings ▸ Scratch Disks`, `Text to Speech ▸ Download natural voices`),
+the matching i18n source keys and translation rows, and the mixer post-fader insert prefix
+(`▸ ` → `> `). One `# View ▸ Reset Interface Zoom` header comment in each language file was
+updated for consistency; Rust doc comments were left unchanged.
+
+This is deliberate tofu avoidance. FilmCraft installs Inter at the front of the proportional
+family and `FontDefinitions::default()` then falls back to Ubuntu-Light, egui-icons and the
+monochrome emoji faces; none of those contains U+25B8 (verified from each bundled font's
+`cmap`), and `system_fonts` stays disabled, so proportional menu-path text could show a
+missing-glyph box. JetBrains Mono and Hack do cover U+25B8, but the substitution is global so
+the same hint reads identically in every family. ASCII `>` is used because every bundled face
+has it. This is a source-level decision; no visible GUI comparison has been recorded yet, so
+it remains part of the visible-GUI acceptance gate below.
+
+`FontData` construction is §5.1. Keep the process-wide caches (`OnceLock`) and the single
+system scan; do not call `filmcraft_text::fonts::scan_system()` in a UI pass.
+
+`eframe` 0.37 adds an optional `system_fonts` feature (fontique provider, #8512) and a
+`system_font_fallback` option. **Do not enable it in the migration.** It changes startup cost
+and the fallback face chosen for a missing glyph; the current explicit CJK/RTL fallback is
+part of FilmCraft’s visual contract. Record it as an opt-in follow-up with measured startup
+and glyph coverage, especially for color emoji; do not accept clamp-only as a substitute for
+texture wrap/filter semantics.
+
+Pinned test fixtures are the exact set from the egui plan §10.6, fetched into the task’s
+evidence fixture directory with their licence files. **Do not copy font binaries into this
+repository.** The fixture set is:
+
+| Fixture | Source | SHA-256 | License |
+|---|---|---|---|
+| Arabic | craft-fonts `2481a8a324b986a45954e90045ed1f8f2efaaf3c` `fonts/noto-sans-arabic/NotoSansArabic.ttf` | `63111b5b2e074dd48cc67692e0a2726d86ee94c1c37fe8598257b7b4e87e869e` | OFL-1.1, adjacent `OFL.txt` |
+| Thai | same craft-fonts `fonts/noto-sans-thai/NotoSansThai.ttf` | `5a1c559bb539583c8a1fd99d1c5b9491e5e14478c9cd2bd0970d5c3096cc9ef8` | OFL-1.1 |
+| CJK SC | same craft-fonts `fonts/noto-sans-cjk-sc/NotoSansCJKsc-Regular.otf` | `2c76254f6fc379fddfce0a7e84fb5385bb135d3e399294f6eeb6680d0365b74b` | OFL-1.1 |
+| Japanese | same craft-fonts `fonts/biz-ud-pgothic/BIZUDPGothic-Regular.ttf` | `258d7156c165f2ff774b6efee637c22c3b950de0d8a10e501137061bc8085d01` | OFL-1.1 |
+| Hebrew | google/fonts `8b0a1d0f5983c89bc2b93f1b5fb55f9e252744b5` `ofl/notosanshebrew/NotoSansHebrew[wdth,wght].ttf` | `7ef36a2c3593758cdb622e1bdef4f84523e92fbc3ccc667438dd80ff54c2de88` | OFL-1.1; fix axes weight 400/width 100 |
+| Color emoji | googlefonts/noto-emoji `22e564626297b4df0a40570ad81d6c05cc7c38bd` `fonts/NotoColorEmoji.ttf` | `39ee3c587e10e89669b9ff32703261d10d5f9c4dd5ad147b6b5a1c5200591817` | OFL-1.1 |
+| Bundled Latin/emoji | candidate `epaint_default_fonts` `Ubuntu-Light.ttf` | `80307b8da7649aa4ee4d484b232140e3ce1ec0ca093073d3c53c8f5a5ced7a70` | Ubuntu Font License, adjacent `UFL.txt` |
+| Bundled mono emoji | candidate `epaint_default_fonts` `NotoEmoji-Regular.ttf` | `415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5` | OFL-1.1 |
+
+The fixture bytes and licence hashes enter the evidence manifest. A controlled comparison
+uses a fixed common set; a separate default-policy visual comparison records each
+baseline/candidate policy. System-provider tests are a nondeterministic integration row with
+OS/font inventory recorded, not pixel-golden input.
+
+### 6.2 UI language and AccessKit language
+
+FilmCraft’s `i18n::Language` is a private list (`crates/ui-egui/src/i18n/mod.rs`,
+`Language::ALL`; 12 languages, no Arabic/Hebrew UI). Add `Language::bcp47()` returning proper
+tags (`en`, `ja`, `es`, `pt-BR`, `uk`, `zh-CN`, `de`, `ru`, `fr`, `id`, `it`, `ko`). Call
+`ctx.set_language(Some(tag))` when the language changes and `frame.set_ui_language(Some(tag))`
+in `App::ui` (fork E18) so the AccessKit root and the web hidden IME input use the same tag.
+In kittest, `Frame::set_ui_language` is a no-op; the `ctx.set_language` call is the tested
+path.
+
+Do not enable `Style::right_to_left` (fork E9) yet: FilmCraft offers no RTL interface
+language, and mirroring the custom-drawn workspace without a full RTL audit would be worse
+than leaving it LTR. Document RTL UI as a future feature gated on real translated layouts.
+
+### 6.3 Document RTL and the fork’s bidi work
+
+`crates/ui-egui/src/rtl.rs` currently compensates for 0.36’s lack of bidi: `line_sections`
+splits RTL runs into words, reverses them, mirrors brackets and gives each word its own
+`LayoutSection`. The fork (E5/E12) performs UAX #9 shaping and visual ordering itself. Keeping
+both is a double-reversal bug.
+
+In P1, in the same stage that pins the fork, change `rtl::Lines`:
+
+- keep `has_rtl` and the `rtl` alignment flag;
+- build one `LayoutJob` with `direction: TextDirection::Auto`,
+  `halign: if rtl { Align::RIGHT } else { Align::LEFT }`, `halign_min_is_start: true`, one
+  section, and the requested wrap width;
+- delete `line_sections`, `mirror`, `in_word`, `line_ranges` and their unit tests once the
+  fork is pinned; replace them with tests on `Row::rtl_paragraph`, `Row::visual_order`, glyph
+  order and right alignment;
+- keep `paint`/`paint_line` API so `timeline_captions.rs:152` and `text.rs:239` do not change
+  contracts.
+
+The fork's E5/E12 path and the removal of the manual reversal must ship in the same P1
+commit set; there is no intermediate state with both active. A negative regression first
+demonstrates the double ordering (Arabic caption with the fork produces reversed words), then
+P1 removes it. Test `"كلمة أخرى"`, `"قال FilmCraft 0.6 جيد"`, Arabic-Indic digits, brackets
+and an LTR paragraph containing an RTL phrase; assert the leftmost drawn glyph of the first
+visual word, not just “some Arabic glyph exists”.
+
+`TextEdit` keeps logical order; fork E13/E16 add grapheme/bidi-safe caret movement. Test
+caption text editing (logical caret, Delete/Backspace, Home/End) and selection rendering.
+
+## 7. Input, IME, clipboard and PRIMARY
+
+### 7.1 Keyboard
+
+`handle_shortcuts` (`lib.rs:1546`) already uses `i.consume_key` and a panel/app-wide
+specificity sort. Fork E19 adds `RawInput::keyboard_layout_is_latin` and
+`latin_layout_chars`; `handle_shortcuts` must use the Latin-layout character for letter
+shortcuts when the active layout is not Latin, so `Ctrl+Z` still undoes on a
+Russian/Arabic/Hebrew layout and an unmodified `Z` does not become a tool shortcut. P7
+held-key pairing keeps a key's emitted egui identity for its release when the layout or
+modifiers change, clears it on focus loss/IME/destruction, and does not redefine winit's
+live `logical_key`. Add a kittest that constructs `RawInput` with
+`keyboard_layout_is_latin: Some(false)` and
+`latin_layout_chars: vec![(Key::Q, 'q'), ...]`, sends a physical key, and asserts the command
+fires only for a Latin-letter key. Do not hard-code a platform.
+
+Input handling remains in `App::ui` pass 0, where the event list is fresh; pass 1+ must not
+re-run it.
+
+### 7.2 IME and outgoing surrounding text (E21b/P7b)
+
+Fork E6 (request_focus does not interrupt composition), E8 (TextEdit glyph clipping), E21
+(`ImeEvent::DeleteSurroundingBytes`) and winit W18-W27 cover Windows/X11/Wayland/macOS IME.
+The candidate has a confirmed gap: winit W27 exposes
+`WindowExtWayland::set_ime_surrounding_text`, but egui-winit never calls it, and
+`egui::IMEOutput` carries no logical text. E21 alone carries incoming deletion/commit only.
+
+This migration therefore requires **E21b/P7b** before acceptance. The authoritative
+contract is the complete E21b section of `egui/docs/egui-037-migration-plan.md` plus
+`winit-review-triage.md`; these bullets are FilmCraft's adoption summary, not a weaker
+restatement:
+
+- `IMEOutput` carries one atomic descriptor: owner/context-generation identity plus the
+  surrounding-text state and payload. The owner generation is present **even when the state
+  is `Unavailable`**; an available empty document is distinct from unavailable support and
+  is sent as an explicit empty payload, not omitted.
+- add a bounded transient payload of at most **4000 UTF-8 bytes**, extracted at valid UTF-8
+  boundaries **without allocating a full document copy**, with indices remapped after
+  excluding preedit. If the selection cannot fit, emit explicit `Unavailable` rather than
+  presenting a truncated selection as complete. Keep `Clone`/`Eq`, update `Copy`-dependent
+  callers, and keep transient text out of Debug, serialization and persistence.
+- built-in `TextEdit` produces committed logical text after applying deletion/commit/cursor
+  updates, excluding preedit, with UTF-8 byte cursor/anchor indices; password fields emit no
+  text. Normal-to-password, no-IME, focus-loss/reset, owner-change and unavailable
+  transitions clear old backend text; each payload belongs to the current IME-owning
+  widget/viewport.
+- W27 gains an explicit owner/support transition: clear its cache and commit a
+  disable/enable boundary before publishing a new owner or support state. Merely changing
+  purpose or sending empty text does not clear protocol state. Available-empty maps to
+  `set_surrounding_text("", 0, 0)` plus commit; unavailable omits `set_surrounding_text` and
+  uses the committed clear boundary; when support returns, enable plus the full payload
+  precedes commit. Cancel the old preedit without inserting it into the new owner.
+- egui-winit appends the latest completed pass's IME descriptor, owner and payload together,
+  including an authoritative `None`; a previous payload must not survive a later
+  non-text/password/`None` pass. The same finalized output and payload are appended
+  together across passes.
+- on a current-epoch text-input-v3 `done` with a mismatched serial, apply the incoming edits
+  **once** and defer outgoing state until a matching serial. Obsolete owner/focus epochs
+  invalidate their pending batch; a current-generation serial mismatch is not a reason to
+  drop valid edits.
+- the egui-winit Wayland adapter calls W27 with the transient payload on text, selection or
+  IME-owner change, per window and owner; macOS NSRange conversion remains a separate W26
+  path, not a claim of a new macOS API.
+
+FilmCraft’s own custom `IMEOutput` producer is at
+`crates/ui-egui/src/panels/graphics.rs:933-940`. It must supply the logical model text, the
+preedit, and UTF-8 byte cursor/anchor ranges from its own scalar/grapheme coordinates; it must
+not pass display-bidi text or a `None` placeholder. Its integration test must reject a
+split-UTF-8 range and verify the model range maps to the emitted byte range. Built-in
+`TextEdit` consumers in FilmCraft (caption, notes, search, metadata) inherit the producer and
+need tests rather than custom adapters; the same inheritance applies to LightCraft’s built-in
+consumers. The suite inventory of custom producers is WordCraft `canvas.rs` (two),
+VectorCraft `canvas.rs`, FigCraft `shortcuts.rs`, EffectCraft `viewer_text.rs`, FilmCraft
+`graphics.rs`, DesignCraft `canvas.rs`, DeckCraft `canvas.rs` and PhotoCraft `type_tool.rs`;
+each needs its own adapter and test.
+
+Required tests: outgoing text changes immediately after delete+commit and deletion-only
+batches; scalar/grapheme vs byte indices; supplementary emoji/combining marks/RTL logical
+order; preedit exclusion and caret movement; long selection/window limits; same-window field
+switch; two windows; focus loss/reset/late serial; initial empty, available-empty → non-empty
+and unavailable/password → available transitions; multi-pass final-output selection where
+pass 1 is text and pass 2 is password, non-text or `None`. Native Wayland Vietnamese/
+predictive IME verifies the protocol trace and editor content/undo. Headless tests cannot
+prove native IME focus/composition.
+
+#### Film graphics IME ownership lifecycle
+
+Incoming `ImeEvent` carries no owner or epoch, so the custom Program-monitor editor keeps a
+local causal lifecycle: `Active(owner)`, `TerminalPending(owner)` and `Stale`. A non-empty
+preedit records `Active`; an empty preedit clears the visible composition but records
+`TerminalPending`, because its commit/delete is a separate event. A target change or editor
+close turns either state into `Stale`, so that pending terminal event cannot edit the
+replacement target. A rejected stale commit is itself the terminal boundary and consumes the
+tombstone immediately, allowing a preedit later in the same raw batch to start a new
+composition. A stale empty preedit or delete is only tentatively terminal: the tombstone is
+kept through the batch so a paired old delete+commit is rejected, and is consumed at batch end
+when no commit follows. A lone stale non-empty preedit keeps the tombstone across batches, so a
+preedit/commit pair split across batches cannot retarget either. This uses observed event order
+only, never frame/time heuristics. Regressions cover an empty preedit followed by a target
+switch before its commit, and a coalesced stale commit followed by a new preedit in the same raw
+batch. An entirely unobserved platform reset remains indistinguishable from a new composition;
+the first ambiguous composition after it may be dropped rather than claiming provenance.
+
+Platform rows:
+
+- Windows: Japanese and Korean IME in a caption/notes/search `TextEdit`; caret follows
+  composition; a key the IME consumes is not also a tool shortcut; commit adds exactly one
+  undo step.
+- X11: Vietnamese Telex; one input context per window; no duplicate letters.
+- Wayland: text-input-v3 surrounding text and delete-surrounding; no double commit; outgoing
+  bytes observed after commit/delete.
+- macOS: press-and-hold accents, dictation, ideographic space, first Korean key; real
+  hardware required.
+- Web: named keys are not typed as text; `lang` on the hidden input; IME commit in a text
+  field.
+
+### 7.3 Clipboard and PRIMARY
+
+0.37 adds PRIMARY selection (#8428). The production graph must integrate **both** E4 and
+W15P:
+
+- W15P adds a winit-owned PRIMARY path on the existing Wayland connection/event queue and
+  per-seat lifecycle, using SCTK 0.19.2’s existing `PrimarySelectionManagerState`, device,
+  source and offer support. PRIMARY is a distinct protocol object; do not bind a second
+  regular `wl_data_device`.
+- Egui 0.37 `get_primary`/`set_primary` routes through that path. E4 preserves password
+  exclusion and does not reclaim ownership for an unchanged selection.
+- FilmCraft also uses `arboard` directly for files/images (`apps/filmcraft/src/main.rs`
+  `clipboard_media`). The arboard/smithay PRIMARY path is a measured fallback only if the
+  winit path cannot meet a proven requirement; it is not the planned end state and it is not
+  accepted merely by documenting a GNOME limitation.
+
+Required native matrix, on X11 and Wayland, under wlroots (Hyprland/Sway), KWin and Mutter
+with supported capabilities recorded:
+
+- keyboard- and pointer-triggered selection plus middle-click paste at the clicked position.
+  A PRIMARY request uses a fresh serial from the event that triggered it; the protocol
+  explicitly allows pointer-driven selection and `set_selection` takes the triggering
+  event's serial. Do not impose a keyboard-only serial rule;
+- serial freshness, owner/seat changes, empty/absent offers, self-paste;
+- password selection never offered;
+- unchanged selection does not reclaim ownership;
+- bounded asynchronous transfer: total deadline **2 s**, **16 MiB** cap, at most **4 read
+  workers** and **2 writer threads** with queue depth **8**. Copy/PRIMARY ownership claims
+  stay synchronous on the fresh triggering input turn (validate serial/seat, reserve bytes,
+  create the source, call `set_selection`); only pipe serving and potentially blocking reads
+  are asynchronous;
+- a caller-owned live completion handle records the target window, input generation and an
+  owner-specific waker, wakes only that viewport, and is held weakly by workers. Canceled,
+  stale or superseded results are discarded and release their resources; no arbitrary
+  first-seat fallback;
+- slow, trickling, oversized, canceled and failed transfers release/complete exactly once;
+- text copy/cut/paste and Paste/Paste Insert/Paste Attributes;
+- file list and image paste through arboard, not duplicated by egui’s image paste;
+- Windows `Ctrl+Insert`, `Shift+Insert`, `Shift+Delete` still map through
+  `clipboard_events_as_keys`;
+- `Event::PasteImage` maps to `Key::V` and does not produce two Paste commands.
+
+## 8. Panels, geometry, docking, viewports and GPU resources
+
+- `dock_ui.rs:190` `dock_area` calls `dock::layout_with_actions` for a manual rect tree, then
+  `panel_body` (`:144`) creates `ui.new_child(... id_salt(...))` and sets clip rects. 0.37’s
+  `Panel` API is not used; keep the manual layout, but verify that `Ui::new_child`/`scope_id`
+  and the improved panel clip rect (#8562) do not change body rects.
+- Floating groups use `egui::Area` with `Order::Middle`; layer order is read through
+  `ctx.memory(|m| m.layer_ids())` (`dock_ui.rs:173` `floating_order`). Check the 0.37 layer
+  iteration API and z-order after the bump; `ui_dock_resize.rs` and `shared_docking_ui.rs`
+  cover focus, resize, detach, close/reopen and tab reorder.
+- `dock.rs` draws custom tabs and registers automation ids. Keep stable ids
+  (`panel.tab.*`, `timeline.tab.*`, `panel.menu.*`, `panel.float.*.resize`) and use
+  `Role::Tab`/`Role::Button` semantics. The `Tabs` tab strip is not an `egui::TabBar`; do not
+  replace it.
+- `ViewportCommand` usage remains root-only: `Close`, `InnerSize`, `Focus`, `CancelClose`,
+  `Maximized`, `Fullscreen`, `StartDrag`, `CursorPosition`, `Screenshot`, and the new
+  `RequestPaintWhileHidden` for hidden composition stages. `ui.resize` and `ui.focus`
+  control methods keep their behavior; `control_input_only` must still preserve close and
+  viewport lifecycle metadata.
+- GPU: `FilmcraftApp::set_wgpu` receives `CreationContext::wgpu_render_state`;
+  `TextureHandle` and `GpuState`/`uploadedBytes` remain. `egui-wgpu` fork E2/E3 add surface
+  fitting and error scopes; they are relevant to large/odd windows. Do not change the
+  FilmCraft `wgpu 30.0.1` pin or the GPU compositor in the migration PR. The candidate’s own
+  lock resolves `wgpu 30.0.0`; FilmCraft’s lock is authoritative. Record the actual resolved
+  version and prove there is one source; do not claim the candidate lock’s version.
+  `perf.stats` `gpu.uploadedBytes`, transitions, `submitMs` and frame-cache counters are the
+  upload/GPU observables.
+
+## 9. Commands, undo, save and reopen
+
+The public contracts are:
+
+- every interactive action is a command registered in `crates/engine`; UI, CLI, MCP and the
+  control channel use the same ids;
+- `menus::invoke` dispatches UI-only commands and engine commands;
+- drag gestures are one undo step via `begin_press` and `cancel_value_drag`;
+- `file.save`, `file.saveAs`, `file.open`, `file.closeProject`, `file.revert` and recovery are
+  unchanged;
+- UI state (tool, workspace, dock layout, zoom, scroll, monitor settings) is serde in
+  `crates/ui-egui/src/state.rs`; project state is not UI state.
+
+Migration rules:
+
+- `begin_press` runs in UI pass 0 before any UI; `cancel_value_drag` runs once after the
+  final UI pass using the pass-0 Escape latch (§4.4).
+- Input-driven UI mutations dispatch once in pass 0; actions that must see final layout are
+  queued and drained on the first non-discarded pass. Engine commands from control/MCP/CLI
+  remain one-shot channel work in logic.
+- A forced two-pass click adds exactly one undo step and one project revision. A forced
+  two-pass click on a first-show `Grid` does the same. A forced discard during a drag with
+  Escape cancels once.
+- Save/reopen preserves an edit, an effect, a caption, and the dock/tab layout. Existing
+  `timeline_tabs_ui.rs:258` and `scripted.rs:548` patterns are the starting point; add an
+  effect/trim/save/reopen assertion and compare `sequence.inspect` and `project.inspect`.
+
+## 10. Fork and vendor patch provenance
+
+FilmCraft has no vendor directory. The suite forks carry behavior that FilmCraft either uses
+or must consciously not use. Keep the pins; do not delete unrelated fixes. The tables below
+name the aiongg research candidate for provenance only; production pins are G-PINS.
+
+### 10.1 `aiongg/egui` `craft/0.37` (`a4f9a17f`, research)
+
+| Patch | Decision in this plan | Validation |
+|---|---|---|
+| E2+E3 egui-wgpu surface fit/error scopes | Keep; use for large windows and odd surfaces | Windows/Linux resize/VM; `ui.resize` to a large size; no `Wgpu` error |
+| E4 Wayland clipboard/PRIMARY | Keep; must be paired with W15P; the filmcraft#1115 problem is exactly this | Hyprland/KWin/Mutter copy/paste, PRIMARY matrix, file/image paste |
+| E5, E8, E12, E13, E14, E15, E16, E17, E20 | Keep; use them; remove FilmCraft’s manual bidi | Arabic/Hebrew captions, editing, alignment, screenshots |
+| E6, E21 IME | Keep; E21 alone is incoming only; E21b is mandatory | native IME rows plus outgoing-state tests |
+| E7, E19 non-Latin shortcuts and P7 held-key pairing | Keep; adapt `handle_shortcuts` to Latin-layout chars; retain the emitted egui key identity for a held physical key across layout/modifier changes and clear it on focus loss/IME/destruction | kittest + native layouts, repeat/unidentified keys |
+| E9 RTL UI mirroring | Keep in fork but do not enable `Style::right_to_left` | no RTL UI language yet |
+| E10 web key/lang fixes | Keep; test browser IME and named keys | `smoke.mjs` + manual browser |
+| E11 vello_cpu multithreading | Not exercised by FilmCraft; no local feature change | none |
+| E1 viewport hooks | Not used by FilmCraft; keep the fork patch | no FilmCraft test |
+| E18 `Frame::set_ui_language` | Use with `ctx.set_language` | language switch + AccessKit root |
+| E15 `LineBreaker`/`LayoutJob::language` | Optional; use only if document line breaking needs it | caption wrapping tests |
+| E21b/P7b outgoing IME surrounding text (P7b) | **Required new prerequisite**: the complete shared owner/support/serial contract, 4000-byte bounded payload without a full-document copy, TextEdit producer, Film graphics adapter and Wayland delivery | §7.2 tests; native Wayland trace |
+| P7c selected #8763/#8748 fixes | P7c owns the selected, tested #8763 selection-action and #8748 hidden parent/child fixes. #8764 remains an unmerged proposal at `6eb460a2a6d537d312a80579cb801895509deaed`, not a release fix | selection/pointer/keyboard and hidden-parent regressions |
+
+There is no E22. Do not invent fork APIs. A local workaround for #8763 needs a specific
+reason and removal condition.
+
+### 10.2 `aiongg/winit` `craft/0.30.13-lang` (`8b35388b`, research)
+
+Keep the whole pinned branch because E4/E19/E21/E21b require W15/W15P/W25/W26/W27,
+including the bounded W15P transfer path and the W27 owner/support lifecycle. For FilmCraft,
+exercise at least:
+
+- W1 mixed-DPI window rect; W3/W4 Windows IME/hidden maximized; W5/W20/W21 X11 IME;
+  W6-W10 macOS IME; W11 X11 DPI; W12 macOS titlebar drag; W13 Wayland scroll phase;
+  W15 Wayland drops/clipboard; W15P PRIMARY; W18/W19 Windows IME; W22-W27 language/IME.
+- W15P is required with E4 as described in §7.3, including per-seat lifecycle, password
+  exclusion, unchanged-owner behavior and slow/canceled transfer tests.
+- W14 macOS cancelable termination is opt-in; FilmCraft does not call that platform extension,
+  and its own close interception remains.
+- Do not enable W16 pinch/rotation or tablet input; no `craft-tablet` dependency exists.
+
+If the suite later replaces these forks with upstream releases containing the fixes, drop the
+corresponding patch rows only after the same tests pass; do not remove a patch just because a
+release number moved.
+
+### 10.3 `craft-libs` port
+
+Port only the selected PR-199 API hunks (`8614e4a`) and README changes (`1764bca`) onto the
+current published `4919088` tree. Preserve newer security/settings/docking/printing fixes,
+including the protected-group docking tests. Never merge `b68de8c` or `ec8840a` as trees. The
+CL-2/CL-2F helper is a separate reviewed addition, not part of the stale PR tree.
+
+## 11. Tests and observable assertions
+
+### 11.1 Required repository gates (managed, proposed)
+
+Every new host build/test and owned-VM command must use
+`maintenance/task.py run/status/finish` with its own task, job ID, source and evidence. The
+commands below are proposals for the parent to submit; they were not executed during this
+planning pass. Capacity must be inspected first; the suite snapshot had less than one default
+64 GiB build reservation available after existing reservations.
+
+```sh
+python3 /home/codex/work/maintenance/task.py run \
+  --job-id filmcraft-egui037-ci-01 --kind build \
+  --task filmcraft-egui037-migration \
+  --source /home/codex/work/CraftApps/egui037-migration-20261022/filmcraft-implementation \
+  --evidence /home/codex/work/ssd2/task-evidence/egui037-migration-20261022/filmcraft \
+  -- cargo xtask ci
+python3 /home/codex/work/maintenance/task.py status filmcraft-egui037-ci-01 --tail-bytes 8192
+python3 /home/codex/work/maintenance/task.py finish filmcraft-egui037-ci-01 --artifact-manifest /home/codex/work/ssd2/task-evidence/egui037-migration-20261022/filmcraft/artifacts.json
+# after inspecting the plan and preserving evidence:
+python3 /home/codex/work/maintenance/task.py finish filmcraft-egui037-ci-01 \
+  --artifact-manifest /home/codex/work/ssd2/task-evidence/egui037-migration-20261022/filmcraft/artifacts.json \
+  --apply --owner-confirmed --checks-complete --evidence-preserved
+python3 /home/codex/work/maintenance/task.py status filmcraft-egui037-ci-01 --tail-bytes 8192
+```
+
+Every job uses one unique resource task/fresh job ID/`--source`/`--evidence`; poll `status`
+until both the command and the finish outcome are known, and never treat `ok: true` alone as
+success.
+
+`cargo xtask ci` already runs fmt, clippy, tests, layers, assets and wasm; keep it as the
+authoritative gate. Also run, as separate managed jobs where a selected feature is not in
+default CI:
+
+- `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`,
+  `cargo test --workspace`, `cargo xtask layers`, `cargo xtask assets`, `cargo xtask wasm`;
+- with and without `CRAFT_FONTS_DIR` (pinned craft-fonts `abb83316d96aa59c1cf64784289e378fe9fa5695`);
+- `FILMCRAFT_REQUIRE_ORACLES=1` when ffmpeg is available;
+- `cargo metadata --locked`, the graph checks from §3.4, and the native `clipboard` +
+  `monochrome_emoji_fonts` feature assertions.
+
+Strict kittest naming and glyph behavior is part of the first green compatibility stage.
+Do not add a global `allow`/disable for missing names or missing glyphs. If a name/glyph is
+missing, fix the widget or fixture.
+
+**Font features do not propagate through kittest.** `egui_kittest`'s normal `[dependencies]
+egui` uses `default-features = false`; only kittest's own `[dev-dependencies]` enable
+`default_fonts` and `monochrome_emoji_fonts`, and a dependency's dev-dependencies do not
+propagate into a consumer. Every kittest/FilmCraft test root that needs the bundled faces must
+enable those egui features explicitly or install controlled fonts, and each actual graph must
+be inspected. The production feature policy in §3.5 does not reach the harness by itself.
+
+Windows uses a uniquely owned clone and the VM run/status/finish workflow, with the clone’s
+`Build-DesignCraft.ps1` equivalent for FilmCraft or the repository’s documented build helper.
+The baseline VM is not adopted or reused across tasks.
+
+### 11.2 UI, lifecycle and workflow tests
+
+Existing anchors to extend or keep:
+
+- `crates/ui-egui/tests/scripted.rs` `Driver::demo`, `frames`, `call`, `ok`, `exec`; add
+  multi-pass and save/reopen cases.
+- `crates/ui-egui/tests/ui_control_input.rs:153` screenshot/control isolation.
+- `crates/ui-egui/tests/ui_dock_resize.rs`, `shared_docking_ui.rs`, `timeline_tabs_ui.rs`.
+- `crates/ui-egui/tests/interface_zoom_ui.rs`, `settings_ui.rs`, `panels_ui.rs`,
+  `monitor_geometry.rs`, `timeline_trim_ui.rs`, `clipboard_paste_ui.rs`, `project_panel_ui.rs`.
+- `crates/ui-egui/tests/perf_ui.rs` monitor lag.
+- `crates/ui-egui/tests/robustness_ui.rs` hostile UI state.
+
+New/extended assertions:
+
+1. **Lifecycle:** visible single/multipass; logic called per pass but background effects are
+   idempotent; hidden `run_logic` ticks advance playback/autosave/workers/jobs without reading
+   input; forced hidden paint with a screenshot delivers an image; buffered input survives a
+   hidden tick and is handled once on the next visible pass; repeated hidden logic ticks keep
+   one synthetic gesture step pending and do not collapse press/release; a forced two-pass
+   click (including a first-show `Grid`) adds exactly one undo step; Escape drag cancels once.
+2. **Root UI/geometry:** at 1600×980 and 1920×1080, `ui.elements` rects for
+   `panel.Timeline`, `panel.Program`, `panel.Project`, `tools.Razor`, dock split handles and
+   floating grips match the baseline within 1 point; panel bodies never overlap the
+   header/status bar; tab overflow still reaches every tab.
+3. **Screenshot callback:** two queued `ui.screenshot` requests with different panel crops
+   return matching images/paths; a hidden screenshot delivers both when already issued and
+   when still settling (queued-but-not-issued), using `RequestPaintWhileHidden` in the latter
+   case; the weak callback wakes the live slot's waker after unlocking and never wakes itself;
+   a callback after timeout/close is ignored; the completion slot is dropped exactly once; any
+   resize/DPI/zoom change, including a change back, either retries within the deadline or
+   errors, never pairs old pixels with new geometry. Native VM test; headless test of the
+   correlation helper.
+4. **Scroll header sync:** after horizontal scroll, media-browser/project-list headers align
+   with rows (≤1 point); after rubber-band overshoot, the header uses clamped offset.
+5. **Accessibility:** for the demo workspace assert `Role::Tab`/selected on panel tabs,
+   `Role::Button`/selected on tool buttons, `Role::Button` "Resize panel" on the floating grip,
+   `Role::Splitter` on dock split dividers, and `Role::TextInput` with a non-empty accessible
+   name on caption/metadata/search fields. Use `Harness::get_by_label`,
+   `accesskit_node().role()`, `label()`, `toggled()`. All 56 `TextEdit` sites must be named;
+   add a negative control that removes a name and fails the strict kittest gate.
+6. **Fonts:** with `CRAFT_FONTS_DIR` and without, assert Japanese/Chinese/Korean/Arabic/Hebrew
+   sample text produces no missing-glyph UV and preserves the expected family/weight; assert
+   `✔ ✓ ✖ ⚡ ⚠ ⚙ ♪ ☑` coverage; assert a non-zero TTC face index survives `FontData`
+   construction. Fixtures and licences are pinned in §6.1.
+7. **RTL:** Arabic/Hebrew caption visual order, right alignment, bracket mirroring, digits and
+   a mixed LTR paragraph; editing caret/Home/End/Delete; compare glyph order, not just “text
+   present”.
+8. **IME/clipboard:** outgoing surrounding text after commit/deletion, preedit exclusion,
+   grapheme/byte boundaries, password clearing, same-window switch, two windows, late serial,
+   owner generation present when unavailable, available-empty vs unavailable and a
+   pass-1-text/pass-2-`None` final pass; synthetic `PasteImage` maps to Paste once; native
+   PRIMARY (keyboard and pointer serials, bounded transfer) and text/file/image paste matrix
+   from §7.3.
+9. **Save/reopen:** edit + effect + caption + tab layout, `file.saveAs`, `file.open`, equal
+   `sequence.inspect`/`project.inspect` and reopened tab order; undo/redo count exactly.
+10. **Mutation/negative probes:** a deliberately broken test-only flag that repeats a queued
+    action must fail the one-undo-step assertion; a screenshot with a wrong token/slot must not
+    be delivered to the wrong request; a scroll offset beyond content must clamp; a font face
+    with the wrong index must produce a distinct glyph or missing glyph and fail the coverage
+    test; removing an accessible name must fail strict kittest.
+
+### 11.3 Visual comparisons and tolerances
+
+Do not add committed screenshots unless they are needed; if added, they are original
+FilmCraft captures and need `.attribution` sidecars and `ATTRIBUTION.md` rows
+(`cargo xtask assets`). Prefer writing review PNGs to the durable evidence directory.
+
+For before/after review:
+
+- workspace chrome is custom-painted: mask only volatile monitor/video regions; use
+  PSNR ≥ 45 dB, max channel difference ≤ 12, p99 ≤ 2 for unchanged regions, and exact layout
+  rects within 1 point. These thresholds are provisional until the baseline report records
+  the noise floor of an unchanged build; record the reference measurement that sets them.
+- egui-drawn dialogs may move/resize because 0.37 changes button spacing and corner radius
+  (#8617, #8445): mask the dialog region or use p99 ≤ 8/max ≤ 32, and require human visual
+  review; do not auto-bless a changed golden.
+- Arabic/Hebrew captions get both a pixel check and a glyph-order assertion; pixel-only
+  comparison would hide double reversal.
+- A changed golden is never accepted merely to make CI pass; re-run and review.
+
+### 11.4 Native and browser workflows
+
+Native Linux (proposed, through the managed adapter; no raw `cargo run` outside task.py):
+
+```sh
+python3 /home/codex/work/maintenance/task.py run \
+  --job-id filmcraft-egui037-linux-ui-01 --kind build \
+  --task filmcraft-egui037-migration \
+  --source /home/codex/work/CraftApps/egui037-migration-20261022/filmcraft-implementation \
+  --evidence /home/codex/work/ssd2/task-evidence/egui037-migration-20261022/filmcraft \
+  -- cargo run --release -p filmcraft -- --control 9876
+python3 /home/codex/work/maintenance/task.py status filmcraft-egui037-linux-ui-01 --tail-bytes 8192
+# after the UI workflow, evidence capture and review:
+python3 /home/codex/work/maintenance/task.py finish filmcraft-egui037-linux-ui-01 \
+  --apply --owner-confirmed --checks-complete --evidence-preserved
+python3 /home/codex/work/maintenance/task.py status filmcraft-egui037-linux-ui-01 --tail-bytes 8192
+```
+
+Drive `ui.inspect`, `ui.screenshot`, `ui.resize`, dock actions, clipboard/PRIMARY, and review
+every PNG. Repeat under X11 and Wayland (and Hyprland for E4/W15P). Native Windows through a
+uniquely owned clone: build the task checkout, run `filmcraft-ui-egui` UI tests, launch with
+`--control`, capture screenshots, exercise IME and DX12/software graphics modes. macOS: real
+hardware for Cmd shortcuts, titlebar drag, Japanese/Korean IME and header drag; if no Mac is
+available, record macOS as unresolved, not passed.
+
+Browser (proposed; `cargo xtask web --serve` is a long-running server, so all steps run in
+one managed `task.py run` job with a trap that stops the server, then `status` and an attested
+`finish` after evidence review):
+
+```sh
+# payload inside the managed job, with exact --task/--source/--evidence and a fresh job ID:
+cargo xtask web --serve 8765 &
+SERVER=$!
+trap 'kill "$SERVER" 2>/dev/null' EXIT
+ffmpeg -f lavfi -i testsrc2=size=640x360:rate=30 -f lavfi -i sine -t 3 -c:v libx264 -pix_fmt yuv420p -c:a aac target/web/dist/web-test.mp4
+node apps/filmcraft-web/tests/smoke.mjs --url http://127.0.0.1:8765/ --media web-test.mp4 --out target/web/smoke
+```
+
+Run WebGPU and `?webgl`; inspect `report.json` and steps `01-demo` … `05-modes`; check
+`filmcraft.info()` for backend/compositor. A wasm compile is not runtime evidence; headless
+browser tests do not prove native focus/IME/file pickers.
+
+### 11.5 Environment provisioning gates
+
+No current runtime acceptance exists. The following are gates, not passes:
+
+| Environment | Current evidence | Required before claiming a pass |
+|---|---|---|
+| Linux X11 | No inherited `DISPLAY`; no Xvfb/window manager observed | Provision an isolated display/window manager, record versions, qualify native focus/clipboard/PRIMARY |
+| Linux Wayland | No inherited `WAYLAND_DISPLAY`; no compositor/input-method observed | Provision Weston/Sway/Hyprland/KWin/Mutter and an IME, record capabilities; run text-input and PRIMARY matrix |
+| Linux GPU | Parent inspection found i915 PCI `8086:3E96` and readable/writable `/dev/dri/renderD128`; worker sandbox may hide it; **do not claim the server has no GPU** | Managed renderer/device probe must identify the actual driver/backend; access alone is not GPU acceptance |
+| Windows | Sealed baseline uses Microsoft Basic Render Driver; a full clone may not fit current capacity | Allocate a unique full clone or a baseline-backed overlay with an adequate reservation; run visible edited/saved/reopened workflows, IME, DX12/software |
+| Browser | Wasm compile is not runtime evidence | Pin browser and adapter; run interactive WebGPU and WebGL2 fixtures; record raw/compressed wasm sizes and backend identity |
+| macOS / physical Windows audio/video | No qualified environment in this task | Real hardware access and owned evidence; software VM results do not qualify these rows |
+
+These rows remain explicit rollout blockers where unavailable. Do not report a GPU absent,
+a current runtime pass, or a platform gate as satisfied from source inspection alone.
+
+## 12. Performance: baseline, paired runs, thresholds
+
+### 12.1 Baseline before production edits
+
+Record before changing production code, on the exact baseline SHA and lockfile, as managed
+`task.py run` jobs (fresh job ID, exact `--source`/`--evidence`, `status`, then attested
+`finish --apply`). Submit each payload as
+`task.py run --job-id <unique> --kind build --task filmcraft-egui037-migration --source
+<checkout> --evidence <evidence> -- <payload>`; the commands below are payloads, not a
+raw-command exception:
+
+- `cargo xtask bench` with `--sections timeline,playback,scrub`, `--label
+  filmcraft-egui036-baseline`; GPU and `--cpu` runs. The timeline harness currently defaults
+  to 120 frames per view, 8 warmups (the `--repeat` value is a **run count**, not a sample
+  count) and emits only p50/p95, so extend `crates/ui-egui/examples/bench/sections.rs` to
+  accept the frame/warmup counts and emit p99 with exact sample counts **before** using it as
+  acceptance evidence. Run at least 10 warmups, 30 timed iterations per steady configuration
+  and at least 1,000 actual captured frames per view for any p99;
+- `cargo xtask bench-playback` for `demo`, `stack3`, `stack3-blend`, `h264-1080`, `h264-2160`,
+  `after-preview`, `seek-storm`, `--res full,half`, GPU and `--cpu`, with 10 warmups / 30
+  timed iterations per configuration where the harness supports them; p99 requires at least
+  1,000 frames;
+- native idle: no playback, no input, 60 s; record repaint count, process CPU, RSS;
+- startup: first present and `Renderer::new` timing on Windows DX12 and Linux Vulkan, from
+  20 fresh processes;
+- `perf.stats` before/after a fixed operation script (open demo, razor, undo, apply effect,
+  play 5 s, screenshot);
+- wasm raw and compressed sizes for the exact feature set.
+
+Record: exact SHA, `Cargo.lock` hash, feature set, `CRAFT_FONTS_DIR` revision, fixture names
+and hashes, OS/driver, GPU adapter/backend, DPI/scale factor, viewport size, profile (release),
+thread count, theme, warmups and repetitions, raw samples, median/p95/p99, peak RSS, idle
+repaint/CPU, operation latency, `gpu.uploadedBytes`, frame-cache entries, shapes/vertices, and
+load average. For allocation counts use `heaptrack` or `valgrind --tool=massif` on the Linux
+bench process; record peak/total allocations separately from product metrics. GPU uploads are
+reported by `perf.stats` (`gpu.uploadedBytes`) and frame-cache counters.
+
+### 12.2 Paired candidate runs
+
+Run the same commands against the candidate on the same machine and environment, alternating
+baseline/candidate where possible. Separate software-renderer (`--cpu`, llvmpipe/WARP) from
+real-GPU results; do not mix rows. Never benchmark concurrently with builds or another noisy
+workload and claim a small improvement. Preserve raw samples and the exact source/lock
+identity for both sides.
+
+Where the operation is equivalent, include a **stock 0.37 control** alongside 0.36 and the
+selected fork. Fork-only app code need not compile unchanged on stock; use the same operation
+in a pinned minimal adapter/harness and explain remaining semantic differences. Record all
+three source/lock identities; unavailable equivalence is an attribution limitation, not proof
+that an upstream regression is unavoidable.
+
+### 12.3 Predefined thresholds and noise policy
+
+These are the shared suite minimums; FilmCraft may tighten them, never silently loosen them.
+The stock-0.37 equivalent control and the first baseline report are required before any
+regression claim; thresholds and goldens are never auto-widened or auto-blessed to make a run
+pass.
+
+- **Sampling:** at least 10 warmups and 30 timed iterations for steady operations; at least 20
+  fresh processes for startup; at least **1,000 actual captured frames** per configuration for
+  any frame-distribution p99. A p99 from 20/30/50 samples is not a tail estimate. Report the
+  exact frame count and sample count in the report schema.
+- **Timeline UI** (headless kittest, 1000 clips/20 tracks, 1920×1080): median update/tessellation
+  ≤ +5%, p95 ≤ +10%, p99 reported and reviewed. Vertices/shapes must not grow without
+  explanation.
+- **Playback CPU** (`bench-playback` CPU ms/frame, worker/source columns): ≤ +3% median;
+  shown/dropped may vary with load and is not a gate alone.
+- **Peak RSS:** FilmCraft gate is ≤ +5% for the same scenario after subtracting the measured
+  noise floor; investigate any repeatable increase above the floor. Report absolute MB.
+- **Idle:** no extra repaint requests and no extra CPU when nothing is playing; a hidden window
+  keeps auto-save/playback semantics without busy-looping.
+- **Startup:** report first-present and `Renderer::new`; on Windows DX12 a +20 ms median or
+  more is a regression to investigate against #8736; do not silently accept it.
+- **Wasm:** record raw and compressed sizes; a size regression is reviewed, not hidden by a
+  compile-only check.
+
+If a threshold is exceeded, re-run alternating; if still exceeded, profile (`perf`, `tracy`,
+`heaptrack`/massif) and report. Never auto-accept a changed golden or call compile time UI
+performance.
+
+### 12.4 Separate workload rows
+
+Do not merge these into one number:
+
+- **#8731 text tessellation:** plain-text timeline/fixture workload (1000 clips/20 tracks,
+  1920×1080), compare unchanged 0.36, stock 0.37 and the fork; measure tessellation time and
+  text-heavy frame time separately. If confirmed, evaluate a row-level fast path and cached
+  color-glyph metadata; test mixed/color rows. Do not bless a regression.
+- **#8736 DX12 FXC shader compile:** Windows VM, measure `Renderer::new`/pipeline creation and
+  first present separately from steady frames, with predictable filtering disabled. Compare an
+  override-constant design with semantically equivalent wrap arithmetic only if needed;
+  clamp-only is not a valid Repeat/MirroredRepeat fix.
+- **#8512 system-font startup:** measure discovery/startup separately. The migration keeps
+  `system_fonts` off, so this is a controlled opt-in experiment, not a default change; preserve
+  glyph coverage and record provider inventory.
+- **Wasm/browser:** raw and compressed wasm size plus WebGPU/WebGL2 runtime frame timings from
+  the pinned browser environment; compile time is not UI performance.
+
+## 13. Implementation PR stages and dependency DAG
+
+No production stock-0.37 stage exists. The first production stage is the coherent fork graph.
+
+| Stage | Contents | Depends on | Rollback |
+|---|---|---|---|
+| P0 | This plan only; no code | — | delete document |
+| **P1** | **Atomic compatibility landing on the final fork graph.** Manifests/lockfile: final approved `storytold/egui` P8 + `storytold/winit` pins, final `storytold/craft-libs` revision (CL-1 + CL-2F), explicit `default_fonts`, `monochrome_emoji_fonts`, native `clipboard`, no `system_fonts`/`links`. API migration: `FontData`, `Role`/names, `ScrollArea`, `MouseWheelSource`, `run_ui` signature, `Id::unique`, screenshot callback + CL-2 helper, `PasteImage`, E21b custom IME adapter, bounded E4/W15P clipboard/PRIMARY routing, lifecycle split/multi-pass queue, strict kittest names/glyphs, and **removal of the manual `rtl::Lines` reversal and its unit tests**. Tests from §11. | P0; **G-PINS**, **G-CL2F**, published/reachable pins; capacity for gates | revert to the coherent 0.36.2 graph (`Cargo.toml`/`Cargo.lock` and source); keep old craft-libs `5c874d51` and `craft-docpath 82a24b0` |
+| P2 | Language and the full native input matrix: Latin-layout shortcuts, `ctx.set_language`/`set_ui_language`, and the full W15P/E4 PRIMARY and E21b native rows against the P1 integration. Fork bidi is already active in P1; P2 does not introduce a second bidi state. | P1 (fork already pinned) | revert P2; restore prior language/input behavior without changing the P1 dependency graph or re-introducing manual reversal |
+| P3 | Accessibility semantics beyond first-green naming: radio-group/tool semantics, richer role/value/label assertions, AccessKit language screenshots. | P1 | revert P3 |
+| P4 | Evidence hardening: visual/geometry/screenshot regression harness, mutation probes, performance baseline/candidate and stock control, wasm sizes, environment provisioning. | P1–P3 | revert P4; keep earlier behavior |
+| P5 | Documentation/rollout notes and optional measured experiments (`system_fonts`, color emoji, macOS). | P4 | revert P5 |
+
+Publication is not part of P0. Each future push/new PR requires fresh direct human approval
+after the parent shows the exact contents and validation. Do not include agent/model/tool
+signatures in PR text or commits.
+
+### Rollback set
+
+Keep the old coherent set recoverable:
+
+- `egui/eframe/egui_kittest = 0.36.2`;
+- `craft-ui` rev `5c874d51eeb3de70e735c8ce87a59a7dedd47675`;
+- `craft-docpath` rev `82a24b006eefa036b43c09a67fb9a3fbd17ffe63`;
+- registry `winit 0.30.13`, `wgpu 30.0.1`.
+
+A rollback is `git revert` of the stage commits plus restoring the baseline
+`Cargo.toml`/`Cargo.lock` (or `git checkout abf44fda -- Cargo.toml Cargo.lock` after reverting
+source changes). Do not keep a machine-local path patch as a fallback. A rollback rehearsal
+uses the preserved baseline executable/source and a separate managed allocation.
+
+## 14. CI, compatibility and publication checks
+
+- `.github/workflows/ci.yml` runs `cargo xtask ci` with pinned `CRAFT_FONTS_REF`; add the pin
+  checks from §3.4 and a `cargo metadata --locked` step.
+- Keep `freebsd.yml`’s skip-tests policy and `windows-arm64.yml` as-is; do not weaken them.
+- `cargo xtask wasm` must still check `filmcraft-ui-egui` and `filmcraft-web`; `egui_kittest`
+  is a dev dependency and remains native-only.
+- The web crate’s `wasm-bindgen` exact pin (`=0.2.129`) must match the installed CLI. The
+  candidate’s own lock uses `wasm-bindgen 0.2.126` and `web-sys 0.3.103`; FilmCraft currently
+  pins `web-sys 0.3.106` and `wasm-bindgen 0.2.129`. The `0.2`/`0.3` ranges are compatible,
+  but the final FilmCraft lock is authoritative: record the resolved versions and run
+  `wasm-bindgen --version` before `cargo xtask web`.
+- `rfd 0.17`, `arboard 3.6.1`, `wgpu 30.0.1`, `accesskit 0.25`/`0.24` transitive and `winit
+  0.30.13` compatibility were checked from manifests; a fresh `cargo metadata --locked` and a
+  clean lockfile resolution are still required.
+- The candidate’s own lock resolves `wgpu 30.0.0`; FilmCraft pins 30.0.1. Record the actual
+  resolved candidate/FilmCraft version in the evidence and ensure one source; do not claim the
+  candidate lock is FilmCraft’s.
+- New 0.37 dependencies include `wl-clipboard-rs`, `tree_magic_mini`, `petgraph`, `nom`,
+  `send_wrapper`, `unicode-properties`, `vello_cpu 0.2`, `glifo 0.3`, `kittest 0.5` and updated
+  `accesskit*`/`phf`. Review their licences (all expected MIT/Apache-2.0/BSD/ISC); no GPL/LGPL
+  may enter.
+- Do not commit local screenshots as assets without sidecars/index rows. Keep review PNGs
+  under the task evidence directory.
+- No agent/model/tool attribution in PR titles, descriptions, commits or comments. Contributor
+  credit stays username-only (`@skylartaylor`); do not add a name entry.
+
+## 15. Blocking unknowns and acceptance criteria
+
+These are gates, not future nice-to-haves. A failed or unavailable gate is an explicit blocker,
+not a passing result.
+
+1. **G-PINS — production fork pins.** The reviewed, published, immutable `storytold/egui`
+   commit (E1-E21 + E21b/P7b + selected #8763/#8748 fixes) and `storytold/winit` commit
+   (W15P + W27 + required W1-W27 behavior) are not known at planning time. Do not invent a SHA,
+   do not use an aiongg branch as a production pin, and do not land a stock-0.37 intermediate.
+   The exact SHAs, feature sets and provenance must be recorded before P1.
+2. **G-CL2F — shared capture helper.** `craft-libs` must publish the CL-2 helper, DesignCraft
+   and GridCraft adapters must be reviewed against it, and CL-2F must freeze the API before
+   FilmCraft pins the revision. A branch head or path dependency is not acceptable.
+3. **G-CRAFT-LIBS — shared baseline and port.** The final published `craft-libs` revision must
+   build on the merged PR #199 base `3832c47ef68a0e6214f2c1e85f3526b6adcb686e` with the
+   protected-group docking fix and lazy printing preserved; the PR-199 hunks
+   (`8614e4a`/README `1764bca`) are historical provenance. `5c874d51` is the old FilmCraft
+   manifest pin; `4919088` is historical GitHub main. `craft-docpath` stays at `82a24b0`
+   unless a concrete cross-type reason appears.
+4. **G-IME — native IME and E21b.** E21b/P7b must exist in the pinned fork with the complete
+   shared contract: owner generation present even when `Unavailable`, available-empty distinct
+   and explicitly sent, committed W27 disable/enable transitions with cache clear,
+   authoritative completed-pass `None`, current-epoch serial-mismatch edits applied once with
+   outgoing state deferred, and a 4000-byte payload extracted without a full-document copy.
+   The FilmCraft graphics adapter must supply logical model/preedit/UTF-8 bytes, and Windows
+   Japanese/Korean, X11 Vietnamese, Wayland text-input-v3 and macOS rows must run on real
+   environments. No headless test is a substitute. macOS without hardware is explicitly
+   unresolved.
+5. **G-PRIMARY — W15P + E4.** The winit-owned PRIMARY path must be integrated, with native
+   per-seat keyboard- **and pointer-triggered** selection using a fresh triggering serial,
+   owner/seat changes, empty/absent offers, password exclusion, unchanged-owner non-reclaim,
+   self-paste, and slow/trickling/oversized/canceled transfers under wlroots, KWin and Mutter.
+   The transfer path is bounded (2 s total deadline, 16 MiB, 4 read workers, 2 writers with
+   queue depth 8), claims ownership synchronously on the fresh input turn, serves
+   asynchronously, and discards stale/canceled completions. The arboard/smithay path is a
+   measured fallback only.
+6. **G-SEL — P7c #8763/#8748.** Reproduce selection loss with a caption/metadata field and a
+   custom toolbar action; P7c owns the selected, tested #8763 and #8748 fixes. #8764 is an
+   unmerged proposal, not a release fix. A local workaround needs a reason and removal
+   condition.
+7. **G-PERF — performance and stock control.** Baseline and candidate runs must meet §12
+   sampling and thresholds, with separate #8731 text, #8736 DX12, #8512 font and wasm rows, and
+   a stock-0.37 control where equivalent. Compile duration is not UI performance.
+8. **G-ENV — real environments.** Linux X11/Wayland compositors and IME, a browser with a
+   pinned adapter, a unique Windows clone, and macOS hardware must be provisioned. The i915
+   device’s presence is availability evidence only; the worker sandbox may hide it. No current
+   runtime pass is claimed.
+9. **G-ACCESS — accessibility names and glyphs.** All 56 `TextEdit` sites and other input
+   widgets have names; strict kittest naming/glyph behavior is green without a global disable;
+   monochrome emoji coverage is asserted.
+10. **G-LIFECYCLE — multi-pass audit.** The input-action design, Escape latch, monotonic
+    deadlines, one-step synthetic gesture retention across hidden logic ticks, idempotent
+    toast/settle counters and grep allow-list are implemented and tested; until then the
+    one-action and hidden-work guarantees are not met.
+11. **G-SCREENSHOT — capture matrix.** The callback is delivered for a visible capture and
+    for a hidden capture, including queued-but-not-yet-issued settling; timeout/close/
+    late-callback behavior is correct. The CL-2 slot holds the strong waker, the callback is
+    weak and does not wake itself, and admission bounds four outstanding requests, 128 MiB per
+    image and 256 MiB aggregate with checked `width * height * 4` before issue and after any
+    resize/DPI/zoom epoch change (including a change back).
+12. **G-RTL — bidi.** P1 must land the fork's E5/E12 together with the simplified
+    `rtl::Lines`, and validate visual order/alignment/editing. Do not ship both the manual
+    reorder and fork bidi, and do not leave the removal to P2.
+
+## 16. Limitations of this planning pass
+
+- No build, test, benchmark, screenshot or app launch was run. All behavior statements are
+  source review and upstream documentation, not fresh validation. No command in §11 was
+  executed.
+- The historical compiler diagnostics are from an earlier checkout and only identify likely
+  sites; current line numbers and new errors must be discovered by implementation gates.
+- The production fork pins and the final `craft-libs` revision are unknown until the fork and
+  shared helper are published; no SHA is invented.
+- The i915 device was observed on the host but no display session is inherited and the worker
+  sandbox may hide it. Windows baseline is software-rendered. macOS, browser runtime and real
+  Wayland compositor behavior remain unproven until the environment gates run.
+- The exact stock-0.37 control harness may need small adapters for fork-only operations; such
+  differences are recorded as attribution limitations, not ignored.
+
+## 17. Review finding dispositions
+
+This table is an index; the body sections above are authoritative.
+
+| Finding | Disposition | Where resolved |
+|---|---|---|
+| F1 deferred-action clearing loses clicks | **Accepted.** No clear on pass 1+; input actions dispatch once in the pass with events; deferred actions persist and drain on the first non-discarded pass; duplicates coalesce; no silent drop. | §4.4, §9, §11.2 |
+| F2 Escape rollback cannot fire on a multi-pass frame | **Accepted.** Latch Escape and the undo mark in pass 0; apply once after the final pass. | §2.3, §4.4, §9 |
+| F3 hidden window never presents | **Accepted.** The screenshot command already requests paint while hidden; `RequestPaintWhileHidden` also covers queued-but-not-issued settling and other composition stages; timeout is not the normal hidden path; no visibility-based phase inference. | §4.2, §4.5, §11.2, §11.5 |
+| F4 OS clipboard feature lost | **Accepted.** Add native `clipboard`; cross-application paste tests on X11/Wayland/Windows; web checked separately. | §3.5, §7.3, §11.1 |
+| F5 stock 0.37 landable stage | **Accepted.** Stock is a local/CI comparison only; one coherent fork landing; final pins gated. | §3.2, §13 |
+| F6 `default_fonts` not monochrome emoji | **Accepted.** Explicit `monochrome_emoji_fonts`, exact glyph set, screenshot diff. | §3.5, §6.1, §11.2 |
+| F7 E21b/P7b IME gap | **Accepted.** Full owner/support/serial contract, 4000-byte no-full-copy payload, TextEdit producer, Film graphics adapter, tests; native rows required. | §7.2, §10.1, §11.2, §15 G-IME |
+| F8 PRIMARY downgraded | **Accepted.** W15P + E4 required; keyboard/pointer serials, bounded transfer, native per-seat/password/unchanged-owner/slow-cancel matrix; arboard fallback measured only. | §7.3, §10.1-10.2, §15 G-PRIMARY |
+| F9 effects catalogue incomplete | **Accepted.** Enumerates `trim.tick`, native menus, metadata/auto/sync sites, all monotonic deadline calls; trim idempotent; grep guard. | §2.3, §4.1, §4.6 |
+| F10 performance protocol weak | **Accepted.** 10 warmups, 30 steady, 20 startup, ≥1,000 actual frames for p99; shared 5%/10%; stock control; separate #8731/#8736/#8512 rows; wasm sizes. | §12 |
+| F11 unmanaged commands | **Accepted.** All validation uses `task.py run/status/finish` with task/source/evidence; proposals only. | §11.1, §11.4 |
+| F12 EffectCraft reverse dependency absent | **Accepted.** Exact `2c5ba7a` pin, UI-free proof, separate branch retained, re-audit triggers. | §1.1 |
+| F13 4919088 unpublished / PR 199 premise | **Premise rejected.** GitHub main verified `4919088`; stale `origin/main` `b1401e3` does not prove otherwise. Old `5c874d51` fetched; seven-file +607/−2 diff audited; printing and protected-group docking preserved; `craft-docpath` stays separate; PR 199 only hunks `8614e4a`/README `1764bca`. The actionable audit requirements are accepted. | §3.1, §10.3, §15 |
+| F14 accessibility role contradiction | **Accepted.** Floating grip = `Button` "Resize panel"; dock split divider = `Splitter`; test updated once. | §5.3, §11.2 |
+| F15 minor accuracy/robustness | **Accepted.** Catch-unwind latch; no `Window::show` in logic; wgpu/candidate versions stated; thresholds require a noise reference; strict kittest names are an ordering constraint. | §4.1, §4.2, §11.1, §11.3, §12.1, §14 |
+
+### 17.1 Fresh v2 review findings
+
+| Finding | Disposition | Where resolved |
+|---|---|---|
+| v2-1 P1 lands manual bidi reversal with fork bidi | **Accepted.** P1 now pins the fork, removes `rtl::Lines` reversal and its tests, and validates visual order; P2 no longer ships a second bidi state. | §6.3, §13, §15 G-RTL |
+| v2-2 E21b contract incomplete | **Accepted.** Full owner/context identity, available-empty vs unavailable, committed W27 transitions, authoritative `None`, serial-mismatch-once/deferred-outgoing, no full-document copy. | §7.2, §10.1, §15 G-IME |
+| v2-3 keyboard-only PRIMARY and no bounded transfer | **Accepted.** Keyboard and pointer triggering serials; 2 s/16 MiB/4 readers/2 writers/queue 8; synchronous claim, async serving, owner-specific waker, stale discard. | §7.3, §15 G-PRIMARY |
+| v2-4 no screenshot wakeup/collection path | **Accepted.** Strong waker in the live slot, weak callback, unlock before wake, callback has no repaint path of its own; queued hidden requests use `RequestPaintWhileHidden`. | §3.3, §4.5, §15 G-SCREENSHOT |
+| v2-5 performance commands contradict sampling rule | **Accepted.** Harness must emit p99 and exact counts, 1,000+ frames/10 warmups/30 iterations; `--repeat` is not a sample count. | §12.1, §12.3 |
+| v2-6 validation mixes managed and raw commands | **Accepted.** Bench and browser payloads run inside `task.py run/status/finish`; the Linux UI job has an attested finish and the long-running server has a stop step. | §11.1, §11.4, §12.1 |
+| v2-7 effect catalogue misses Toast and settle counters | **Accepted.** Toast uses monotonic time; settle counters are per rendered frame/pass identity; synthetic hook retains one step across hidden logic ticks. | §2.3, §4.1, §4.5, §15 G-LIFECYCLE |
+| v2-8 consumer count and P7c traceability | **Accepted.** Fourteen capture consumers (eleven craft-ui + three local adapters); P7c explicitly owns #8763/#8748. | §3.3, §8, §10.1, §15 G-SEL |
+
+## 18. Primary sources reviewed
+
+- Upstream `egui 0.37.0` changelog and release commit `841a328b`; source inspected through
+  `git -C /home/codex/work/CraftApps/egui037-migration-20261022/egui show 0.37.0:…`.
+- Upstream API changes: emilk/egui#8489 (screenshot callback), #8555 (`WidgetType` -> `Role`),
+  #8583 (`default_fonts` off), #8534 (Id deprecations), #8535 (`root_ui`), #8428 (PRIMARY),
+  #8512 (system fonts), #8631/#8748 (logic-only/overdue windows), #8577 (bidi), #8731 (text
+  tessellation), #8736 (DX12 shader compile), #8763 (TextEdit click-away) and proposed #8764
+  (`6eb460a2a6d537d312a80579cb801895509deaed`, open/unmerged).
+- Lifecycle source audit: `/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/lifecycle-source-audit.md`.
+- IME gap: `/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/ime-surrounding-gap.md`,
+  `.../winit-review-triage.md` for the W15P/W27/E21b serial and owner/support corrections, and
+  egui plan §10.6 for pinned font fixtures.
+- Shared baseline audit: `/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/filmcraft-shared-baseline-audit.md`.
+- Suite rollout: `craft-libs/docs/egui-037-suite-rollout.md` and
+  `craft-libs/docs/egui-037-migration-plan.md` (CL-2/CL-2F, §7.8, §10.6).
+- Fork provenance: `aiongg/egui` `craft/0.37` `PATCHES.md` (E1-E21) and `aiongg/winit`
+  `craft/0.30.13-lang` `PATCHES.md` (W1-W27), inspected read-only in
+  `/home/codex/work/CraftApps/egui037-migration-20261022/{egui,winit}`.
+- Shared migration: `storytold/craft-libs#199` (port hunks `8614e4a`, README `1764bca`;
+  stale heads `b68de8c`/`ec8840a` are not mergeable trees), current main `4919088`, old
+  FilmCraft pin `5c874d51`, language work `storytold/craft-libs#198`.
+- Local evidence: `/home/codex/work/ssd2/task-evidence/craft-fork-plan-20261020/PLAN.md`,
+  `/home/codex/work/ssd2/task-evidence/craft-fork-ai-lines-20261022/SURVEY.md`,
+  `/home/codex/work/ssd2/task-evidence/craft-fork-egui037-20261021/RESULTS.md`,
+  `/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/upstream-discussions.json`,
+  `upstream-8764-fresh.json`, `craft-ui-consumers-exact.json`.
+- Repository rules and commands: `AGENTS.md`, `CLAUDE.md`, `docs/architecture.md`,
+  `docs/testing.md`, `docs/web.md`, `docs/agents.md`, `.github/workflows/ci.yml`,
+  `xtask/src/main.rs`.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+The owned checkout's current branch HEAD is `fa550ce2d07bdfee6b1d7b6835e8abc8c6913d00`; the migration work is uncommitted on that base. The 2026-10-23 note that the checkout was fast-forwarded to `c5c16939896277ab332280a6d3f1d7283d0d0c4e` and earlier baseline SHAs above are retained as historical review evidence. Use the current HEAD and its exact manifest/lock hashes (table in §1) for local integration and paired measurements; remote main is not asserted here. The original refs remain reachable.
+
+Preserve isolated MCP screenshot temporary directories and caller-path desktop captures; rejected synthetic gestures enqueue nothing (click 0–10, drag 2–1024). Retain the new typography/contrast/clip regressions and random benchmark output directories.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+
+## Final source review repair — 2026-10-24
+
+The reviewed cumulative source identity and two findings are preserved in the external
+`final-landing/filmcraft-final-review.md/json` evidence. Same-owner application caret/selection
+moves (pointer, keyboard, Select All and explicit gfxEdit offsets) and another field taking
+focus now invalidate only a known active/terminal-pending graphics composition before its late
+replacement can mutate the moved selection. Stable owner/generation identity is preserved;
+commit-only input without an old composition and uninterrupted replacement chains stay valid.
+A private one-shot interruption asks the platform to cancel the old composition and survives
+discarded passes until a final observation. No public IME protocol was added.
+
+Automation lookup now uses the current registry whenever it is populated, so a removed control
+cannot resolve to its previous-pass coordinates. The pre-draw previous-registry fallback stays.
+New regressions cover removed IDs, real pointer press/release plus next-batch char/byte deletion
+and commit, terminal-pending composition, same-owner control/keyboard moves, direct-commit and
+valid-chain positive controls. These checks and fresh independent review are pending managed
+validation; the earlier18-test result predates this repair. Canonical manifests/lock are unchanged.
diff --git a/docs/gaps.md b/docs/gaps.md
index 259b9d042..2bafd859f 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -27,7 +27,7 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
 | G11 | No plugin hosting | ecosystem | no | 200–400 h |
 | G12 | AI features | AI | no | 150–300 h |
 | G13 | Delivery formats | file format | no | 60–110 h |
-| G14 | Localization: 8 of the 12 key languages missing | localization | no | 150–230 h |
+| G14 | Localization: 3 of the 12 key languages missing | localization | no | 150–230 h |
 | G15 | Interchange never validated in Avid / Pro Tools; slow XML import | file format | partly | 20–40 h |
 | G16 | Performance reports on 0.5.0 | performance | partly | 30–60 h |
 | G17 | Audio device and playback reliability | stability | partly | 20–40 h |
@@ -119,7 +119,7 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
 
 ## G6. No real-world media corpus or workflow acceptance tests
 
-- **Done:** first scripted MCP workflows (#835, `apps/filmcraft-cli/tests/workflows.rs`): the
+- **Done:** first scripted MCP workflows (#835, `apps/filmcraft-cli/tests/it/workflows.rs`): the
   `filmcraft-cli mcp` binary imports ffmpeg-made phone-like VFR H.264 + AAC MP4 and long-GOP
   H.264 Matroska with two audio tracks (AAC, AC-3), edits (extract, audio gain, title; ripple
   trims, colour matte, cross dissolve), exports H.264 MP4, and saves a project that a new process
@@ -161,8 +161,8 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
   rearrangement (#493); clicking empty space to deselect (#683); filmstrip thumbnails (#614);
   marquee selection in the Project panel (#578); Freeform bins and middle-mouse pan (#579);
   Program monitor Button Editor (+) (#431); keyframe curves for Position (#448); transition
-  editing controls (#577: Effect Controls has the transition's own timeline, drag to slide or resize;
-  the A/B previews with Start / End sliders remain); track renaming (#654); window controls on macOS (#637); UI scale on
+  editing controls (#577: Effect Controls has the transition's own timeline, drag to slide or resize,
+  drag the cut to move it with the transition; the A/B previews with Start / End sliders remain); track renaming (#654); window controls on macOS (#637); UI scale on
   X11 (#457).
 - **Estimate:** 120–200 h. Doc: [ui-parity.md](ui-parity.md).
 
@@ -231,22 +231,26 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
   (audio-only `.m4a`, or ADTS `.aac`; #814); ProRes 4444 / 4444 XQ in the export UI (#342).
 - **Estimate:** 60–110 h. Doc: [file-format-parity.md](file-format-parity.md).
 
-## G14. Localization: 8 of the 12 key languages missing
+## G14. Localization: 3 of the 12 key languages missing (Hindi, Arabic, Vietnamese)
 
 - **Have:** Spanish, Japanese, Simplified Chinese, French (#498) and Portuguese (Brazil) (#859)
   catalogs cover ~99.6–100% of the ~3,500 cataloged strings; Ukrainian ~10% (menus).
 - **Missing:** Hindi, Arabic (no RTL interface layout or catalog; the interface has Arabic and Hebrew
   fallback fonts and shows captions in reading order, but other names and fields keep egui's
   left-to-right run order; Arabic titles reported broken, #395),
-  German beyond menus (#490), Korean (#508; needs Hangul fonts in craft-fonts),
+  Korean (#508; needs Hangul fonts in craft-fonts),
   Vietnamese; Premiere also ships Russian. Engine errors,
-  CLI and MCP stay English. No language has a recorded native-speaker review.
+  CLI and MCP stay English. Apart from the German menus (#630), no language has a recorded
+  native-speaker review.
 - **Done:** Indonesian (#867): `id.tsv` has every entry of the Spanish catalog (~100%), in Edit ▸
   Language, Settings ▸ General and the native macOS menu; System Language picks it for `id-*` (and
   legacy `in-*`) locales. Native-speaker review welcome.
 - **Done:** Italian: `it.tsv` has every entry of the Spanish catalog (~100%), in Edit ▸ Language,
   Settings ▸ General and the native macOS menu; System Language picks it for `it-*` locales.
   Native-speaker review welcome.
+- **Done:** German: `de.tsv` has every entry of the Spanish catalog (~100%), beyond the menus of
+  #630 (panels, dialogs, effects and their parameters, settings, status messages). The menus are
+  native-reviewed; review of the rest welcome.
 - **Estimate:** 150–230 h. Doc: [localization-parity.md](localization-parity.md).
 
 ## G15. Interchange never validated in Avid / Pro Tools; slow XML import
@@ -294,7 +298,9 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
   with circular fillets (`masks.add` `cornerRadius`, `masks.roundCorners`, every path keyframe;
   #813), from an on-monitor corner-roundness handle with a live preview (one undo step per drag;
   #844); Shift snaps pen mask segments and dragged-out Bézier handles to 45° steps (#853), and
-  Shift constrains vertex and whole-mask drags to 45° steps from the press point (#1408).
+  Shift constrains vertex and whole-mask drags to 45° steps from the press point (#1408); a
+  marquee or Shift-click selects several vertices on the Program monitor, and dragging any of
+  them moves them all in one undo step (#3150).
 - **Estimate:** 60–110 h.
 
 ## G19. Speech to text off in release builds
@@ -316,3 +322,4 @@ platforms** G4, G9, G17; **performance** G16; **ecosystem** G11; **measurement**
 | 2026-10-10 | major | Created from ROADMAP.md's "Where we are lacking" (2026-10-05); re-ranked against Premiere 26.5.2 and the 188 open issues; added `.prproj`, 10-bit / 4:2:2 camera decode, launch crashes and missing PR CI, localization, delivery formats |
 | 2026-10-12 | minor | G10: MP1 (`A_MPEG/L1`) in Matroska imports (#1402) |
 | 2026-10-12 | minor | G10: OpenEXR PXR24 import |
+| 2026-10-24 | minor | G8: dragging the cut on a transition's timeline in Effect Controls moves the cut, and the transition moves with it (#577) |
diff --git a/docs/graphics.md b/docs/graphics.md
index cacf61732..61030d146 100644
--- a/docs/graphics.md
+++ b/docs/graphics.md
@@ -13,7 +13,10 @@ kerning and ligatures, bidi, line breaking, all drawn as vectors in linear light
 - Its **layers** are effect instances `graphic_text` / `graphic_shape` in the clip's effect list,
   in paint order (first = back). They are hidden from the Effects panel. Because they are effect
   instances they save with the project, take keyframes on every animatable property (Source Text
-  keyframes hold), appear in Effect Controls and copy with the clip. Standard effects on a graphic
+  keyframes hold), appear in Effect Controls and copy with the clip. The Essential Graphics
+  panel's number and point properties (Tracking, Leading, Font Size, Position, Opacity…) carry
+  the same stopwatch as Effect Controls (`graphics.prop.<id>.stopwatch`, #2358): once a property
+  animates, changing it in the panel adds or updates a keyframe at the playhead. Standard effects on a graphic
   clip apply to the composed graphic; Motion and Opacity apply last.
 - `filmcraft_project::graphic::eval_layer` evaluates a layer at a time into a `LayerSpec`.
 - Projects with graphics need no schema migration: everything is additive (new item kind, new
diff --git a/docs/images/filmcraft-lumetri.png b/docs/images/filmcraft-color-panel.png
similarity index 100%
rename from docs/images/filmcraft-lumetri.png
rename to docs/images/filmcraft-color-panel.png
diff --git a/docs/images/filmcraft-lumetri.png.attribution b/docs/images/filmcraft-color-panel.png.attribution
similarity index 91%
rename from docs/images/filmcraft-lumetri.png.attribution
rename to docs/images/filmcraft-color-panel.png.attribution
index 4e6f6ceb4..2cbab37de 100644
--- a/docs/images/filmcraft-lumetri.png.attribution
+++ b/docs/images/filmcraft-color-panel.png.attribution
@@ -1,11 +1,11 @@
-asset:        filmcraft-lumetri.png
-title:        README: Lumetri Color panel
+asset:        filmcraft-color-panel.png
+title:        README: color grading panel
 author:       FilmCraft contributors (screenshot); film/footage/music credits below
 source:       original work (screenshot of FilmCraft captured with its ui.screenshot control command)
 license:      MIT OR Apache-2.0 (screenshot); embedded film frames are public domain, music CC0-1.0
 license-file:
 added:        2026-09-30 by Claude (agent) for Brandon Thomas
-notes:        Crop of the Lumetri Color panel (Basic Correction, Color Wheels) while grading Charade (1963); shows panel controls only. All UI icons are drawn in code; fonts are Inter and JetBrains Mono (OFL-1.1). Contains no Adobe artwork.
+notes:        Crop of the color grading panel (Basic Correction, Color Wheels) while grading Charade (1963); shows panel controls only. All UI icons are drawn in code; fonts are Inter and JetBrains Mono (OFL-1.1). Contains no Adobe artwork.
 Media visible in the screenshot (none of it is committed to the repository):
   - Night of the Living Dead (1968), dir. George A. Romero, Image Ten. US public domain (released without a copyright notice). Source: https://archive.org/details/night-of-the-living-dead-1968-english (Public Domain Mark).
   - Carnival of Souls (1962), dir. Herk Harvey, Harcourt Productions. US public domain. Source: https://archive.org/details/CarnivalOfSoulsVideoQualityUpgrade (Public Domain Mark).
diff --git a/docs/keyboard.md b/docs/keyboard.md
index 7e655b4ef..7ecca2857 100644
--- a/docs/keyboard.md
+++ b/docs/keyboard.md
@@ -11,7 +11,7 @@ commands (frames, panels, monitor zoom, Project and Text panel navigation) run t
 channel (`engine.execute` / `ui.menu.invoke`) and MCP (`command_run`).
 
 Tests: `crates/engine/src/keyboard_tests.rs` (no key used twice in one scope; behaviour of the
-keyboard commands, with undo) and `crates/ui-egui/tests/keyboard_ui.rs` (no dangling ids in the
+keyboard commands, with undo) and `crates/ui-egui/tests/it/keyboard_ui.rs` (no dangling ids in the
 tables, no conflicts in FilmCraft Default or the Premiere preset, keys pressed in the headless app).
 
 ## Keyboard-only commands (M3.12)
@@ -26,10 +26,12 @@ Premiere has these as keys only (most are not in a menu). Modules: `filmcraft_en
 | Trimming | Extend Previous/Next Edit To Playhead; Nudge Clip Selection Left/Right One/Five Frames, Up/Down; Slip and Slide Clip Selection Left/Right One/Five Frames | Shift+Q/W; Cmd+(Shift+)Left/Right, Alt+Up/Down; Cmd+Alt+(Shift+)Left/Right; Alt+(Shift+), / . (Timeline) |
 | Targeting | Toggle All Video/Audio Targets, Toggle All Source Video/Audio; Toggle Target Video/Audio 1–8, Move All Video/Audio Targets Up/Down, Toggle Mute/Solo for targeted audio, Toggle Track Output for targeted video (unbound, as in Premiere) | Cmd+0/9, Cmd+Alt+0/9 |
 | Tracks | Expand/Minimize All Tracks (again restores), Increase/Decrease Video/Audio Tracks Height, Show Next/Previous Screen | Shift+= / Shift+-, Cmd+= / Cmd+- / Alt+= / Alt+-, PageDown/PageUp (Timeline) |
+| Work area | Set Work Area Bar In/Out Point (`sequence.setWorkAreaIn` / `setWorkAreaOut` in `filmcraft_engine::commands`; the Timeline panel menu's Work Area Bar shows and hides the bar) | Alt+[ / Alt+] (Timeline) |
 | Monitors | Zoom Program/Source Monitor to 100%/Fit, Toggle Full Screen, Play In to Out with Preroll/Postroll, Play from Playhead to Out Point, Export Frame, Set/Clear Poster Frame | Cmd+Shift+1/0, Cmd+Alt+Shift+1/0, Ctrl+`, Shift+Space, Ctrl+Space, Shift+E, Cmd+P / Alt+P |
 | Panels | Maximize or Restore Active Frame / Frame Under Cursor, Select Next/Previous Panel, Toggle Source/Program Monitor Focus, Workspaces 7–9 | Shift+`, `, Ctrl+Shift+. / ,, Alt+Shift+7/8/9 |
 | Audio | Increase/Decrease Clip Volume (1 dB) and …Many (Settings ▸ Audio ▸ Large Volume Adjustment), Nudge Volume ±1/±3 dB, Toggle Audio During Scrubbing | ] / [, Shift+] / Shift+[, Shift+S |
 | Graphics | Increase/Decrease Font Size and Leading by One/Five Units, Left/Center/Right align text, Begin Text Editing, Nudge Selected Object by one/five (graphic layers, else Motion position) | Cmd+Alt+(Shift+)Left/Right, Alt+(Shift+)Up/Down, Cmd+Shift+L/C/R, Cmd+Alt+', Cmd+(Shift+)arrows (Program, Properties) |
+| History panel | Delete (Delete Redoable Actions, which asks for OK first) | Backspace |
 | Project panel | List/Icon/Toggle View, Hover Scrub, Thumbnail Size Next/Previous (and = / -), Move/Extend Selection, Mark In / Out of the hover-scrubbed clip | Cmd+PageUp/PageDown, Shift+\, Shift+H, Shift+] / Shift+[, arrows, Home/End, PageUp/PageDown, I / O |
 | Text panel | Navigate/Select to Previous/Next Word and Line, Start/End of Segment, Delete (lift), Ripple Delete (extract), Show Program Transcript, Merge/Split Segments | arrows, Shift+arrows, Home/End, Shift+Home, Cmd+Shift+Down, Alt+Backspace, Backspace, Shift+X, Alt+M / Alt+S |
 | Other | Help (F1), Quit (Cmd+Q), Media Browser ▸ Open In Source Monitor (imports the file first), Send to Media Encoder (= Send to Export Queue, Alt+Shift+M), Metadata panel Play/Loop | |
@@ -38,7 +40,9 @@ Existing commands that only lacked their Premiere key were added to the table to
 Project, Import from Media Browser, Get Media File Properties, Paste Attributes, Find, Edit
 Original, Make Subclip, Audio Channels, the Graphics New Layer / Arrange / Select Layer commands,
 Program monitor Show Rulers / Show Guides / Snap / Lock Guides, New Bin From Selection, Paste and
-Paste Insert in the Timeline, the Audio Track Mixer Loop).
+Paste Insert in the Timeline, the Audio Track Mixer Loop). The Audio Track Mixer menu's
+Show/Hide Tracks… and Meter Input(s) Only are the commands `mixer.showHideTracks` and
+`mixer.meterInputOnly`, on Cmd+Alt+T and Ctrl+Shift+I with the Audio Track Mixer focused.
 
 FilmCraft Default keeps its own keys where they differ (Shift+E is Clip ▸ Enable there, so Export
 Frame has no default key; the Premiere preset moves Shift+E to Export Frame and Enable to ⇧⌘E).
@@ -52,13 +56,10 @@ Frame has no default key; the Premiere preset moves Shift+E to Export Frame and
 | Change Draw Mode (⌥⌘L) | Premiere's shape draw modes for the Pen/shape tools; FilmCraft's shape tools have no draw modes. |
 | Production panel: New Project, New Folder, Close Project, Make a Copy, Move Selection Home/End/Page Up/Page Down, Move To Trash, Open Project, Zoom In/Out (12 keys) | Productions (shared multi-project folders) are not implemented; there is no Production panel. |
 | Search panel: Open in Source Monitor (⇧O) | No separate Search panel; Open Search (⇧⌘F) focuses the Project panel search. |
-| Audio Track Mixer: Show/Hide Tracks… (⌥⌘T), Meter Input(s) Only (⌃⇧I) | The mixer has no track visibility dialog and no input metering (no hardware input recording). |
 | Effect Controls: Remove Selected Effect (Delete), Loop During Audio-Only Playback (⌘L) | Effect Controls has no effect selection state and no audio-only playback mode; effects are removed from their context menu or `effects.remove`. |
 | Effects panel: New Custom Bin (⌘/), Delete Custom Item (Delete) | The Effects panel has no custom bins (effect presets live in the Presets bin). |
-| History panel: Delete (Delete) | History states cannot be selected and deleted individually. |
 | Media Browser: Select Directory List / Select Media List (⇧← / ⇧→) | The directory tree and media list take no separate keyboard focus. |
 | Project panel: Delete Selection with Options (⌘Delete) | Needs the "delete instances in sequences" dialog; plain Clear (Backspace) deletes. |
 | Project panel: Next/Previous Column Field, Next/Previous Row Field (Tab, ⇧Tab, Return, ⇧Return) | The list view has no inline-editable metadata cells. |
 | Text panel: Edit Segment (Return) | No inline transcript text editing (corrections go through `transcript.set`). |
 | Text panel: Follow Active Monitor (⇧C), Show Source Transcript (⇧Z) | Only sequence transcripts exist; source clips have no transcript view. |
-| Timeline: Set Work Area Bar In/Out Point (⌥[ / ⌥]) | FilmCraft has no work area bar (Premiere hides it by default; renders use In/Out). |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index a9164e19b..d981ba664 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (Swedish covers the whole interface) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (Swedish covers the whole interface) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
 
 Per-language status of FilmCraft's interface. Premiere 26.5.2 ships 10 interface languages (the
 installed bundle's `.lproj` folders): German, English, Spanish, French, Italian, Japanese, Korean,
@@ -17,8 +17,8 @@ are reachable over the control channel. One catalog per language,
 commands, panels, workspaces, presets) are translated where they are drawn. Searches match the
 displayed labels as well as English sources. Tests fail when a `tl!` literal, a menu label or a
 registry name has no Spanish entry; `zh-cn.tsv` must also cover every `tl!` literal and menu
-label; `ja.tsv`, `fr.tsv` and `pt-br.tsv` have the same entries but are not yet required by tests
-(French must cover the core menus, Brazilian Portuguese every menu label, and neither may keep an
+label; `ja.tsv`, `fr.tsv`, `pt-br.tsv` and `de.tsv` have the same entries but are not yet required by tests
+(French and German must cover the core menus, Brazilian Portuguese every menu label, and neither may keep an
 entry without a Spanish one). Engine error messages, the
 control channel, the CLI and MCP stay English.
 
@@ -48,20 +48,26 @@ whole interface, one PR) at ~4–8 h per language for the catalog plus tests.
 | Arabic | ar | 0 (0%) | — | **no RTL interface layout**; fallback fonts and shaping in the interface, captions in reading order, other text in egui's left-to-right run order; titles broken (#395) | — | none | 40–70 h |
 | French | fr | 3,526 (same entries as Spanish, plus the macOS Settings item) | as Spanish | Latin (bundled fonts) | not recorded; welcome | partial (#498) | review |
 | Portuguese (Brazil) | pt-br | 3,541 (same entries as Spanish, plus the macOS Settings item) | as Spanish | Latin (bundled fonts) | not recorded; welcome | partial (#859) | review |
-| Indonesian | id | 3,541 (same entries as Spanish, plus the macOS Settings item); must cover the core menus, no entry without a Spanish one | as Spanish | Latin (bundled fonts); System Language also maps the legacy `in` code | not recorded; welcome | partial (#867) | review |
+| Indonesian | id | 3,541 (same entries as Spanish, plus the macOS Settings item) | as Spanish | Latin (bundled fonts); System Language also maps the legacy `in` code | not recorded; welcome | partial (#867) | review |
 | Japanese | ja | 3,487 (99.7%) | as zh-cn; system-font kanji may pick the Chinese fallback (#547) | CJK fonts, vertical title text | not recorded | partial | 4–8 h + review |
-| German | de | 371 (10.6%) | menus only | Latin | yes (#630) | menus only | 5–9 h + review |
+| German | de | 3,590 (same entries as Spanish) | as Spanish | Latin (bundled fonts) | menus yes (#630); the rest not recorded, welcome | partial | review |
 | Korean | ko | 3,573 (same entries as Spanish, plus the macOS Settings item) | as Spanish | installed system Hangul font (Malgun Gothic, Apple SD Gothic Neo, Noto Sans CJK KR…); refused without one | not recorded; welcome | partial (#508) | review; Hangul in craft-fonts for the web |
 | Vietnamese | vi | 0 (0%) | — | Latin with stacked diacritics (font coverage to check) | — | none | 6–12 h + review |
-| *Other shipped:* Italian | it | 3,573 (same entries as Spanish, plus the macOS Settings item); must cover the core menus, no entry without a Spanish one | as Spanish | Latin (bundled fonts) | not recorded; welcome | partial | review |
-| *Other shipped:* Swedish | sv | 3,590 (same entries as Spanish, plus the macOS Settings item); must cover the core menus, no entry without a Spanish one | as Spanish | Latin (bundled fonts, å ä ö) | not recorded; welcome | partial | review |
+| *Other shipped:* Italian | it | 3,573 (same entries as Spanish, plus the macOS Settings item) | as Spanish | Latin (bundled fonts) | not recorded; welcome | partial | review |
+| *Other shipped:* Swedish | sv | 3,607 (same entries as Spanish) | as Spanish | Latin (bundled fonts, å ä ö) | not recorded; welcome | partial | review |
 | *Other shipped:* Ukrainian | uk | 351 (10.0%) | menus only | Cyrillic (bundled) | not recorded | menus only | 5–9 h |
 
+UI strings are catalog entries (the non-comment lines of `src/i18n/<code>.tsv`; English counts the
+source strings in the code), so the rows were measured at different times: at this change the
+Spanish and German catalogs both have 3,590 entries, German every Spanish one. A string a catalog
+lacks shows in English; no test or build requires a translation. `cargo xtask i18n-report` (also
+printed by `cargo xtask ci`) lists each language's missing strings.
+
 Premiere also ships Italian, which we now cover like Spanish, and Russian (6–10 h).
 
-**Localization dimension:** 6 of the 12 key languages near-complete (English, Spanish, Japanese,
-Simplified Chinese, French, Portuguese (Brazil)), 1 menus-only, 5 none; against Premiere's 10 languages
-we cover 6 well and 1 partly. **~35%, 150–230 h** for all twelve to `full` plus Italian and Russian, of which the script
+**Localization dimension:** 9 of the 12 key languages near-complete (English, Spanish, Japanese,
+Simplified Chinese, French, Portuguese (Brazil), Indonesian, Korean, German), 3 none (Hindi, Arabic,
+Vietnamese); against Premiere's 10 languages we cover 9 well and Russian partly. **~35%, 150–230 h** for all twelve to `full` plus Italian and Russian, of which the script
 work (RTL and complex shaping in the egui interface) is the largest and least parallel part.
 Every language needs native-speaker review (human).
 
@@ -69,6 +75,8 @@ Every language needs native-speaker review (human).
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-14 | minor | Swedish (sv) covers the whole interface: every entry of the Spanish catalog plus the macOS Settings item; System Language picks it for `sv-*` locales |
+| 2026-10-26 | minor | Swedish (sv) covers the whole interface: every entry of the Spanish catalog (3,607); System Language picks it for `sv-*` locales |
+| 2026-10-23 | minor | Missing translations never fail a test or build (they show in English); `cargo xtask i18n-report`, also run by `cargo xtask ci`, lists them per language |
+| 2026-10-13 | minor | German (de) covers the whole interface: every entry of the Spanish catalog (3,590); the tests require the core menus and the macOS app menu and reject entries without a Spanish one |
 | 2026-10-11 | minor | German (de) ships the menus (#630): 371 of 3,498 strings (10.6%), native-reviewed; dimension now 2 menus-only, 5 none |
 | 2026-10-10 | major | Created from ROADMAP.md's "Interface localization" section; catalog coverage measured (es 3,496, ja 3,487, zh-cn 3,485, pt-br 348, uk 351 of 3,498); the 12-language table and script-support gaps added |
diff --git a/docs/monitors.md b/docs/monitors.md
index c0120112a..d26fd3c09 100644
--- a/docs/monitors.md
+++ b/docs/monitors.md
@@ -11,7 +11,7 @@ focused monitor (Program by default). Code: `crates/ui-egui/src/panels/monitor_v
 | `view.playbackRes.<full\|half\|quarter\|eighth\|sixteenth>` | View ▸ Playback Resolution | render scale while playing |
 | `view.pausedRes.<…>` | View ▸ Paused Resolution | render scale while stopped (default Full) |
 | `view.highQualityPlayback` | View ▸ High Quality Playback | play at the paused resolution when it is higher |
-| `view.display.<composite\|alpha\|red\|green\|blue>` | View ▸ Display Mode | composite, or one channel as greyscale (colour channels premultiplied) |
+| `view.display.<composite\|alpha\|red\|green\|blue>` | View ▸ Display Mode | composite, or one channel as greyscale (colour channels premultiplied). The channel modes render on the CPU instead of the GPU compositor, and Alpha renders the sequence live instead of using render previews (they are flattened over black), so playback in them is slower |
 | `view.display.multicam` | Display Mode ▸ Multi-Camera | the Program's multi-camera view (`multicam.toggleView`) |
 | `view.display.audioWaveform`, `view.display.videoAndWaveform` | Display Mode ▸ Audio Waveform / Video and Audio Waveform Split | Source Monitor: the clip's waveform (click to move the source playhead); audio-only clips always show it |
 | `view.display.comparison` | Display Mode ▸ Comparison View | Program: the reference frame (left) beside the current frame; the reference starts at the playhead and is stepped or reset with the buttons under it, or `view.compare.setReference {time\|seconds}` |
@@ -19,6 +19,7 @@ focused monitor (Program by default). Code: `crates/ui-egui/src/panels/monitor_v
 | `view.showRulers`, `view.showGuides`, `view.lockGuides`, `view.clearGuides` | View | toggles take `{"enabled": bool}` |
 | `view.addGuide` | View ▸ Add Guide… | dialog, or `{"orientation": "vertical\|horizontal", "position": px}` |
 | `view.snapInProgramMonitor` | View ▸ Snap in Program Monitor | graphic moves snap to the frame edges / centre and the guides (6 pt) |
+| `view.transparencyGrid` | wrench menu ▸ Transparency Grid | a gray and white checkerboard (8 pt squares) behind the picture shows its transparent areas; off by default, each monitor keeps its own; takes `{"enabled": bool}`. The Program monitor renders on the CPU while the grid is on |
 | `view.safeMargins` | Guide Templates ▸ Safe Margins | action- and title-safe boxes |
 | `view.guideTemplates.save`, `.manage`, `.apply`, `.delete` | Guide Templates ▸ Save Guides as Template… / Manage Guides… | templates are stored in the user preferences (`guides.templates`) |
 
@@ -54,7 +55,7 @@ Commands: `source.playback.play`, `source.playback.stop`, `source.playback.toggl
 available through the UI command registry, CLI bridge and MCP. `playback.toggle`,
 `playback.forward`, `playback.reverse`, `playback.slowForward` and `playback.slowReverse` also
 accept `monitor: "source"|"program"` to override focus. `ui.inspect.sourcePlayback` reports playing,
-audioClock and playhead. Test: `cargo test --release -p filmcraft-ui-egui --test source_playback_ui`.
+audioClock and playhead. Test: `cargo test --release -p filmcraft-ui-egui --test it source_playback_ui::`.
 
 ## Drag a marked Source range to the timeline
 
@@ -75,7 +76,7 @@ Automation ids: `source.drag.video`, `source.drag.audio`, `source.drag.both`, `s
 and `source.waveform`. Placement dispatches `timeline.place` with `sourceIn`, `duration`, `video`
 and `audio`; the stream flags default to true for existing callers. Engine tests cover range
 bounds, stream choices, linked placement, invalid parameters and undo/redo. UI tests exercise
-actual drags: `cargo test --release -p filmcraft-ui-egui --test source_drag_ui`.
+actual drags: `cargo test --release -p filmcraft-ui-egui --test it source_drag_ui::`.
 
 Ctrl+Shift+X (Cmd+Shift+X on macOS) clears In/Out on the focused Source clip, including split
 points, and restores the implicit full span. It is undoable and leaves Program marks unchanged.
diff --git a/docs/performance.md b/docs/performance.md
index c2bed4d95..65310442a 100644
--- a/docs/performance.md
+++ b/docs/performance.md
@@ -19,7 +19,7 @@ search highlights by query. Playhead movement reuses them; project edits, undo/r
 refresh them. Highlight lookup is constant work per word, including searches with many matches.
 
 To measure a long transcript, run
-`cargo test -p filmcraft-ui-egui --test transcript_ui long_transcript_redraw_benchmark -- --ignored --nocapture`
+`cargo test -p filmcraft-ui-egui --test it transcript_ui::long_transcript_redraw_benchmark -- --ignored --nocapture`
 alone. It reports median and p95 redraw time for 10,000 words with an empty query and a query matching
 every word. It measures UI update work, not native display presentation, and deliberately has no
 machine-dependent timing assertion. The transcript still lays out every word; list virtualization
@@ -181,7 +181,7 @@ Same commit, Settings ▸ Playback ▸ Hardware decoding switched with the bench
 `--hw auto` (`cargo xtask bench --sections decode --only dec_h --repeat 3 --hw …`, then
 `--sections playback --only h264` and `--only hevc-2160`), 2026-10-05, Apple M4 Pro, load average
 **150–190** throughout (shared with other agent builds). The decoded pictures are identical either
-way (bit-exact parity tests, `crates/platform/tests/videotoolbox.rs`); only who decodes changes.
+way (bit-exact parity tests, `crates/platform/tests/it/videotoolbox.rs`); only who decodes changes.
 
 ### Decode (every frame through the media stack)
 
@@ -390,7 +390,7 @@ rounds; the table gives the range of the two (decode: best of 3 within each). Re
 `cargo xtask bench --sections decode --only dec_h264 --repeat 3 --hw off|auto` (likewise `dec_hevc`)
 and `--sections playback --only "h264-2160 full" --hw off|auto`; set `FILMCRAFT_FFMPEG` if ffmpeg is not
 on `PATH` for the fixture generator. Pictures are identical either way (bit-exact parity tests,
-`crates/platform/tests/media_foundation.rs`). The decoder MFTs were Microsoft's H.264 decoder
+`crates/platform/tests/it/media_foundation.rs`). The decoder MFTs were Microsoft's H.264 decoder
 (`Microsoft H264 Video Decoder MFT`) and the `HEVCVideoExtension` decoder, both decoding with DXVA
 on the RTX 5060's NVDEC: `nvidia-smi dmon -s u` showed the decoder engine at 18–27 % during an
 Auto run and 0 % otherwise, and every picture came back as a Direct3D 11 texture.
@@ -553,7 +553,7 @@ one thread the code path is the old one.
 
 Linux, AMD Ryzen 7 7800X3D (8 cores / 16 threads), 2026-10-11, shared with other agents' builds;
 base = `2ff3f5e`, after = this change, 16 decoder threads, SVT-AV1 preset 8 fixtures from
-`crates/av1/tests/perf.rs` (`perf_1080p_lowdelay` and `perf_2160p_gop` are new there).
+`crates/av1/tests/it/perf.rs` (`perf_1080p_lowdelay` and `perf_2160p_gop` are new there).
 
 `av1dec` example (`AV1_LOOPS=2 AV1_THREADS=16`), 8 rounds alternating base / after per fixture,
 load average 11–27; speed-up = base wall time / after wall time of the adjacent pair:
@@ -693,7 +693,7 @@ copy.
    the loop filter; HEVC sub-layer non-reference pictures of the top sub-layer skip deblocking
    and SAO; AV1 shown frames that refresh no slot skip deblocking, CDEF and loop restoration.
    Tested per codec (unflagged pictures bit-exact, single- and multi-threaded) and through the
-   media stack (`crates/codecs/tests/draft_decoders.rs`: draft frames reach draft requests only;
+   media stack (`crates/codecs/tests/it/draft_decoders.rs`: draft frames reach draft requests only;
    an export after draft playback is bit-exact with ffmpeg).
 
 Not done: AV1 row-level frame threading (references are waited for as whole frames) and its
diff --git a/docs/project-files.md b/docs/project-files.md
index 3ca0bc0be..2e2c380df 100644
--- a/docs/project-files.md
+++ b/docs/project-files.md
@@ -125,9 +125,10 @@ like Premiere's:
 | Update it at least every N second(s) | `autoSave.recoveryIntervalSeconds` | 5 (1–600) |
 
 At each interval, if the project changed since the last auto-save, a copy is written to the
-`Auto-Save` folder next to the project as `<name>-YYYY-MM-DD_HH-MM-SS.fcproj` (local time). An
+`Auto-Save` folder next to the project as `<name>-YYYY-MM-DD_HH-MM-SS-<unix seconds>.fcproj` (local time, then the real time that orders
+the copies, so a clock change at the end of daylight saving time cannot reorder them). An
 unsaved project uses `<data dir>/Auto-Save/`. After each write the oldest copies beyond the limit are
-deleted. Only files named exactly `<name>-<timestamp>.fcproj` are ever deleted. An auto-save is an
+deleted. Only files named exactly `<name>-<timestamp>.fcproj` or `<name>-<timestamp>-<unix seconds>.fcproj` are ever deleted. An auto-save is an
 ordinary project file: open it with File ▸ Open Project. `file.listAutoSaves` lists them, newest
 first.
 
@@ -155,6 +156,8 @@ Premiere's auto-save can lose up to one interval of work. FilmCraft also keeps a
   Recover unsaved changes from 2026-10-01 00:02:09?"*, with the buttons **Recover**, **Not Now** and
   **Discard**. Stale directories without a snapshot are removed. Journals of running sessions are
   never touched.
+- If discarding a recovery session fails, FilmCraft reports the error and keeps that session and
+  the remaining candidates in the recovery list for retry. Sessions already deleted stay removed.
 - Recovering loads the snapshot as an **unsaved** project with its original path, so Save writes
   over the original file. The recovered state goes into the new session's own journal before the old
   journal is deleted.
diff --git a/docs/releasing.md b/docs/releasing.md
index 58c283743..d3f482b41 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -59,8 +59,8 @@ signing jobs are refused, and the draft-release job, which needs them, is skippe
 `filmcraft --version` and `filmcraft-cli --version` print the version from `Cargo.toml`.
 
 **Fonts.** Every build job checks out [craft-fonts](https://github.com/storytold/craft-fonts) at a
-pinned commit (the `ref:` of its craft-fonts checkout step, marked `# bump deliberately`) and builds
-with `CRAFT_FONTS_DIR` and `CRAFT_FONTS_REQUIRED=1`, so releases embed its Japanese fonts and fail
+pinned commit (`craft-fonts-ref` in `.github/workflows/release.yml` and `freebsd.yml`) and builds
+with `CRAFT_FONTS_DIR` and `CRAFT_FONTS_REQUIRED=1`, so releases embed its fonts and fail
 rather than ship without them (the web build embeds only the UI font, to stay small). The packages
 carry each embedded font's licence (`copy_font_licences` in `packaging/env.sh`). Bump the pins
 deliberately, in every job at once.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 3484e30a2..ae2e49261 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # Roadmap detail
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (new file: milestones moved from ROADMAP.md, Current focus rewritten from the 2026-10-10 re-measure, beta milestones added) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (M8: Fujifilm F-Log / F-Log2 / F-Log2 C colour spaces) · **Target:** Adobe Premiere Pro 2026 (26.5.2)
 
 Forward-looking plan: milestones with status, the current focus and what's next, with estimates in
 Opus 5.5 agent-hours (calibration in [target-app-parity.md](target-app-parity.md#calibration)).
@@ -63,12 +63,12 @@ Status: ✅ done · 🟡 in progress · ⬜ not started. Estimates are remaining
 | M0 | Skeleton + visual shell | ✅ | Workspace, 20 crates, dock/workspaces, Premiere 26 look, native menus, control channel, MCP, xtask gates (layers, wasm) | — | — |
 | M1 | Media I/O | ✅ | MP4/MOV demux+mux, WAV, stills, MJPEG, symphonia audio (MP3/FLAC/ALAC/Vorbis), GOP seek + frame cache, import | Media Browser polish | 2 |
 | M2 | H.264 decoder | ✅ | Own decoder, bit-exact on 37+ streams, 500–600 fps 1080p | — | — |
-| M3 | Editing core | 🟡 | Edit algebra (insert/overwrite/razor/lift/extract/ripple/roll/slip/slide/rate-stretch/nest/paste), tools, markers, trim mode + Trim Monitor + dynamic J/K/L trimming, Keyboard Shortcuts editor with FilmCraft/Premiere/FCP/Avid presets; Edit/Clip/File menu commands (Label colours and Select Label Group, Paste/Remove Attributes, Select All Matching, Remove Unused, Consolidate Duplicates, Sequence From Clip, Bin From Selection, Offline File, Close Project, Make/Edit Subclip, Modify Audio Channels/Timecode, Frame Hold Options/Add Frame Hold/Insert Frame Hold Segment, Time Interpolation with frame blending, Fit/Fill frame, Breakout to Mono, Extract Audio, Replace With Clip; M3.11: Scene Edit Detection (pure-Rust cut detection, background job), Normalize Mix Track, Simplify Sequence, Transcribe Sequence, Find/Find Next and search bins, Automate to Sequence, Edit Original, Edit Offline, Source Settings, Update Metadata (XMP), Generate Audio Waveform, Project Settings General/Scratch Disks, Get Media File Properties, Save as Template, Selection as FilmCraft Project, Avid Log Exchange export, Flash Cue markers, Dynamic Audio Waveforms, Reveal Log Files, System Compatibility Report); M3.12 keyboard parity: Premiere's default keyboard (~115 keyboard-only commands: edit-point navigation on targeted/any track, select clip at playhead/next/previous, extend edit to playhead, nudge/slip/slide selection, target and source-patch toggles, clip volume ±1 dB/many, frame maximize/full screen/panel cycling, monitor zoom, track heights, Project and Text panel keyboard navigation, text size/leading/alignment, Export Frame, poster frames; see docs/keyboard.md); multicam (Create Multi-Camera Source Sequence, Multi-Camera view with live switching on 1–9, angle switching, Enable/Flatten, Edit Cameras) and sync (Synchronize, Merge Clips; In/Out/timecode/marker/audio — GCC-PHAT, sample-accurate) | Multicam paging >16 angles and grid thumbnails, optical flow (renders as frame blending), 39 Premiere default shortcuts skipped with reasons in docs/keyboard.md (Productions, AI/cloud tools, work area bar, Production/Search panels) | 6–10 |
+| M3 | Editing core | 🟡 | Edit algebra (insert/overwrite/razor/lift/extract/ripple/roll/slip/slide/rate-stretch/nest/paste), tools, markers, trim mode + Trim Monitor + dynamic J/K/L trimming, Keyboard Shortcuts editor with FilmCraft/Premiere/FCP/Avid presets; Edit/Clip/File menu commands (Label colours and Select Label Group, Paste/Remove Attributes, Select All Matching, Remove Unused, Consolidate Duplicates, Sequence From Clip, Bin From Selection, Offline File, Close Project, Make/Edit Subclip, Modify Audio Channels/Timecode, Frame Hold Options/Add Frame Hold/Insert Frame Hold Segment, Time Interpolation with frame blending, Fit/Fill frame, Breakout to Mono, Extract Audio, Replace With Clip; M3.11: Scene Edit Detection (pure-Rust cut detection, background job), Normalize Mix Track, Simplify Sequence, Transcribe Sequence, Find/Find Next and search bins, Automate to Sequence, Edit Original, Edit Offline, Source Settings, Update Metadata (XMP), Generate Audio Waveform, Project Settings General/Scratch Disks, Get Media File Properties, Save as Template, Selection as FilmCraft Project, Avid Log Exchange export, Flash Cue markers, Dynamic Audio Waveforms, Reveal Log Files, System Compatibility Report); M3.12 keyboard parity: Premiere's default keyboard (~115 keyboard-only commands: edit-point navigation on targeted/any track, select clip at playhead/next/previous, extend edit to playhead, nudge/slip/slide selection, target and source-patch toggles, clip volume ±1 dB/many, frame maximize/full screen/panel cycling, monitor zoom, track heights, Project and Text panel keyboard navigation, text size/leading/alignment, Export Frame, poster frames; see docs/keyboard.md); multicam (Create Multi-Camera Source Sequence, Multi-Camera view with live switching on 1–9, angle switching, Enable/Flatten, Edit Cameras) and sync (Synchronize, Merge Clips; In/Out/timecode/marker/audio — GCC-PHAT, sample-accurate) | Multicam paging >16 angles and grid thumbnails, optical flow (renders as frame blending), 34 Premiere default shortcuts skipped with reasons in docs/keyboard.md (Productions, AI/cloud tools, Production/Search panels) | 6–10 |
 | M4 | Playback | 🟡 | Audio-clock master, prefetch with cancellation, J/K/L, correct dropped-frame stats, playback resolution, render bar + content-hashed render previews, App Nap opt-out; 1080p H.264 and 3 stacked 1080p streams play with 0 dropped frames | 4K under load, 8K, frame-threaded AV1 decode, reduced-resolution decode for multicam grids | 6–10 |
 | M5 | Effects, keyframes, GPU | 🟡 | All 93 Premiere 26 video effects and 84 transitions (CPU), blend modes and 33 common effects on the GPU (#32, GPU2, GPU4, GPU5), keyframes + value/velocity graphs, wgpu compositor, effect + opacity masks (ellipse/polygon/pen, feather, expansion, modes; CPU/WGSL parity), mask tracking (Lucas–Kanade + RANSAC), adjustment layers, effect presets (built-in + user, JSON import/export) | More effects on the GPU (34 ids done incl. Lumetri basic / creative / vignette; GPU export landed #421), GPU masks in the live path, exact Warp Stabilizer (3-D) and Morph Cut | 40–70 |
 | M6 | Export | ✅ | Own H.264 encoder (High/Main/Baseline, B-frames, VBR/CBR/2-pass) → MP4 or QuickTime + own AAC; ProRes, DNxHR, MJPEG, PNG/TIFF/BMP sequences (Premiere-style numbering), GIF, WAV, AIFF; background jobs; M6.5: Export mode parity (frame size / rate / scaling / pixel aspect, profile / level, CBR / VBR 1- and 2-pass, keyframe distance, audio codec / rate / channels / bitrate / sample size, multiplexer, burn-in or sidecar captions, image / name / timecode overlays, video limiter, loudness normalization with true-peak limiter, metadata, ranges, estimated size, summary), 24 built-in presets + user presets with favourites and import/export (Preset Manager), export queue (reorder, cancel, retry, several sequences / ranges), Quick Export; `export.*` commands and `filmcraft-cli export --preset` | Interlaced encoding, 5.1 audio, smart render, publishing destinations | 6–8 |
 | M7 | Audio | 🟡 | Mixer graph (tracks → submixes → Mix, pre/post-fader inserts and sends, latency-compensated, sample-accurate, ~6× realtime for 24 tracks × 3 effects on one core), Audio Track Mixer + Audio Clip Mixer panels, track automation (Off/Read/Latch/Touch/Write, recorded live while playing, thinned to keyframes, timeline lanes with pen editing), solo/solo-safe, channel mapping basics, peak + BS.1770 loudness meters (match ffmpeg), DSP crate with 16 clip/track effects, Audio Gain (set/adjust/normalize), Constant Power / Constant Gain / Exponential Fade, Essential Sound (types, Loudness auto-match, Repair incl. DeEss/DeReverb, Clarity, Creative, Ducking keyframes, presets; full Dialogue chain 22× realtime) | Music duration remix, ML speech enhancement, 5.1 panner and multichannel buses, voice-over record, effect editor windows (EQ curve), remaining effects (multiband, convolution reverb), clip-mixer automation recording | 6–9 |
-| M8 | Colour | 🟡 | Lumetri: basic, creative + looks, RGB & hue curves, wheels, HSL secondary, vignette, section bypass; Input LUT / Look LUT (.cube 1D/3D/shaper, .3dl; tetrahedral CPU + WGSL; project LUT library; built-in camera conversions); Colour Match (Oklab tonal-range statistics, skin protection, solved in Lumetri wheels); colour management: Rec. 709 / Rec. 2100 PQ / HLG working spaces + wide gamut, Interpret Footage colour space (S-Log3, V-Log, Canon Log 2/3, LogC3/4, Apple Log, D-Log from published specs), metadata auto-detect, BT.2390 tone mapping, gamut mapping, HDR export signalling (VUI/colr/mdcv/clli/SEI, ffprobe-verified); Lumetri Scopes: Vectorscope YUV (75/100 % targets, skin-tone line) and HLS, Histogram, Parade (RGB/YUV/RGB-White), Waveform (RGB/Luma/YC/YC no Chroma), presets, Rec. 601/709/2100, 8-bit/float/HDR (cd/m²) scales, multi-scope grid, `scopes.read` | HDR-aware Lumetri maths, macOS EDR monitors, mastering metadata → tone-map peak, D-Log M (no published formula), HSL Secondary refine | 3–5 |
+| M8 | Colour | 🟡 | Lumetri: basic, creative + looks, RGB & hue curves, wheels, HSL secondary, vignette, section bypass; Input LUT / Look LUT (.cube 1D/3D/shaper, .3dl; tetrahedral CPU + WGSL; project LUT library; built-in camera conversions); Colour Match (Oklab tonal-range statistics, skin protection, solved in Lumetri wheels); colour management: Rec. 709 / Rec. 2100 PQ / HLG working spaces + wide gamut, Interpret Footage colour space (S-Log3, V-Log, Canon Log 2/3, LogC3/4, Apple Log, D-Log, Fujifilm F-Log / F-Log2 / F-Log2 C from published specs), metadata auto-detect, BT.2390 tone mapping, gamut mapping, HDR export signalling (VUI/colr/mdcv/clli/SEI, ffprobe-verified); Lumetri Scopes: Vectorscope YUV (75/100 % targets, skin-tone line) and HLS, Histogram, Parade (RGB/YUV/RGB-White), Waveform (RGB/Luma/YC/YC no Chroma), presets, Rec. 601/709/2100, 8-bit/float/HDR (cd/m²) scales, multi-scope grid, `scopes.read` | HDR-aware Lumetri maths, macOS EDR monitors, mastering metadata → tone-map peak, D-Log M (no published formula), HSL Secondary refine | 3–5 |
 | M9 | More codecs | 🟡 | ProRes decode+encode, AAC decode+encode, HEVC Main/Main 10 decoder (bit-exact on 41 fixtures, ~225 fps 1080p), VP9 decoder (profiles 0–3, 8/10/12-bit, bit-exact on 50+ fixtures; WebM/MKV `V_VP9` and MP4 `vp09` import with key-frame-checked seeking), Matroska/WebM import (H.264/HEVC/VP9/ProRes/MJPEG + AAC/Opus/FLAC/MP3/Vorbis/PCM), Opus decoder (SILK/CELT/hybrid, 5.1/7.1 multistream; all RFC 8251 vectors range-exact; WebM/MKV/MP4), DNxHD/DNxHR decoder (all SMPTE ST 2019-1 CIDs, 8/10/12-bit, 4:2:2/4:4:4, interlaced, alpha; within IDCT precision of ffmpeg on 22 fixtures) + DNxHR LB/SQ/HQ/HQX/444 encoder and MOV `AVdh` export, AV1 decoder (Main profile, 8/10-bit, all intra/inter tools, loop filters, superres, film grain, intra BC, spatial layers; bit-exact vs libdav1d on 19 SVT fixtures + 22 libaom vectors; MP4 `av01` / WebM `V_AV1` import), MXF import (OP1a/OP-Atom; AVC with POC-ordered B pictures bit-exact, DNxHD/DNxHR, ProRes, PCM/AES3; MPEG-2 reported unsupported; index-table seeking, material package timecode), Ogg Opus/Vorbis (granule seeking, pre-skip, end trimming), image sequences, Broadcast WAV timecode | VP9 frame threading, AV1 threading/SIMD (~4 fps 1080p today), AV1 High/Professional profiles, H.264 High 10 / 4:2:2 and HEVC 4:2:2 in software (G3), E-AC-3, AVI (MPEG-2 decoder and hardware decode have landed) | 30–50 |
 | M10 | Graphics & captions | 🟡 | Caption tracks (Subtitle/CEA-608/708/Teletext formats, track style), SRT/WebVTT/SCC import+export (frame-exact, property-tested), caption editing (add/split/merge/trim/move, sync-locked insert/extract), Text panel Captions tab, burn-in in Program monitor and export; text engine (`crates/text`: bundled + system fonts, harfrust shaping, bidi, line breaking, paragraph layout, glyph cache; 3-line 1080p title ≈ 0.15 ms warm); graphic clips with text + shape layers (fill, 2 strokes, background, shadow, keyframable transform), Type tool with on-monitor editing, shape/pen tools, Properties/Essential Graphics editor, align/distribute; graphics templates (own `.fcgt` format, 8 original built-ins, Browse tab with engine-rendered thumbnails, export / install / apply / editable properties; never reads .mogrt), rolls/crawls with ease and pre/postroll, responsive pins and intro/outro, per-character styles, Upgrade Caption to Graphic, source graphics, Replace Fonts; MCC (608+708), EBU STL, TTML/IMSC1, DFXP (frame-exact, property-tested) | 608/708 embedding in video streams, speech-to-text | 12–18 |
 | M11 | Interchange & project management | ✅ | `.fcproj` schema versions + migrations, atomic saves, Save a Copy/Revert, auto-save ring + crash-recovery journal (Preferences ▸ Auto Save, recovery prompt), FCP7 XML, FCPXML, EDL, OTIO; offline media (own slate) + Link Media (fingerprint-checked relink, folder remap, search, Align Timecode, Make Offline); proxies (ProRes Proxy/LT, H.264 ¼/½ background jobs, attach/detach/reconnect, monitor toggle, export full-res) + ingest (copy/transcode/proxies); Project Manager (collect, consolidate + transcode with handles, size estimate) | Rename media to clip names, image-sequence conversion, Media Browser-driven relink, smart (cross-drive) path tracking | 1–2 |
diff --git a/docs/testing.md b/docs/testing.md
index 67d312fad..77ed53f0d 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -2,6 +2,7 @@
 
 ```sh
 cargo test --workspace                          # everything; oracle tests skip without ffmpeg
+cargo nextest run --workspace                   # the same in parallel processes (doctests: cargo test --doc)
 cargo test -p filmcraft-h264                    # one crate
 cargo test --release -p filmcraft-hevc          # codec tests are much faster in release
 cargo xtask ci                                  # all gates (fmt, clippy, tests, layers, assets, wasm)
@@ -9,34 +10,41 @@ cargo xtask fixtures                            # pre-generate the ffmpeg fixtur
 FILMCRAFT_REQUIRE_ORACLES=1 cargo test --workspace   # CI: missing ffmpeg fails instead of skipping
 ```
 
+Integration tests build one binary per crate: a crate with several test files keeps them in
+`tests/it/`, and `tests/it/main.rs` declares each as a module. Add a test file there with a `mod`
+line in `main.rs`; shared helpers live in `tests/it/common/` or `tests/it/support/`. A test file that
+changes process-wide state (a global switch, pool, panic hook or fault injection) or times a workload
+stays a binary of its own in `tests/`. Select one file's tests with its module path:
+`cargo test -p filmcraft-h264 --test it conformance::`.
+
 ## 1. Kinds of tests
 
 | Kind | Where | Examples |
 |---|---|---|
 | Unit | `src/` `#[cfg(test)]` modules, `src/tests.rs` | CABAC engines, VLC tables (prefix-freeness, Kraft sums), colour matrices, frame cache |
-| Property (`proptest`) | `time`, `bitstream`, `edit`, `isobmff/tests/roundtrip.rs`, `interchange/tests/*` | tick↔frame round trips for every rate, DF timecode, edit invariants (no overlaps, durations conserved), mux→demux round trips, interchange export→import |
+| Property (`proptest`) | `time`, `bitstream`, `edit`, `isobmff/tests/it/roundtrip.rs`, `interchange/tests/it/*` | tick↔frame round trips for every rate, DF timecode, edit invariants (no overlaps, durations conserved), mux→demux round trips, interchange export→import |
 | Synthetic streams | `h264/src/synth_tests.rs`, `hevc/src/synth_tests.rs` | hand-built bitstreams for features the reference encoders don't emit; expected output known exactly |
-| Scripted UI | `crates/ui-egui/tests/scripted.rs` | headless app (egui_kittest) driven over the control channel: razor/undo, insert, apply effect, playback, click by automation id (§4) |
-| Monitor view / Graphics menu | `crates/ui-egui/tests/view_ui.rs`, `crates/engine/src/graphics_tests.rs` | View menu items and checkmarks, playback/paused resolution, channel / comparison / multi-camera / waveform display modes, magnification and Hand-tool panning, guides dragged from the rulers (move, lock, remove, Add Guide…, templates in the preferences), snapping a graphic to the frame centre and a guide; align to frame / as group / to selection, distribute (centres and gaps), arrange, select next/previous graphic and layer, reset parameters / duration, vertical text, New Layer from file (`FILMCRAFT_UI_SHOTS=<dir>` writes `view-*.png`) |
-| Settings | `crates/engine/src/settings_tests.rs`, `crates/ui-egui/tests/settings_ui.rs` | schema keys and defaults, persistence in the data directory, v1 → v2 migration and repair of bad values, validation, per-category reset; each wired setting (still / transition durations, step many, label defaults and colours, media scaling, timebase, recent projects, media cache policy, output mapping, smart quotes, auto-transcribe); the dialog: every category from its command and Cmd+,, edits by automation id, OK / Cancel / Escape / Reset…, theme, label names in Edit ▸ Label, tooltips, frame cache (`FILMCRAFT_UI_SHOTS=<dir>` writes `settings-*.png`) |
-| Scopes and panels (M8.9 / M12.6) | `crates/scopes/src/tests.rs`, `crates/engine/src/{scopes,panels}_tests.rs`, `crates/ui-egui/tests/panels_ui.rs` | scope maths on generated frames (flat colours → exact histogram bins, ramps → waveform row = code value, 75 % bars → parade levels and vectorscope target cells for BT.601/709/2020, HLS hue angles, YC chroma, Clamp Signal, decimation, NaN); `scopes.read` on a colour matte (exact bins, 78.43 %) and on Bars and Tone (the six targets); metadata edits (one undo step, read-only fields refused, saved in the project), the event log (failed / disabled commands, repeats, jobs started / finished / failed / cancelled); every panel from Window ▸, the scopes' wrench menu, presets, five-scope grid, typing into a Metadata field, Timecode rows and modes, Events filter / Clear All, Progress cancel, Reference Monitor park / gang / scopes (`FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` writes `panels-*.png`); `perf_scopes_at_1080p` (ignored) times each scope |
-| Keyframe navigator and Effect Controls ruler | `crates/engine/src/tests.rs` (`add_keyframe_toggles_the_keyframe_at_the_playhead`), `crates/ui-egui/tests/keyframes_ui.rs`, `lane_tests` in `crates/ui-egui/src/panels/effect_controls.rs` | `effects.addKeyframe` adds a keyframe at the playhead or removes the one there (the value falls back to the remaining keyframes; undo, redo, parameters that name nothing); headless: the Properties diamond turns animation on, adds and removes the keyframe at the playhead (Scale 50 % → 100 % again), its ◀ ▶ arrows and Effect Controls' step between keyframes, Crop is applied before its first keyframe; a click on the Effect Controls time ruler and a drag of the playhead's handle move the playhead, and no playhead is drawn off the clip; ruler labels are sequence timecode, and clip times, frame rates and panel widths at their limits don't panic (`FILMCRAFT_UI_SHOTS=<dir>` writes `keyframes-*.png`) |
+| Scripted UI | `crates/ui-egui/tests/it/scripted.rs` | headless app (egui_kittest) driven over the control channel: razor/undo, insert, apply effect, playback, click by automation id (§4) |
+| Monitor view / Graphics menu | `crates/ui-egui/tests/it/view_ui.rs`, `crates/engine/src/graphics_tests.rs` | View menu items and checkmarks, playback/paused resolution, channel / comparison / multi-camera / waveform display modes, magnification and Hand-tool panning, guides dragged from the rulers (move, lock, remove, Add Guide…, templates in the preferences), snapping a graphic to the frame centre and a guide; align to frame / as group / to selection, distribute (centres and gaps), arrange, select next/previous graphic and layer, reset parameters / duration, vertical text, New Layer from file (`FILMCRAFT_UI_SHOTS=<dir>` writes `view-*.png`) |
+| Settings | `crates/engine/src/settings_tests.rs`, `crates/ui-egui/tests/it/settings_ui.rs` | schema keys and defaults, persistence in the data directory, v1 → v2 migration and repair of bad values, validation, per-category reset; each wired setting (still / transition durations, step many, label defaults and colours, media scaling, timebase, recent projects, media cache policy, output mapping, smart quotes, auto-transcribe); the dialog: every category from its command and Cmd+,, edits by automation id, OK / Cancel / Escape / Reset…, theme, label names in Edit ▸ Label, tooltips, frame cache (`FILMCRAFT_UI_SHOTS=<dir>` writes `settings-*.png`) |
+| Scopes and panels (M8.9 / M12.6) | `crates/scopes/src/tests.rs`, `crates/engine/src/{scopes,panels}_tests.rs`, `crates/ui-egui/tests/it/panels_ui.rs` | scope maths on generated frames (flat colours → exact histogram bins, ramps → waveform row = code value, 75 % bars → parade levels and vectorscope target cells for BT.601/709/2020, HLS hue angles, YC chroma, Clamp Signal, decimation, NaN); `scopes.read` on a colour matte (exact bins, 78.43 %) and on Bars and Tone (the six targets); metadata edits (one undo step, read-only fields refused, saved in the project), the event log (failed / disabled commands, repeats, jobs started / finished / failed / cancelled); every panel from Window ▸, the scopes' wrench menu, presets, five-scope grid, typing into a Metadata field, Timecode rows and modes, Events filter / Clear All, Progress cancel, Reference Monitor park / gang / scopes (`FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` writes `panels-*.png`); `perf_scopes_at_1080p` (ignored) times each scope |
+| Keyframe navigator and Effect Controls ruler | `crates/engine/src/tests.rs` (`add_keyframe_toggles_the_keyframe_at_the_playhead`), `crates/ui-egui/tests/it/keyframes_ui.rs`, `lane_tests` in `crates/ui-egui/src/panels/effect_controls.rs` | `effects.addKeyframe` adds a keyframe at the playhead or removes the one there (the value falls back to the remaining keyframes; undo, redo, parameters that name nothing); headless: the Properties diamond turns animation on, adds and removes the keyframe at the playhead (Scale 50 % → 100 % again), its ◀ ▶ arrows and Effect Controls' step between keyframes, Crop is applied before its first keyframe; a click on the Effect Controls time ruler and a drag of the playhead's handle move the playhead, and no playhead is drawn off the clip; ruler labels are sequence timecode, and clip times, frame rates and panel widths at their limits don't panic (`FILMCRAFT_UI_SHOTS=<dir>` writes `keyframes-*.png`) |
 | Golden images | `crates/golden/tests/golden.rs` | CPU renders vs committed PNGs; GPU vs CPU on the same scenes (§3) |
 | Engine / command | `crates/engine/src/tests.rs` | run commands on the demo project, assert the sequence, undo/redo, disabled cases |
 | Render | `crates/render/src/tests.rs` | compositing, opacity, Motion, cross dissolve midpoint, ½-res vs full, GPU plan vs reference, audio mix, audio-effect continuity |
-| Multi-camera / sync | `crates/audio-dsp/src/sync.rs`, `crates/engine/src/multicam_tests.rs`, `crates/ui-egui/tests/multicam_ui.rs` | audio offsets within one sample: Rust-generated multi-mic speech (gains −20…+10 dB, SNR 40/25/10/3 dB, zero-phase colouring, fractional delays, a 0 dB-SNR room with a −4 dB echo) and ffmpeg-made camera/recorder files (pink-noise bursts, independent noise; exact lags recovered); timecode (± hours) and marker sync within a frame; Merge Clips; timeline Synchronize keeps frame-aligned starts; multicam structure, angle render (PSNR vs the camera), Switch Audio mix = the angle's track, live switching from a simulated playback clock (cuts, healing, one undo step), Ctrl+N cuts, flatten (frames identical), save/load; 20 angles: paging (auto / 2×2 / 3×3), page-relative keys, absolute cameras beyond 16, a page decoding only its angles at the cell scale (recording source), Auto-Adjust scale, Selection Top Down; headless: page arrows, angle 17–20 cells, grid-only view, Edit Cameras thumbnails; `perf_grid_of_four_1080p_angles` (ignored) prints the grid cost |
-| Project panel and Media Browser (M12.7) | `crates/engine/src/{project_panel,media_browser}_tests.rs`, `crates/ui-egui/tests/project_panel_ui.rs` | view settings and their preference round trip; Metadata Display columns (custom fields, Freeform keys hidden), numeric vs text sorting, view presets (save / save as / restore / rename / delete, ten slots, persisted in `preferences.json`); Freeform moves keeping offsets, snapping, Align to Grid, Clip Size, stacks, arrangements, Reset (each one undo step, saved in the project); bin rename / nesting; the Media Browser against a fake filesystem (folders first, hidden and unsupported files left out, file-type filter, back / forward / up, recent directories, Favorites, import of a selection or a folder, Open in Source Monitor, ingest, probe columns). Headless: List view (sort by header, drag a column wider, inline rename), Icon view (hover scrub + I / O set the clip's In / Out, Shift+] / [), Freeform (drag a card, stack from the card menu, options dialog), panel menu, Metadata Display dialog, view presets, bins in place / tab / window, footer buttons, Media Browser navigation, Favorites, import, Shift+O, Edit Columns…, thumbnails, drag to the Timeline (`FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` writes `project-*.png`, `media-browser-*.png`) |
-| Menu long tail (M3.11) | `crates/render/src/scene.rs`, `crates/engine/src/{scene_detect,sequence_extras,project_tools}_tests.rs`, `crates/interchange/src/ale.rs`, `crates/project/src/find.rs`, `crates/ui-egui/tests/menus_ui.rs` | Scene Edit Detection on synthetic frames (hard cuts vs pans, flashes, sensitivity) and on generated movies with known cut points (our own ProRes render of demo scenes; an ffmpeg-made H.264 concat of testsrc2 / SMPTE bars / Mandelbrot): cuts with linked audio, clip markers, subclips, one undo step, background job and cancel; Normalize Mix Track to a target peak; Simplify Sequence; Find / Find Next and search bins; Automate to Sequence (overlap, transitions, insert, unnumbered markers); ALE round trip; Project Settings and scratch disks; menu order and shortcuts against Premiere's; the dialogs by automation id |
+| Multi-camera / sync | `crates/audio-dsp/src/sync.rs`, `crates/engine/src/multicam_tests.rs`, `crates/ui-egui/tests/it/multicam_ui.rs` | audio offsets within one sample: Rust-generated multi-mic speech (gains −20…+10 dB, SNR 40/25/10/3 dB, zero-phase colouring, fractional delays, a 0 dB-SNR room with a −4 dB echo) and ffmpeg-made camera/recorder files (pink-noise bursts, independent noise; exact lags recovered); timecode (± hours) and marker sync within a frame; Merge Clips; timeline Synchronize keeps frame-aligned starts; multicam structure, angle render (PSNR vs the camera), Switch Audio mix = the angle's track, live switching from a simulated playback clock (cuts, healing, one undo step), Ctrl+N cuts, flatten (frames identical), save/load; 20 angles: paging (auto / 2×2 / 3×3), page-relative keys, absolute cameras beyond 16, a page decoding only its angles at the cell scale (recording source), Auto-Adjust scale, Selection Top Down; headless: page arrows, angle 17–20 cells, grid-only view, Edit Cameras thumbnails; `perf_grid_of_four_1080p_angles` (ignored) prints the grid cost |
+| Project panel and Media Browser (M12.7) | `crates/engine/src/{project_panel,media_browser}_tests.rs`, `crates/ui-egui/tests/it/project_panel_ui.rs` | view settings and their preference round trip; Metadata Display columns (custom fields, Freeform keys hidden), numeric vs text sorting, view presets (save / save as / restore / rename / delete, ten slots, persisted in `preferences.json`); Freeform moves keeping offsets, snapping, Align to Grid, Clip Size, stacks, arrangements, Reset (each one undo step, saved in the project); bin rename / nesting; the Media Browser against a fake filesystem (folders first, hidden and unsupported files left out, file-type filter, back / forward / up, recent directories, Favorites, import of a selection or a folder, Open in Source Monitor, ingest, probe columns). Headless: List view (sort by header, drag a column wider, inline rename), Icon view (hover scrub + I / O set the clip's In / Out, Shift+] / [), Freeform (drag a card, stack from the card menu, options dialog), panel menu, Metadata Display dialog, view presets, bins in place / tab / window, footer buttons, Media Browser navigation, Favorites, import, Shift+O, Edit Columns…, thumbnails, drag to the Timeline (`FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` writes `project-*.png`, `media-browser-*.png`) |
+| Menu long tail (M3.11) | `crates/render/src/scene.rs`, `crates/engine/src/{scene_detect,sequence_extras,project_tools}_tests.rs`, `crates/interchange/src/ale.rs`, `crates/project/src/find.rs`, `crates/ui-egui/tests/it/menus_ui.rs` | Scene Edit Detection on synthetic frames (hard cuts vs pans, flashes, sensitivity) and on generated movies with known cut points (our own ProRes render of demo scenes; an ffmpeg-made H.264 concat of testsrc2 / SMPTE bars / Mandelbrot): cuts with linked audio, clip markers, subclips, one undo step, background job and cancel; Normalize Mix Track to a target peak; Simplify Sequence; Find / Find Next and search bins; Automate to Sequence (overlap, transitions, insert, unnumbered markers); ALE round trip; Project Settings and scratch disks; menu order and shortcuts against Premiere's; the dialogs by automation id |
 | Mixer | `crates/render/src/mixer_tests.rs`, `crates/engine/src/mixer_tests.rs` | sample-exact fader gain and pan laws, automation at block boundaries (bit-identical however requests are cut), solo/mute/solo-safe, sends and submix routing, latency-compensation alignment, render-vs-playback identity, Touch ramp-back, recorder modes (Latch/Touch/Write), thinning, Audio Gain, transition curves; `perf_24_tracks_3_effects_realtime_factor` prints the realtime factor |
-| 5.1 / multichannel | `crates/audio-dsp/src/channels.rs`, `crates/render/src/mixer_tests.rs`, `crates/export/src/surround_tests.rs`, `crates/engine/src/mixer_tests.rs`, `crates/ui-egui/tests/audio51_ui.rs` | BS.775 downmix / upmix coefficients exact, mixdown types; 5.1 panner point gains equal-power (Σg² = 1 over a 21×21 grid × 3 centre settings), speaker positions exact, 5.1 through the default puck bit-exact identity; graph: stereo/mono tracks into a 5.1 Mix (L/R, C, rear right, room centre −6 dB each, LFE = mean), 5.1 track through a 5.1 Mix and folded into stereo, a 5.1 submix, `pan51` automation block-invariant, six-channel meters; export: 6-ch WAV (`WAVE_FORMAT_EXTENSIBLE`, mask 0x3F) and ProRes MOV (6 × 24-bit PCM) decoded by ffmpeg **sample-exact**, ffprobe `channels` 6 / `channel_layout` 5.1; AAC 5.1 in MP4: every decoded channel's own tone ≥ 30 dB above the others' (no swapped channels), stereo export of a 5.1 Mix = BS.775 within 2·10⁻⁶; `sequence.settings {mix}`, `file.newSequence {mix, trackType}`, panner lanes, Write pass records the puck; UI: puck drag (one undo step), Center / LFE, six meter bars |
-| Audio Clip Mixer automation, Track Mixer view | `crates/engine/src/mixer_tests.rs`, `crates/ui-egui/tests/audio51_ui.rs` | Touch: a 201-point fader ramp thins to ≤ 6 clip keyframes, values within 0.1 dB, live override while held, values outside the gesture unchanged, one undo step; Latch holds until stop; Write records volume and pan from the start; a gesture across two clips writes both; Read commits once without a pass; UI: Clip Mixer mode dropdown, a recorded fader drag writes clip keyframes; Show/Hide Tracks, Meter Input(s) Only, transport record button |
-| Voice-over | `crates/engine/src/voiceover_tests.rs`, `crates/ui-egui/tests/voiceover_ui.rs` | synthetic click train lands in `mix_sequence` exactly at R + k·period (pre-roll dropped, exact sample count), punch-in between In/Out (ramp source, every sample checked), one undo step + undo/redo, take numbering, record-arm/targeting track choice, sync/discard/zero-length/locked cases, cue times; UI: right-click Mic → Voice-Over Record Settings dialog (edits persist on OK, Cancel discards), the Mic button starts and stops a take on its track with pre-roll and overlay, and records past the end of the timeline (also `voiceover_playback_tests` in `crates/ui-egui/src/lib.rs`) |
-| Text to Speech | `crates/tts/src/**/*.rs` (Kokoro tests need `FILMCRAFT_KOKORO_DIR`), `crates/tts-text`, `crates/engine/src/narration_tests.rs`, `crates/ui-egui/tests/tts_ui.rs` | built-in voices: determinism, finite samples, exact-silence pause markers, pace scales length, measured pitch per voice and per semitone, hostile scripts; engine: narration placed at the playhead with clip length = speech (sample-exact), never overwrites (busy tracks → next free track → new track), occupied/locked/unknown track refused with no change, edit keeps start/length/speed (longer speech: whole speech in the file; shorter: file padded with exact zeros), edits write beside the previous file, undo/redo restore the project exactly, enabled only with a narration clip (or `clip`), 16 hostile parameter sets refused without change, preview changes nothing, save/reload keeps narrations, the narration is audible in `mix_sequence`; UI: type + Add pause + Add to timeline, the new clip is selected and loaded, clicking the clip on the timeline loads its script, Save edits it in place as one undo step, Advanced twirl, panel opens beside Properties; natural voices: 50-sentence Whisper-base WER 2.1–3.6 % for all 9 voices (crate README), loaders fuzzed with hostile files, `tts.render` cache, download refused without the feature |
-| Remix | `crates/audio-dsp/src/remix.rs`, `crates/render/src/remix.rs`, `crates/engine/src/remix_tests.rs`, `crates/ui-egui/tests/remix_ui.rs` | generated rhythmic music (Rust-synthesised drums, bass, chord sections at 90–128 BPM, 22.05/44.1/48 kHz): tempo within 0.3 BPM, every beat within 10 ms (measured ≤ 8.9 ms); remix targets from 0.4× to 2.2× the source within one beat (measured ≤ 12 ms at default sliders), every cut on a detected beat, intro and outro kept, pieces ≥ 4 beats, deterministic; silence, tone and noise refused; rendering independent of request cuts, source-exact outside the 20 ms equal-power crossfades, no clicks; the engine's mix equals the source pieces (< 1e-5); undo, redo and revert exact; overlaps refused; Remix Properties dialog and Remix tool drag driven by automation id |
-| Oracle | `crates/*/tests/*oracle*.rs`, `conformance.rs` | compare with ffmpeg/ffprobe (§2) |
-| Robustness / fuzz | `*/tests/robustness.rs`, `*/tests/fuzz.rs` | seeded mutation and truncation of real and synthetic files; nothing may panic |
-| Program monitor while dragging | `crates/ui-egui/tests/perf_ui.rs` | headless: a parameter changed on every UI pass (a value dragged in Effect Controls or Properties) and a backward scrub leave the Program monitor's picture at most one step behind (it shows the frame asked for the pass before while the frame due renders; it used to freeze until the mouse rested); a frame still rendering is kept when the same frame is asked for at a newer revision, so frames slower than a refresh (CPU effects) are shown too; `perf.stats` reports the picture's frame and revision against the playhead and the project |
-| Performance | `*/tests/perf.rs` (`#[ignore]`) | §5 |
+| 5.1 / multichannel | `crates/audio-dsp/src/channels.rs`, `crates/render/src/mixer_tests.rs`, `crates/export/src/surround_tests.rs`, `crates/engine/src/mixer_tests.rs`, `crates/ui-egui/tests/it/audio51_ui.rs` | BS.775 downmix / upmix coefficients exact, mixdown types; 5.1 panner point gains equal-power (Σg² = 1 over a 21×21 grid × 3 centre settings), speaker positions exact, 5.1 through the default puck bit-exact identity; graph: stereo/mono tracks into a 5.1 Mix (L/R, C, rear right, room centre −6 dB each, LFE = mean), 5.1 track through a 5.1 Mix and folded into stereo, a 5.1 submix, `pan51` automation block-invariant, six-channel meters; export: 6-ch WAV (`WAVE_FORMAT_EXTENSIBLE`, mask 0x3F) and ProRes MOV (6 × 24-bit PCM) decoded by ffmpeg **sample-exact**, ffprobe `channels` 6 / `channel_layout` 5.1; AAC 5.1 in MP4: every decoded channel's own tone ≥ 30 dB above the others' (no swapped channels), stereo export of a 5.1 Mix = BS.775 within 2·10⁻⁶; `sequence.settings {mix}`, `file.newSequence {mix, trackType}`, panner lanes, Write pass records the puck; UI: puck drag (one undo step), Center / LFE, six meter bars |
+| Audio Clip Mixer automation, Track Mixer view | `crates/engine/src/mixer_tests.rs`, `crates/ui-egui/tests/it/audio51_ui.rs` | Touch: a 201-point fader ramp thins to ≤ 6 clip keyframes, values within 0.1 dB, live override while held, values outside the gesture unchanged, one undo step; Latch holds until stop; Write records volume and pan from the start; a gesture across two clips writes both; Read commits once without a pass; UI: Clip Mixer mode dropdown, a recorded fader drag writes clip keyframes; Show/Hide Tracks, Meter Input(s) Only, transport record button |
+| Voice-over | `crates/engine/src/voiceover_tests.rs`, `crates/ui-egui/tests/it/voiceover_ui.rs` | synthetic click train lands in `mix_sequence` exactly at R + k·period (pre-roll dropped, exact sample count), punch-in between In/Out (ramp source, every sample checked), one undo step + undo/redo, take numbering, record-arm/targeting track choice, sync/discard/zero-length/locked cases, cue times; UI: right-click Mic → Voice-Over Record Settings dialog (edits persist on OK, Cancel discards), the Mic button starts and stops a take on its track with pre-roll and overlay, and records past the end of the timeline (also `voiceover_playback_tests` in `crates/ui-egui/src/lib.rs`) |
+| Text to Speech | `crates/tts/src/**/*.rs` (Kokoro tests need `FILMCRAFT_KOKORO_DIR`), `crates/tts-text`, `crates/engine/src/narration_tests.rs`, `crates/ui-egui/tests/it/tts_ui.rs` | built-in voices: determinism, finite samples, exact-silence pause markers, pace scales length, measured pitch per voice and per semitone, hostile scripts; engine: narration placed at the playhead with clip length = speech (sample-exact), never overwrites (busy tracks → next free track → new track), occupied/locked/unknown track refused with no change, edit keeps start/length/speed (longer speech: whole speech in the file; shorter: file padded with exact zeros), edits write beside the previous file, undo/redo restore the project exactly, enabled only with a narration clip (or `clip`), 16 hostile parameter sets refused without change, preview changes nothing, save/reload keeps narrations, the narration is audible in `mix_sequence`; UI: type + Add pause + Add to timeline, the new clip is selected and loaded, clicking the clip on the timeline loads its script, Save edits it in place as one undo step, Advanced twirl, panel opens beside Properties; natural voices: 50-sentence Whisper-base WER 2.1–3.6 % for all 9 voices (crate README), loaders fuzzed with hostile files, `tts.render` cache, download refused without the feature |
+| Remix | `crates/audio-dsp/src/remix.rs`, `crates/render/src/remix.rs`, `crates/engine/src/remix_tests.rs`, `crates/ui-egui/tests/it/remix_ui.rs` | generated rhythmic music (Rust-synthesised drums, bass, chord sections at 90–128 BPM, 22.05/44.1/48 kHz): tempo within 0.3 BPM, every beat within 10 ms (measured ≤ 8.9 ms); remix targets from 0.4× to 2.2× the source within one beat (measured ≤ 12 ms at default sliders), every cut on a detected beat, intro and outro kept, pieces ≥ 4 beats, deterministic; silence, tone and noise refused; rendering independent of request cuts, source-exact outside the 20 ms equal-power crossfades, no clicks; the engine's mix equals the source pieces (< 1e-5); undo, redo and revert exact; overlaps refused; Remix Properties dialog and Remix tool drag driven by automation id |
+| Oracle | `crates/*/tests/{,it/}*oracle*.rs`, `conformance.rs` | compare with ffmpeg/ffprobe (§2) |
+| Robustness / fuzz | `*/tests/{,it/}robustness.rs`, `*/tests/{,it/}fuzz.rs` | seeded mutation and truncation of real and synthetic files; nothing may panic |
+| Program monitor while dragging | `crates/ui-egui/tests/it/perf_ui.rs` | headless: a parameter changed on every UI pass (a value dragged in Effect Controls or Properties) and a backward scrub leave the Program monitor's picture at most one step behind (it shows the frame asked for the pass before while the frame due renders; it used to freeze until the mouse rested); a frame still rendering is kept when the same frame is asked for at a newer revision, so frames slower than a refresh (CPU effects) are shown too; `perf.stats` reports the picture's frame and revision against the playhead and the project |
+| Performance | `*/tests/{,it/}perf.rs` (`#[ignore]`) | §5 |
 
 Commit `*.proptest-regressions` files so failing cases are re-run.
 
@@ -52,7 +60,7 @@ are never linked or shipped ([AGENTS.md](../AGENTS.md) §2).
 - If a tool is missing the test prints `SKIPPED (<test>): ffmpeg not found …` and passes. Set
   **`FILMCRAFT_REQUIRE_ORACLES=1`** (CI) to make every such skip a failure. In new tests use
   `let ff = filmcraft_testkit::require_ffmpeg!();` (also `require_ffprobe!`, `require_oracles!`).
-- Some oracles need a recent ffmpeg: the APV tests (`crates/apv/tests/oracle.rs`) skip when
+- Some oracles need a recent ffmpeg: the APV tests (`crates/apv/tests/it/oracle.rs`) skip when
   `ffmpeg -formats` does not list `apv` (ffmpeg ≥ 8.0), naming the detected version.
 - Fixtures are generated on first use into `<workspace>/target/fixtures/<crate>/`
   (`filmcraft_testkit::fixtures_dir`; independent of `CARGO_TARGET_DIR`, so agents with private
@@ -71,12 +79,12 @@ are never linked or shipped ([AGENTS.md](../AGENTS.md) §2).
   the matrix.
 - Fixture sources are synthetic: `testsrc2`, `mandelbrot`, SMPTE bars, noise and fades, sine tones.
   H.264 and HEVC fixtures need ffmpeg built with libx264 and libx265. VideoToolbox fixtures are
-  generated only on macOS. The Media Foundation parity tests (`crates/platform/tests/media_foundation.rs`,
+  generated only on macOS. The Media Foundation parity tests (`crates/platform/tests/it/media_foundation.rs`,
   Windows only) make their 640x360, 1080p and 2160p H.264 / HEVC / Main 10 fixtures with ffmpeg and skip
   without a Direct3D 11 video device or the HEVC / VP9 / AV1 codec extensions of the Microsoft Store. The VP9 and
   AV1 fixtures (libvpx-vp9, libaom-av1; 360p, 1080p, 2160p, hidden alt-ref frames, two GOPs) need an ffmpeg with those encoders.
 
-The NVENC tests (`crates/platform/tests/nvenc.rs` and `nvenc_export.rs` for H.264, `nvenc_rgba_input.rs` for
+The NVENC tests (`crates/platform/tests/it/nvenc.rs` and `nvenc_export.rs` for H.264, `nvenc_rgba_input.rs` for
 the GPU's RGB → 4:2:0 conversion, `nvenc_hevc.rs`,
 `nvenc_hevc_export.rs`, `nvenc_hevc_probe.rs` and `nvenc_hevc_warm.rs` for H.265, `nvenc_hevc_main10.rs` and
 `nvenc_hevc_hdr_export.rs` for Main 10 HDR; Windows only) skip, printing `SKIPPED`, without an NVIDIA GPU
@@ -173,7 +181,7 @@ Each codec README has the full fixture matrix and the measured results.
 
 ### Scripted UI tests (headless)
 
-`crates/ui-egui/tests/scripted.rs` runs the real `FilmcraftApp` under
+`crates/ui-egui/tests/it/scripted.rs` runs the real `FilmcraftApp` under
 [`egui_kittest`](https://docs.rs/egui_kittest) (`build_eframe`): no window, no GPU, no OS event loop.
 A small `Driver` opens the demo project, sends requests through the same control channel agents use
 (`ControlRequest` → `control::handle`, exactly as the TCP server does) and steps egui frames until
@@ -190,15 +198,15 @@ next frame by the app's own `raw_input_hook`, so clicks by automation id work he
 | `clicking_a_tool_button_by_automation_id` | `ui.click {id: "tools.Razor"}` changes the tool (real egui input path) |
 | `unknown_methods_and_commands_fail_cleanly` | errors come back as `{"ok": false}` |
 
-`crates/ui-egui/tests/mixer_ui.rs` drives the Audio Track Mixer, Audio Clip Mixer, timeline track
+`crates/ui-egui/tests/it/mixer_ui.rs` drives the Audio Track Mixer, Audio Clip Mixer, timeline track
 keyframes and the Audio Gain dialog by automation id and with multi-frame pointer drags (press, move
 over several frames, release). With `FILMCRAFT_UI_SNAPSHOT_DIR=<dir>` it also renders the window
 offscreen through wgpu (`Harness::render`) and writes `mixer-*.png`; this works without a visible
 window (for example on a locked screen, where `ui.screenshot` cannot capture).
-`crates/ui-egui/tests/essential_sound_ui.rs` does the same for the Essential Sound panel (type buttons,
+`crates/ui-egui/tests/it/essential_sound_ui.rs` does the same for the Essential Sound panel (type buttons,
 switches, a slider drag as one undo step, section bypass, Auto-Match, ducking, Browse presets;
 `essential-sound-*.png`).
-`crates/ui-egui/tests/clip_audio_ui.rs` covers the audio of video clips (#223): the linked audio's
+`crates/ui-egui/tests/it/clip_audio_ui.rs` covers the audio of video clips (#223): the linked audio's
 Volume, Channel Volume and Panner in Effect Controls and Properties, and the Volume line on audio
 clips in the Timeline (a drag is one undo step, Pen-tool keyframes, keyframe drags, a click or
 right-click on the line still reaches the clip; `FILMCRAFT_UI_SHOTS=<dir>` writes `volume-*.png`).
@@ -214,12 +222,12 @@ and the WAV export equals it.
 `perf_full_dialogue_chain_realtime_factor` (ignored; run with `--release`) prints the realtime factor of
 all nine Dialogue effects on one clip (22× on one core).
 
-`crates/ui-egui/tests/export_ui.rs` drives Export mode: the settings column and Summary, editing a
+`crates/ui-egui/tests/it/export_ui.rs` drives Export mode: the settings column and Summary, editing a
 setting turning the preset into Custom, the Preset Manager (search, favourite star, save, apply,
 delete), the queue panel (Send to Queue, Up/Down, Cancel, Start, Retry, Clear) with real encodes,
 the Export button and the header's Quick Export popup (`export-*.png` snapshots).
 
-`crates/ui-egui/tests/color_ui.rs` drives colour features the same way (`color-*.png` snapshots):
+`crates/ui-egui/tests/it/color_ui.rs` drives colour features the same way (`color-*.png` snapshots):
 Lumetri Input/Look LUT menus and section switches, the Interpret Footage ▸ Color Management and
 Sequence Color Management dialogs, and the HDR scopes of a PQ sequence.
 
@@ -258,12 +266,12 @@ engine behaviour without a window.
 
 | Benchmark | Command |
 |---|---|
-| H.264 decode, 1080p, threads sweep | `cargo test --release -p filmcraft-h264 --test perf -- --ignored --nocapture` |
-| HEVC decode, 1080p / 2160p | `cargo test --release -p filmcraft-hevc --test perf -- --ignored --nocapture` |
-| ProRes decode/encode | `cargo test --release -p filmcraft-prores --test perf -- --ignored --nocapture` |
+| H.264 decode, 1080p, threads sweep | `cargo test --release -p filmcraft-h264 --test it perf:: -- --ignored --nocapture` |
+| HEVC decode, 1080p / 2160p | `cargo test --release -p filmcraft-hevc --test it perf:: -- --ignored --nocapture` |
+| ProRes decode/encode | `cargo test --release -p filmcraft-prores --test it perf:: -- --ignored --nocapture` |
 | Encoder speed / PSNR / bitrate | `cargo run --release -p filmcraft-h264enc --example h264enc_synth -- …` |
 | Decode a real file through the media stack | `cargo run --release -p filmcraft-cli -- bench-decode file.mp4 --frames 120` |
-| Coding-tool coverage of the fixtures | `cargo test --release -p filmcraft-h264 --test conformance coverage_report -- --ignored --nocapture` (same for `hevc`) |
+| Coding-tool coverage of the fixtures | `cargo test --release -p filmcraft-h264 --test it conformance::coverage_report -- --ignored --nocapture` (same for `hevc`) |
 | **Whole-app suite**: decode fps per codec, playback, scrubbing, timeline UI, export, project save/open, peak RSS | `cargo xtask bench` ([performance.md](performance.md)) |
 
 `cargo xtask bench` (the example `crates/ui-egui/examples/bench/`) runs six sections, each in its
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 838a98ad0..c0ff7111d 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -19,12 +19,12 @@ open interaction reports (about 40 of the 188 open issues).
 | Menus | 366 in-scope menu items | ~338 present (label diff, 92%) | 92% | spelling, Render and Replace, 5 workspaces | 10–20 h |
 | Keyboard | Premiere default keyboard + editor | Premiere-compatible preset (143 keyboard-only commands; 39 cloud / absent-panel keys skipped with reasons), FilmCraft / FCP / Avid presets, editor | 90% | Ctrl chords (#256 fixed), modifier hints on Windows (#270 fixed) | 5–10 h |
 | Timeline editing tools | Selection, Track Select, Ripple / Rolling / Rate Stretch, Razor, Slip / Slide, Pen, Hand, Zoom, Type | all present, trim modes, Trim Monitor, dynamic trimming | 80% | deselect in empty space (#683), gap delete (#648, #668), clip stretch (#653), new tracks by dropping (#483), Escape cancels drag (#580 fixed), delete in timeline (#680, #404) | 30–50 h |
-| Program monitor on-screen controls | Motion / Transform handles, mask handles, safe margins, guides | guides, rulers, safe margins, snapping, mask drawing; **no transform handles** (#639); Button Editor (+) does nothing (#431) | 55% | #639, #431 | 15–25 h |
+| Program monitor on-screen controls | Motion / Transform handles, mask handles, safe margins, guides, transparency grid | guides, rulers, safe margins, transparency grid, snapping, mask drawing; **no transform handles** (#639); Button Editor (+) does nothing (#431) | 55% | #639, #431 | 15–25 h |
 | Effect Controls | property rows, keyframe area with zoom, divider, graphs, eyedroppers | rows, keyframes, value / velocity graphs, eyedropper (#518); missing keyframe zoom (#641, #645), draggable divider (#643), row lines (#640), Position curves (#448) | 60% | #412, #640–#645, #448 | 15–25 h |
 | Panels and docking | 17 workspaces, dock / undock / float, drop zones | 11 workspaces, docking; rearranging windows reported missing (#493); multi-monitor floating windows (#466) | 60% | #493, #466 | 20–35 h |
 | Project panel | List / Icon / Freeform, hover scrub, marquee | all three views, hover scrub, view presets; no marquee (#578), Freeform bins and pan (#579), bins can't be left on Windows (#587), duplicate imports allowed (#356) | 75% | #578, #579, #587, #456 | 10–20 h |
-| Timeline display | filmstrip thumbnails, waveforms, track heights, renaming | clip thumbnails, waveforms, heights; no continuous filmstrip (#614), no track rename (#654), wheel scroll in audio area (#400) | 70% | #614, #654, #400 | 8–15 h |
-| Transitions | drag, resize, alignment, edit in Effect Controls | drag / select / resize (#503); settings and the transition's own timeline in Effect Controls, drag to slide or resize (#577); no A/B previews with Start / End sliders | 70% | #577 | 5–10 h |
+| Timeline display | filmstrip thumbnails, waveforms, track heights, renaming, duplicate frame markers | clip thumbnails, waveforms, heights, duplicate frame markers; no continuous filmstrip (#614), no track rename (#654), wheel scroll in audio area (#400) | 70% | #614, #654, #400 | 8–15 h |
+| Transitions | drag, resize, alignment, edit in Effect Controls | drag / select / resize (#503); settings and the transition's own timeline in Effect Controls, drag to slide or resize (#577), drag the cut to move it with the transition; no A/B previews with Start / End sliders | 70% | #577 | 5–10 h |
 | Numeric entry and scrubbing | scrubbable hot text, typed values | scrubbable values, timecode scrub-edit (#576); audio clip mixer values cannot be typed (#481) | 80% | #481 | 3–6 h |
 | Drag and drop | OS files into Project / Timeline, clipboard paste | OS drops into the timeline (#517); no clipboard paste of images / files (#611) | 70% | #519, #611 | 5–10 h |
 | Theme and appearance | dark / light, brightness | dark / light / system (#505, #555) | 85% | macOS window controls (#637), Wayland title bar (#433), X11 scale (#457) | 5–10 h |
diff --git a/packaging/env.sh b/packaging/env.sh
index d227a71ab..6d8822693 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -19,10 +19,11 @@ workspace_version() {
     /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
     in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
   ' "$ROOT/Cargo.toml"
+  return 0
 }
 
 VERSION="${FILMCRAFT_VERSION:-$(workspace_version)}"
-if [ -z "$VERSION" ]; then
+if [[ -z "$VERSION" ]]; then
   echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
   exit 1
 fi
@@ -32,7 +33,7 @@ DIST="${DIST:-$ROOT/dist/release}"
 mkdir -p "$DIST"
 export DIST
 
-if [ -z "${FILMCRAFT_BUILD_SHA:-}" ]; then
+if [[ -z "${FILMCRAFT_BUILD_SHA:-}" ]]; then
   FILMCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
 fi
 export FILMCRAFT_BUILD_SHA
@@ -41,32 +42,37 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
 warn() {
-  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return 0
 }
 
 # Copy licence and readme files that exist into a package directory, plus the licences of the
 # craft-fonts fonts the build embedded (only when built with CRAFT_FONTS_DIR).
 copy_docs() {
   local dest="$1" f
-  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
-    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT NOTICE; do
+    if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
+  return 0
 }
 
 # Copy each craft-fonts licence ($CRAFT_FONTS_DIR/fonts/<family>/OFL.txt) to <dest>/OFL-<family>.txt.
 # Does nothing without CRAFT_FONTS_DIR.
 copy_font_licences() {
   local dest="$1" lic family
-  if [ -z "${CRAFT_FONTS_DIR:-}" ]; then return 0; fi
+  if [[ -z "${CRAFT_FONTS_DIR:-}" ]]; then return 0; fi
   for lic in "$CRAFT_FONTS_DIR"/fonts/*/OFL.txt; do
-    [ -f "$lic" ] || continue
+    [[ -f "$lic" ]] || continue
     family="$(basename "$(dirname "$lic")")"
     cp "$lic" "$dest/OFL-$family.txt"
   done
+  return 0
 }
 
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return 0
 }
diff --git a/packaging/freebsd/package.sh b/packaging/freebsd/package.sh
index 36835b5aa..ab24da426 100755
--- a/packaging/freebsd/package.sh
+++ b/packaging/freebsd/package.sh
@@ -20,7 +20,7 @@ APP_ID=ai.storyteller.filmcraft
 
 SKIP_BUILD=0
 DRY_RUN=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --dry-run) DRY_RUN=1; SKIP_BUILD=1; shift ;;
@@ -36,7 +36,7 @@ case "$MACHINE" in
   arm64 | aarch64) ARCH=aarch64 ;;
   *) echo "unsupported architecture $MACHINE" >&2; exit 2 ;;
 esac
-if [ "$DRY_RUN" = 0 ] && [ "$(uname -s)" != FreeBSD ]; then
+if [[ "$DRY_RUN" = 0 ]] && [[ "$(uname -s)" != FreeBSD ]]; then
   echo "error: build on FreeBSD (or pass --dry-run to check the tree layout)" >&2
   exit 2
 fi
@@ -46,7 +46,7 @@ echo "==> FilmCraft $VERSION for FreeBSD $ARCH"
 
 # The release VM has 12 GB; full parallelism on the biggest crates runs it out of memory.
 export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-4}"
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
   (cd "$ROOT" && cargo build --release --locked -p filmcraft -p filmcraft-cli)
 fi
 WORK="$CARGO_TARGET_DIR/freebsd-package"
@@ -56,7 +56,7 @@ mkdir -p "$WORK"
 
 BIN="$CARGO_TARGET_DIR/release"
 OUT_DIR="$DIST"
-if [ "$DRY_RUN" = 1 ]; then
+if [[ "$DRY_RUN" = 1 ]]; then
   # Stub binaries, and the tarball stays in the work dir so dist/ only ever holds real builds.
   BIN="$WORK/stub-bin"
   OUT_DIR="$WORK"
@@ -81,13 +81,13 @@ sed -e "s/@VERSION@/$VERSION/g" -e "s/@DATE@/$FILMCRAFT_BUILD_DATE/g" \
 cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/filmcraft"
 for f in NOTICE ATTRIBUTION.md; do
-  if [ -f "$ROOT/$f" ]; then install -m 644 "$ROOT/$f" "$STAGE/share/doc/filmcraft/"; fi
+  if [[ -f "$ROOT/$f" ]]; then install -m 644 "$ROOT/$f" "$STAGE/share/doc/filmcraft/"; fi
 done
 
 for f in bin/filmcraft bin/filmcraft-cli "share/applications/$APP_ID.desktop" \
   "share/icons/hicolor/256x256/apps/$APP_ID.png" "share/icons/hicolor/scalable/apps/$APP_ID.svg" \
   share/doc/filmcraft/LICENSE-MIT share/doc/filmcraft/LICENSE-APACHE; do
-  if [ ! -e "$STAGE/$f" ]; then echo "error: $f is missing from the package" >&2; exit 1; fi
+  if [[ ! -e "$STAGE/$f" ]]; then echo "error: $f is missing from the package" >&2; exit 1; fi
 done
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
@@ -96,7 +96,7 @@ tar -C "$WORK" -czf "$OUT_DIR/$BASENAME.tar.gz" "$BASENAME"
 echo "wrote $OUT_DIR/$BASENAME.tar.gz"
 
 "$STAGE/bin/filmcraft-cli" --version
-if [ "$DRY_RUN" = 1 ]; then
+if [[ "$DRY_RUN" = 1 ]]; then
   echo "==> dry run: tarball contents"
   tar -tzvf "$OUT_DIR/$BASENAME.tar.gz"
 fi
diff --git a/packaging/icons.sh b/packaging/icons.sh
index dd4014a94..2a947dfae 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -23,7 +23,7 @@ MAC="$TMP/mac.svg"
 sed 's/viewBox="0 0 512 512"/viewBox="-62.14 -62.14 636.27 636.27"/' "$SVG" >"$MAC"
 grep -q 'viewBox="-62.14' "$MAC" || { echo "error: unexpected viewBox in $SVG" >&2; exit 1; }
 
-render() { resvg -w "$2" -h "$2" "$1" "$3" </dev/null; }
+render() { local input="$1" size="$2" output="$3"; resvg -w "$size" -h "$size" "$input" "$output" </dev/null; }
 
 render "$SVG" 1024 "$DIR/filmcraft-1024.png"
 # Runtime window/Dock icon on macOS (apps/filmcraft/src/main.rs embeds it).
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 15d96c156..66406efb9 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -21,7 +21,7 @@ FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
 TARBALL=""
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
@@ -38,7 +38,7 @@ case "$ARCH" in
 esac
 BASENAME="filmcraft-$VERSION-linux-$ARCH"
 TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
-[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+[[ -f "$TARBALL" ]] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
 for tool in flatpak flatpak-builder; do
   command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
 done
@@ -49,7 +49,7 @@ WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"
 tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
-[ -x "$WORK/stage/bin/filmcraft" ] || { echo "error: $TARBALL has no bin/filmcraft" >&2; exit 1; }
+[[ -x "$WORK/stage/bin/filmcraft" ]] || { echo "error: $TARBALL has no bin/filmcraft" >&2; exit 1; }
 cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"
 
 flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
@@ -62,7 +62,7 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
-if [ "$TEST" = 1 ]; then
+if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
   flatpak run --command=filmcraft-cli "$APP_ID" --version
diff --git a/packaging/linux/flatpak/ai.storyteller.filmcraft.yml b/packaging/linux/flatpak/ai.storyteller.filmcraft.yml
index ef8addc75..cf7667ff8 100644
--- a/packaging/linux/flatpak/ai.storyteller.filmcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.filmcraft.yml
@@ -56,6 +56,7 @@ modules:
     build-commands:
       - cargo --offline build --release --locked -p filmcraft -p filmcraft-cli
       - install -Dm755 target/release/filmcraft /app/bin/filmcraft
+      - install -Dm644 NOTICE /app/share/doc/filmcraft/NOTICE
       # The headless CLI and its stdio MCP server, as in the release bundle (#346).
       - install -Dm755 target/release/filmcraft-cli /app/bin/filmcraft-cli
       - install -Dm644 packaging/linux/ai.storyteller.filmcraft.desktop /app/share/applications/ai.storyteller.filmcraft.desktop
diff --git a/packaging/linux/install.sh b/packaging/linux/install.sh
index 033fe9b7e..1240e843b 100755
--- a/packaging/linux/install.sh
+++ b/packaging/linux/install.sh
@@ -9,10 +9,10 @@ usage() {
 }
 fail() { echo "error: $*" >&2; exit 1; }
 prefix="${HOME:?HOME is not set}/.local"
-while [ "$#" -gt 0 ]; do
+while [[ "$#" -gt 0 ]]; do
   case "$1" in
     --prefix)
-      [ "$#" -ge 2 ] || fail '--prefix needs an absolute path'
+      [[ "$#" -ge 2 ]] || fail '--prefix needs an absolute path'
       prefix="$2"; shift 2 ;;
     -h | --help) usage; exit 0 ;;
     *) usage >&2; fail "unknown argument: $1" ;;
@@ -22,14 +22,14 @@ case "$prefix" in /*) ;; *) fail '--prefix must be an absolute path' ;; esac
 prefix="$(realpath -m -- "$prefix")"
 # Desktop Exec paths cannot contain '='; launchers also misinterpret '%' in executable names.
 [[ "$prefix" != *'='* && "$prefix" != *'%'* && ! "$prefix" =~ [[:cntrl:]] ]] || fail 'prefix cannot contain =, % or control characters'
-[ "$prefix" != / ] || fail 'use /usr/local or a user directory, not /'
+[[ "$prefix" != / ]] || fail 'use /usr/local or a user directory, not /'
 source_dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
-case "$prefix/" in "$source_dir/"*) fail 'choose an installation prefix outside the extracted tarball' ;; esac
+case "$prefix/" in "$source_dir/"*) fail 'choose an installation prefix outside the extracted tarball' ;; *) ;; esac
 app_id=ai.storyteller.filmcraft
 for binary in filmcraft filmcraft-cli; do
-  [ -f "$source_dir/bin/$binary" ] || fail "missing bin/$binary; extract the complete tarball first"
+  [[ -f "$source_dir/bin/$binary" ]] || fail "missing bin/$binary; extract the complete tarball first"
 done
-[ -f "$source_dir/share/applications/$app_id.desktop" ] || fail 'missing desktop entry; extract the complete tarball first'
+[[ -f "$source_dir/share/applications/$app_id.desktop" ]] || fail 'missing desktop entry; extract the complete tarball first'
 
 mkdir -p -- "$prefix/bin" "$prefix/share"
 install -m755 -- "$source_dir/bin/filmcraft" "$prefix/bin/filmcraft"
@@ -41,7 +41,7 @@ cp -R -- "$source_dir/share/." "$prefix/share/"
 # https://specifications.freedesktop.org/desktop-entry/latest/exec-variables.html
 exec_path="$(printf '%s' "$prefix/bin/filmcraft" | sed 's/[\\"`$]/\\&/g; s/\\/\\\\/g')"
 try_path="$(printf '%s' "$prefix/bin/filmcraft" | sed 's/\\/\\\\/g')"
-while IFS= read -r line || [ -n "$line" ]; do
+while IFS= read -r line || [[ -n "$line" ]]; do
   case "$line" in
     Exec=*) printf 'Exec="%s" %%F\n' "$exec_path" ;;
     TryExec=*) printf 'TryExec=%s\n' "$try_path" ;;
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 5001bf716..b841f46d2 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -25,7 +25,7 @@ APP_ID=ai.storyteller.filmcraft
 
 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --formats) FORMATS="$2"; shift 2 ;;
@@ -46,8 +46,8 @@ BASENAME="filmcraft-$VERSION-linux-$ARCH"
 
 echo "==> FilmCraft $VERSION for Linux $ARCH ($FORMATS)"
 
-if [ "$SKIP_BUILD" = 0 ]; then
-  if [ -n "${CROSS_TARGET:-}" ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
+  if [[ -n "${CROSS_TARGET:-}" ]]; then
     (cd "$ROOT" && cargo build --release --locked -p filmcraft -p filmcraft-cli --target "$CROSS_TARGET")
   else
     (cd "$ROOT" && cargo build --release --locked -p filmcraft -p filmcraft-cli)
@@ -79,7 +79,7 @@ if command -v appstreamcli >/dev/null; then
   appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi
 
-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() { local fmt="$1"; case " $FORMATS " in *" $fmt "*) return 0 ;; *) return 1 ;; esac; }
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -104,27 +104,64 @@ fi
 
 # ---- AppImage -----------------------------------------------------------------------------------
 if has appimage; then
+  APPIMAGETOOL_VERSION=1.9.1
+  # appimagetool otherwise embeds type2-runtime's unchecked `continuous` build in every AppImage.
+  RUNTIME_VERSION=20251108
+  case "$ARCH" in
+    x86_64)
+      APPIMAGETOOL_SHA256=ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0
+      RUNTIME_SHA256=2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d
+      ;;
+    aarch64)
+      APPIMAGETOOL_SHA256=f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158
+      RUNTIME_SHA256=00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444
+      ;;
+    *) APPIMAGETOOL_SHA256='' RUNTIME_SHA256='' ;;
+  esac
   APPDIR="$WORK/FilmCraft.AppDir"
   cp -R "$STAGE" "$APPDIR"
-  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
   ln -s usr/bin/filmcraft "$APPDIR/AppRun"
   cp "$HERE/$APP_ID.desktop" "$APPDIR/$APP_ID.desktop"
   cp "$ROOT/assets/app-icon/hicolor/256x256/apps/$APP_ID.png" "$APPDIR/$APP_ID.png"
   ln -s "$APP_ID.png" "$APPDIR/.DirIcon"
 
+  if [[ -z "$RUNTIME_SHA256" ]]; then
+    echo "no pinned AppImage runtime for $ARCH" >&2
+    exit 2
+  fi
+  RUNTIME="$CARGO_TARGET_DIR/appimage-runtime-$RUNTIME_VERSION-$ARCH"
+  if [[ ! -f "$RUNTIME" ]]; then
+    download="$RUNTIME.download"
+    curl --proto '=https' -fsSL -o "$download" \
+      "https://github.com/AppImage/type2-runtime/releases/download/$RUNTIME_VERSION/runtime-$ARCH"
+    printf '%s  %s\n' "$RUNTIME_SHA256" "$download" | sha256sum -c -
+    mv "$download" "$RUNTIME"
+  fi
+  printf '%s  %s\n' "$RUNTIME_SHA256" "$RUNTIME" | sha256sum -c -
+
   TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
-  if [ -z "$TOOL" ]; then
-    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
-    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
-      chmod +x "$TOOL"
+  if [[ -z "$TOOL" ]]; then
+    if [[ -z "$APPIMAGETOOL_SHA256" ]]; then
+      echo "no pinned appimagetool for $ARCH; set APPIMAGETOOL or put appimagetool on PATH" >&2
+      exit 2
     fi
+    TOOL="$CARGO_TARGET_DIR/appimagetool-$APPIMAGETOOL_VERSION-$ARCH.AppImage"
+    if [[ ! -x "$TOOL" ]]; then
+      download="$TOOL.download"
+      curl --proto '=https' -fsSL -o "$download" \
+        "https://github.com/AppImage/appimagetool/releases/download/$APPIMAGETOOL_VERSION/appimagetool-$ARCH.AppImage"
+      printf '%s  %s\n' "$APPIMAGETOOL_SHA256" "$download" | sha256sum -c -
+      chmod 755 "$download"
+      mv "$download" "$TOOL"
+    fi
+    printf '%s  %s\n' "$APPIMAGETOOL_SHA256" "$TOOL" | sha256sum -c -
   fi
   # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be
   # relative, e.g. target/agent-<name>).
   OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage"
   APPDIR="$(cd "$APPDIR" && pwd)"
   TOOL="$(cd "$(dirname "$TOOL")" && pwd)/$(basename "$TOOL")"
+  RUNTIME="$(cd "$(dirname "$RUNTIME")" && pwd)/$(basename "$RUNTIME")"
   # A .zsync left by an earlier run would hide a missing zsyncmake and describe another file.
   rm -f "$OUT.zsync"
   # Update information: AppImageUpdate, AppImageLauncher and the like read it from the file and
@@ -136,18 +173,18 @@ if has appimage; then
   # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime,
   # so users don't need libfuse2 either. With zsyncmake on the host (CI installs the zsync
   # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
-  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
+  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream --runtime-file "$RUNTIME" -u "$UPDATE_INFO" "$APPDIR" "$OUT")
   echo "wrote $OUT"
-  if [ -s "$OUT.zsync" ]; then
+  if [[ -s "$OUT.zsync" ]]; then
     echo "wrote $OUT.zsync"
   else
     warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
   fi
 fi
 
-if [ -z "${CROSS_TARGET:-}" ]; then
+if [[ -z "${CROSS_TARGET:-}" ]]; then
   "$STAGE/usr/bin/filmcraft-cli" --version
-elif [ -n "${EMULATOR:-}" ]; then
+elif [[ -n "${EMULATOR:-}" ]]; then
   "$EMULATOR" "$STAGE/usr/bin/filmcraft-cli" --version
 fi
 echo "==> done"
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index 2a11b5309..4fa50e08f 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -12,14 +12,14 @@ umask 077
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 
-if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
   warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
   exit 0
 fi
 
 TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
 KEYCHAIN="$TMP/filmcraft-signing.keychain-db"
-CERT="$TMP/filmcraft-signing.p12"
+CERT="$(mktemp "$TMP/filmcraft-signing.XXXXXX.p12")"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
 trap 'rm -f "$CERT"' EXIT
@@ -36,13 +36,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS"
 security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
 
 IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
-if [ -z "$IDENTITY" ]; then
+if [[ -z "$IDENTITY" ]]; then
   security find-identity -v -p codesigning "$KEYCHAIN" >&2
   echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
   exit 1
 fi
 echo "Imported signing identity $IDENTITY"
-if [ -n "${GITHUB_ENV:-}" ]; then
+if [[ -n "${GITHUB_ENV:-}" ]]; then
   { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
 else
   echo "MACOS_SIGN_IDENTITY=$IDENTITY"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 85902b91b..609dd7376 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -19,7 +19,7 @@ HERE="$ROOT/packaging/macos"
 
 ARCH=universal
 SKIP_BUILD=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --arch) ARCH="$2"; shift 2 ;;
     --skip-build) SKIP_BUILD=1; shift ;;
@@ -44,9 +44,9 @@ DMG="$DIST/filmcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/filmcraft-cli-$VERSION-macos-$ARCH.zip"
 
 NOTARIZE=0
-if [ "$IDENTITY" = "-" ]; then
+if [[ "$IDENTITY" = "-" ]]; then
   warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
-elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+elif [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
   NOTARIZE=1
 else
   warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
@@ -55,7 +55,7 @@ fi
 echo "==> FilmCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize: $NOTARIZE"
 
 # ---- build -------------------------------------------------------------------------------------
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
   args=()
   for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
   (cd "$ROOT" && cargo build --release --locked -p filmcraft -p filmcraft-cli "${args[@]}")
@@ -74,9 +74,9 @@ done
 sign() {
   # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
   local ts=(--timestamp)
-  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  [[ "$IDENTITY" = "-" ]] && ts=(--timestamp=none)
   local kc=()
-  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  [[ -n "${MACOS_KEYCHAIN:-}" ]] && kc=(--keychain "$MACOS_KEYCHAIN")
   codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
 }
 
@@ -88,8 +88,8 @@ notarize() {
   echo "$out"
   id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
   status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
-  if [ "$status" != "Accepted" ]; then
-    if [ -n "$id" ]; then
+  if [[ "$status" != "Accepted" ]]; then
+    if [[ -n "$id" ]]; then
       xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
     fi
     echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
@@ -103,6 +103,7 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 # Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
 cp "$WORK/bin/filmcraft" "$APP/Contents/MacOS/FilmCraft"
 cp "$ROOT/assets/app-icon/filmcraft.icns" "$APP/Contents/Resources/FilmCraft.icns"
+cp "$ROOT/NOTICE" "$APP/Contents/Resources/"
 sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \
   -e "s/@BUILD_SHA@/${FILMCRAFT_BUILD_SHA:-unknown}/g" \
   "$HERE/Info.plist.in" >"$APP/Contents/Info.plist"
@@ -117,7 +118,7 @@ sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/
 sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
 codesign --verify --strict --deep --verbose=2 "$APP"
 
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/FilmCraft-notarize.zip"
   notarize "$WORK/FilmCraft-notarize.zip"
   xcrun stapler staple "$APP"
@@ -144,7 +145,7 @@ hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
   xcrun stapler staple "$DMG"
   xcrun stapler validate "$DMG"
@@ -162,7 +163,7 @@ codesign --verify --strict --verbose=2 "$CLI_DIR/filmcraft-cli"
 rm -f "$CLI_ZIP"
 ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
 # A bare Mach-O can't carry a stapled ticket; Gatekeeper looks the notarization up online.
-if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+if [[ "$NOTARIZE" = 1 ]]; then notarize "$CLI_ZIP"; fi
 
 "$WORK/bin/filmcraft-cli" --version
 echo "==> done"
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
index fa208cad6..0aa031325 100755
--- a/packaging/web/package.sh
+++ b/packaging/web/package.sh
@@ -11,10 +11,10 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 HERE="$ROOT/packaging/web"
 
-if [ "${1:-}" != "--skip-build" ]; then
+if [[ "${1:-}" != "--skip-build" ]]; then
   # CI (the shared release workflow installs only trunk): install the wasm-bindgen CLI at the
   # crate's exact version. Locally, `cargo xtask web` says which version to install.
-  if [ -n "${CI:-}" ]; then
+  if [[ -n "${CI:-}" ]]; then
     WASM_BINDGEN_VERSION="$(sed -n 's/^const WASM_BINDGEN: &str = "\(.*\)";$/\1/p' "$ROOT/xtask/src/main.rs")"
     if ! { command -v wasm-bindgen >/dev/null && wasm-bindgen --version | grep -qF "$WASM_BINDGEN_VERSION"; }; then
       cargo install wasm-bindgen-cli --version "$WASM_BINDGEN_VERSION" --locked
@@ -24,7 +24,7 @@ if [ "${1:-}" != "--skip-build" ]; then
 fi
 
 SITE="$CARGO_TARGET_DIR/web/dist"
-[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+[[ -f "$SITE/index.html" ]] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
 # Paths must be relative so the site works under any prefix.
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
   echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
diff --git a/packaging/windows/filmcraft.wxs b/packaging/windows/filmcraft.wxs
index 91eb71de6..19f1c7b5c 100644
--- a/packaging/windows/filmcraft.wxs
+++ b/packaging/windows/filmcraft.wxs
@@ -7,6 +7,9 @@
   Per-machine install into Program Files and a Start Menu shortcut. No file associations.
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <?ifndef HasCraftFontLicences ?>
+  <?define HasCraftFontLicences=0 ?>
+  <?endif ?>
   <Package
       Name="FilmCraft"
       Manufacturer="Learning Machines LLC"
@@ -34,13 +37,22 @@
     <StandardDirectory Id="ProgramMenuFolder" />
 
     <Feature Id="Main" Title="FilmCraft" Level="1">
+      <?if $(var.HasCraftFontLicences) = 1 ?>
+      <ComponentGroupRef Id="CraftFontLicences" />
+      <?endif ?>
       <ComponentGroupRef Id="FilmcraftFiles" />
     </Feature>
   </Package>
 
   <Fragment>
+    <?if $(var.HasCraftFontLicences) = 1 ?>
+    <ComponentGroup Id="CraftFontLicences" Directory="INSTALLFOLDER">
+      <Files Include="$(var.DocsDir)\**" />
+    </ComponentGroup>
+    <?endif ?>
     <ComponentGroup Id="FilmcraftFiles" Directory="INSTALLFOLDER">
       <Component Id="FilmcraftApp" Guid="15933017-925B-4963-8992-52000EB26AAA">
+        <File Id="FilmcraftNotice" Source="$(var.BinDir)\NOTICE" KeyPath="no" />
         <File Id="FilmcraftExe" Source="$(var.BinDir)\filmcraft.exe" KeyPath="yes">
           <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="FilmCraft"
               Description="FilmCraft video editor" WorkingDirectory="INSTALLFOLDER" Advertise="yes"
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index faa4b8638..4fc87aa8e 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -86,15 +86,31 @@ foreach ($check in @(@('filmcraft.exe', 2), @('filmcraft-cli.exe', 3))) {
 $Stage = Join-Path $TargetDir "windows-package\$Arch"
 Remove-Item -Recurse -Force $Stage -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Stage | Out-Null
+# Dependency font notices are required even without optional craft-fonts.
+Copy-Item -LiteralPath (Join-Path $Root 'NOTICE') -Destination $Stage
 Copy-Item (Join-Path $Bin 'filmcraft.exe'), (Join-Path $Bin 'filmcraft-cli.exe') $Stage
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'filmcraft.exe') (Join-Path $Stage 'filmcraft-cli.exe')
 
+# ---- font notices for the MSI ------------------------------------------------------------------
+# The portable ZIP already carries these notices; stage the complete files before MSI creation too.
+$Docs = Join-Path $Stage 'font-licences'
+New-Item -ItemType Directory -Force -Path $Docs | Out-Null
+$HasCraftFontLicences = 0
+if ($env:CRAFT_FONTS_DIR) {
+  foreach ($ofl in Get-ChildItem -Path (Join-Path $env:CRAFT_FONTS_DIR 'fonts\*\OFL.txt') -File -ErrorAction SilentlyContinue) {
+    Copy-Item -LiteralPath $ofl.FullName -Destination (Join-Path $Docs "OFL-$($ofl.Directory.Name).txt")
+    $HasCraftFontLicences = 1
+  }
+}
+# ---- end font notices for the MSI --------------------------------------------------------------
+
 # ---- MSI ---------------------------------------------------------------------------------------
 $Msi = Join-Path $Dist "filmcraft-$Version-windows-$Arch.msi"
 Invoke-Native 'wix build' {
   wix build (Join-Path $PSScriptRoot 'filmcraft.wxs') -arch $Arch `
     -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\filmcraft.ico')" `
+    -d "DocsDir=$Docs" -d "HasCraftFontLicences=$HasCraftFontLicences" `
     -o $Msi
 }
 # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
@@ -111,7 +127,7 @@ Set-Content -Encoding ascii -Path (Join-Path $Portable 'portable.txt') -Value @(
   'FilmCraft portable: preferences, presets, logs and crash recovery are kept in the data folder',
   'next to filmcraft.exe. Delete this file to use %APPDATA%\FilmCraft instead.'
 )
-foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
+foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE', 'NOTICE') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
 }
diff --git a/packaging/windows/sign.ps1 b/packaging/windows/sign.ps1
index 07aa8bef5..b083fc42f 100644
--- a/packaging/windows/sign.ps1
+++ b/packaging/windows/sign.ps1
@@ -56,8 +56,8 @@ if (-not $haveCert -and -not $haveAzure) {
 
 $script:SignTool = Find-SignTool
 $common = @('sign', '/v', '/fd', 'SHA256', '/td', 'SHA256', '/d', 'FilmCraft', '/du', 'https://github.com/storytold/filmcraft')
-$tmp = Join-Path ([IO.Path]::GetTempPath()) "filmcraft-sign-$PID"
-New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+$tmp = Join-Path ([IO.Path]::GetTempPath()) "filmcraft-sign-$([IO.Path]::GetRandomFileName())"
+New-Item -ItemType Directory -Path $tmp | Out-Null
 
 try {
   if ($haveCert) {
@@ -73,8 +73,15 @@ try {
     Write-Output "Signing with Azure Trusted Signing ($env:AZURE_SIGNING_ACCOUNT / $env:AZURE_CERT_PROFILE): $($Files -join ', ')"
     # The dlib authenticates with DefaultAzureCredential, which reads AZURE_TENANT_ID,
     # AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment.
+    $trustedSigningVersion = '1.0.95'
+    $trustedSigningSha256 = '3bfcf1e0a3cb42af1692f0a8ed45c15de070c2de86f28a59b2795d904d8a920f'
     $pkg = Join-Path $tmp 'trusted-signing.zip'
-    Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client' -OutFile $pkg
+    $uri = "https://api.nuget.org/v3-flatcontainer/microsoft.trusted.signing.client/$trustedSigningVersion/microsoft.trusted.signing.client.$trustedSigningVersion.nupkg"
+    Invoke-WebRequest -Uri $uri -OutFile $pkg
+    $actualHash = (Get-FileHash -Path $pkg -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualHash -ne $trustedSigningSha256) {
+      throw "Microsoft.Trusted.Signing.Client $trustedSigningVersion checksum mismatch"
+    }
     Expand-Archive -Path $pkg -DestinationPath (Join-Path $tmp 'client') -Force
     $dlib = Get-ChildItem -Path (Join-Path $tmp 'client') -Recurse -Filter Azure.CodeSigning.Dlib.dll |
       Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -First 1
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..bd9f6a3f9
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,3 @@
+sonar.projectKey=storytold_filmcraft
+sonar.organization=storytold
+sonar.coverage.exclusions=**/tools/**,**/docs/**,**/examples/**
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 819326fcf..98902837a 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -16,7 +16,10 @@
 //!   lists, against a reference list (default: the local `plan/premiere/<area>.json`), presence and
 //!   placement reported separately (`parity.rs`, docs/gaps.md G7).
 //! - `ico <out.ico> <in.png>…`: pack PNGs into a Windows `.ico` (used by `packaging/icons.sh`).
-//! - `ci`: fmt check, clippy -D warnings, tests, layers, assets, wasm.
+//! - `i18n-report`: print the interface strings each language's catalog lacks (they show in
+//!   English). It never fails.
+//! - `ci`: fmt check, clippy -D warnings, tests (`cargo nextest run` when installed) and doctests,
+//!   the i18n report, layers, assets, wasm.
 
 mod ico;
 mod parity;
@@ -259,7 +262,7 @@ const WEB_CRATES: &[&str] = &["filmcraft-ui-egui", "filmcraft-web"];
 fn wasm() -> Result<(), String> {
     let md = metadata()?;
     let mut cmd = Command::new(env!("CARGO"));
-    cmd.args(["check", "--target", "wasm32-unknown-unknown"]);
+    cmd.args(["check", "--target", "wasm32-unknown-unknown", "--keep-going"]);
     let mut n = 0;
     for (name, _) in workspace_crates(&md) {
         if layer_of(&name).is_some_and(|l| l <= 4) || WEB_CRATES.contains(&name.as_str()) {
@@ -372,9 +375,8 @@ fn serve_dir(dir: &std::path::Path, port: u16) -> Result<(), String> {
                     break;
                 }
             }
-            let path = line.split_whitespace().nth(1).unwrap_or("/").split(['?', '#']).next().unwrap_or("/").to_string();
-            let rel = if path == "/" { "index.html".to_string() } else { path.trim_start_matches('/').replace("..", "") };
-            let file = dir.join(&rel);
+            let path = line.split_whitespace().nth(1).unwrap_or("/").split(['?', '#']).next().unwrap_or("/");
+            let file = served_path(&dir, path);
             let (status, body) = match std::fs::read(&file) {
                 Ok(b) => ("200 OK", b),
                 Err(_) => ("404 Not Found", b"not found".to_vec()),
@@ -400,26 +402,59 @@ fn serve_dir(dir: &std::path::Path, port: u16) -> Result<(), String> {
     Ok(())
 }
 
-/// (crate, test target) whose ignored `generate_fixtures` test builds that crate's fixture matrix.
-const FIXTURE_GENERATORS: &[(&str, &str)] = &[
-    ("h264", "conformance"),
-    ("hevc", "conformance"),
-    ("isobmff", "oracle_demux"),
-    ("matroska", "oracle"),
-    ("prores", "oracle_decode"),
-    ("dnx", "oracle_decode"),
-    ("codecs", "mxf_oracle"),
-    ("codecs", "mpeg_oracle"),
-    ("mpeg2v", "oracle"),
-    ("ac3", "oracle"),
-    ("mpa", "oracle"),
-    ("codecs", "ogg_oracle"),
+fn served_path(root: &std::path::Path, request_path: &str) -> std::path::PathBuf {
+    use std::path::Component;
+    if request_path == "/" {
+        return root.join("index.html");
+    }
+    let repeated_root = request_path.starts_with("//");
+    let raw = request_path.strip_prefix('/').unwrap_or(request_path);
+    let relative = std::path::Path::new(raw);
+    let windows_prefix = raw.contains('\\') || raw.split('/').next().is_some_and(|part| part.ends_with(':'));
+    if !repeated_root && !windows_prefix && relative.components().all(|part| matches!(part, Component::Normal(_))) {
+        root.join(relative)
+    } else {
+        // A path that cannot name a child of the document root deliberately misses.
+        root.join(".invalid-request-path")
+    }
+}
+
+#[cfg(test)]
+mod serve_tests {
+    use super::served_path;
+    use std::path::Path;
+
+    #[test]
+    fn preview_paths_cannot_escape_the_document_root() {
+        let root = Path::new("/dist");
+        assert_eq!(served_path(root, "/"), root.join("index.html"));
+        assert_eq!(served_path(root, "/assets/app.js"), root.join("assets/app.js"));
+        for hostile in ["/../etc/passwd", "//etc/passwd", "/a/../../etc/passwd", r"C:\\Windows\\win.ini"] {
+            assert_eq!(served_path(root, hostile), root.join(".invalid-request-path"));
+        }
+    }
+}
+
+/// (crate, test target, test) whose ignored test builds that crate's fixture matrix.
+const FIXTURE_GENERATORS: &[(&str, &str, &str)] = &[
+    ("h264", "it", "conformance::generate_fixtures"),
+    ("hevc", "it", "conformance::generate_fixtures"),
+    ("isobmff", "it", "oracle_demux::generate_fixtures"),
+    ("matroska", "oracle", "generate_fixtures"),
+    ("prores", "it", "oracle_decode::generate_fixtures"),
+    ("dnx", "it", "oracle_decode::generate_fixtures"),
+    ("codecs", "it", "mxf_oracle::generate_fixtures"),
+    ("codecs", "it", "mpeg_oracle::generate_fixtures"),
+    ("mpeg2v", "it", "oracle::generate_fixtures"),
+    ("ac3", "oracle", "generate_fixtures"),
+    ("mpa", "oracle", "generate_fixtures"),
+    ("codecs", "it", "ogg_oracle::generate_fixtures"),
 ];
 
 fn fixtures(only: &[String]) -> Result<(), String> {
-    let unknown: Vec<&String> = only.iter().filter(|o| !FIXTURE_GENERATORS.iter().any(|(c, _)| *c == short(o))).collect();
+    let unknown: Vec<&String> = only.iter().filter(|o| !FIXTURE_GENERATORS.iter().any(|(c, _, _)| *c == short(o))).collect();
     if !unknown.is_empty() {
-        let known: Vec<&str> = FIXTURE_GENERATORS.iter().map(|(c, _)| *c).collect();
+        let known: Vec<&str> = FIXTURE_GENERATORS.iter().map(|(c, _, _)| *c).collect();
         return Err(format!("no fixture generator for {unknown:?} (known: {})", known.join(", ")));
     }
     let Some(ff) = filmcraft_testkit::ffmpeg() else {
@@ -429,11 +464,11 @@ fn fixtures(only: &[String]) -> Result<(), String> {
     println!("fixtures: {}", filmcraft_testkit::fixtures::fixtures_root().display());
     let (mut made, mut cached, mut skipped) = (0, 0, 0);
     let mut failed = Vec::new();
-    for (krate, target) in FIXTURE_GENERATORS.iter().filter(|(c, _)| only.is_empty() || only.iter().any(|o| short(o) == *c)) {
+    for (krate, target, test) in FIXTURE_GENERATORS.iter().filter(|(c, _, _)| only.is_empty() || only.iter().any(|o| short(o) == *c)) {
         let pkg = format!("filmcraft-{krate}");
-        println!("\n== {pkg} ({target})");
+        println!("\n== {pkg} ({test})");
         let mut cmd = Command::new(env!("CARGO"));
-        cmd.args(["test", "--release", "-p", &pkg, "--test", target, "--", "--ignored", "--exact", "generate_fixtures", "--nocapture"]);
+        cmd.args(["test", "--release", "-p", &pkg, "--test", target, "--", "--ignored", "--exact", test, "--nocapture"]);
         cmd.stderr(std::process::Stdio::inherit());
         let out = cmd.output().map_err(|e| e.to_string())?;
         for line in String::from_utf8_lossy(&out.stdout).lines() {
@@ -456,13 +491,40 @@ fn fixtures(only: &[String]) -> Result<(), String> {
 fn ci() -> Result<(), String> {
     let cargo = env!("CARGO");
     run(Command::new(cargo).args(["fmt", "--check"]))?;
-    run(Command::new(cargo).args(["clippy", "--workspace", "--all-targets", "--release", "--", "-D", "warnings"]))?;
-    run(Command::new(cargo).args(["test", "--workspace", "--release"]))?;
+    run(Command::new(cargo).args(["clippy", "--workspace", "--all-targets", "--", "-D", "warnings"]))?;
+    let tested = tests();
+    i18n_report();
+    tested?;
     layers()?;
     assets()?;
     wasm()
 }
 
+/// Lib, bin and integration tests (examples aren't linked; clippy checked them), then doctests,
+/// which nextest doesn't run.
+fn tests() -> Result<(), String> {
+    let cargo = env!("CARGO");
+    let targets = ["--workspace", "--lib", "--bins", "--tests", "--no-fail-fast"];
+    let nextest = Command::new(cargo).args(["nextest", "--version"]).output().is_ok_and(|o| o.status.success());
+    if nextest {
+        run(Command::new(cargo).args(["nextest", "run"]).args(targets))?;
+    } else {
+        println!("cargo-nextest not found, running cargo test (install: cargo install cargo-nextest --locked)");
+        run(Command::new(cargo).arg("test").args(targets))?;
+    }
+    run(Command::new(cargo).args(["test", "--workspace", "--doc"]))
+}
+
+/// The missing-translations report (`i18n::tests::missing_translations_report` in
+/// `filmcraft-ui-egui`), printed to the log. A missing translation never fails a build, so
+/// neither does this.
+fn i18n_report() {
+    let args = ["test", "-p", "filmcraft-ui-egui", "--lib", "--", "--exact", "i18n::tests::missing_translations_report", "--nocapture"];
+    if let Err(e) = run(Command::new(env!("CARGO")).args(args)) {
+        eprintln!("i18n report not printed: {e}");
+    }
+}
+
 /// The headless playback benchmark (`crates/ui-egui/examples/bench_playback.rs`); extra
 /// arguments go to the benchmark (`cargo xtask bench-playback --scenario stack3 --res full`).
 fn bench_playback() -> Result<(), String> {
@@ -491,6 +553,10 @@ fn main() -> ExitCode {
         "assets" => assets(),
         "fixtures" => fixtures(&std::env::args().skip(2).collect::<Vec<_>>()),
         "ci" => ci(),
+        "i18n-report" => {
+            i18n_report();
+            Ok(())
+        }
         "bench" => bench(),
         "bench-playback" => bench_playback(),
         "web" => web(&std::env::args().skip(2).collect::<Vec<_>>()),
diff --git a/xtask/src/parity.rs b/xtask/src/parity.rs
index 774a0a76a..0b6f81b19 100644
--- a/xtask/src/parity.rs
+++ b/xtask/src/parity.rs
@@ -38,6 +38,8 @@ use serde_json::Value;
 const MAX_DEPTH: usize = 16;
 /// Most menu items accepted from a reference file.
 const MAX_ITEMS: usize = 20_000;
+/// Most UTF-8 bytes retained in one expanded leaf path.
+const MAX_PATH_BYTES: usize = 4 * 1024;
 /// Keys holding a node's label, and its children.
 const LABEL_KEYS: [&str; 3] = ["name", "title", "label"];
 const CHILD_KEYS: [&str; 6] = ["children", "items", "submenu", "menu", "menuItems", "menu_items"];
@@ -303,6 +305,10 @@ fn push_leaf(prefix: &[String], label: &str, min: usize, out: &mut Vec<Vec<Strin
     if out.len() >= MAX_ITEMS {
         return Err(format!("reference has more than {MAX_ITEMS} items"));
     }
+    let bytes = prefix.iter().try_fold(label.trim().len(), |n, part| n.checked_add(part.len())).ok_or("reference path is too large")?;
+    if bytes > MAX_PATH_BYTES {
+        return Err(format!("reference path has more than {MAX_PATH_BYTES} bytes"));
+    }
     let mut path = prefix.to_vec();
     path.push(label.trim().to_string());
     if path.len() >= min.max(1) {
@@ -622,6 +628,8 @@ mod tests {
             assert!(reference_paths(&json!(many), area).unwrap_err().contains("more than"));
             let bare: Vec<String> = (0..MAX_ITEMS + 1).map(|i| format!("Effect {i}")).collect();
             assert!(area == Area::Menus || reference_paths(&json!(bare), area).unwrap_err().contains("more than"));
+            let long = format!("File > {}", "x".repeat(MAX_PATH_BYTES));
+            assert!(reference_paths(&json!([long]), area).unwrap_err().contains("bytes"));
         }
         // odd values are skipped, not trusted
         assert_eq!(reference_paths(&json!([1, null, true, {"name": 5}, ["File"]]), Area::Menus).unwrap(), Vec::<Vec<String>>::new());